User Data and System Configuration GIME Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A macOS device was found to have a malicious configuration profile that redirected web traffic through a proxy. The profile has been removed, but you need to determine when the profile was installed. Which artifact would provide the most reliable timestamp for the profile installation?

   • AThe timestamp in the user's notification history
   • BThe timestamp in the system log for the 'profiled' process
   • CThe creation time of the profile plist in /var/db/ConfigurationProfiles/
   • DThe modification time of the profile plist in /var/db/ConfigurationProfiles/
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   You are examining a macOS system and need to find user-specific application preferences that were created by a third-party app installed only for one user. Which directory would you expect to contain these preferences?

   • A/Users/<username>/Library/Preferences/
   • B/Library/Application Support/
   • C/Library/Preferences/
   • D/Users/<username>/Library/Application Support/
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You are analyzing a macOS device and need to determine whether a configuration profile has disabled the ability to change the wallpaper. Which artifact would contain this restriction?

   • AThe system log for the WindowServer process
   • BThe /Library/Preferences/com.apple.desktop.plist
   • CThe user's wallpaper preference plist
   • DThe profile payload in /var/db/ConfigurationProfiles/
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   During an incident response investigation on macOS, which artifact would be most useful for determining which applications a user launched?

   • AThe system's kernel cache
   • BThe /etc/hosts file
   • CThe user's bash history file
   • DApplication plist files in ~/Library/Preferences
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A macOS device was used to access sensitive company data. The user claims that a configuration profile was installed without their knowledge, but the device shows no profile in System Settings. During forensic analysis, you find a plist in /Library/Managed Preferences/ that contains a forced setting for a VPN. However, the corresponding profile is not listed in the ConfigurationProfiles directory. What is the most likely explanation?

   • AA configuration profile was installed and then removed, but the managed preference override remained.
   • BThe device was enrolled in a mobile device management (MDM) solution that applied the setting without leaving a profile.
   • CThe plist is a system file that was modified by a software update.
   • DThe plist was manually created by an attacker to mimic a managed preference.
   Reveal Solution Discussion Select an answer first