In an iOS incident response, which artifact would be most useful for determining which apps were installed on the device?

The installed application database

During a forensic examination of an iPhone, you need to locate user-created documents that were synced from a computer. Which location on the iOS file system would you examine?

/var/mobile/Library/Preferences/

/var/mobile/Containers/Data/Application/ /Documents/

An employee is suspected of using a messaging app on their company-issued iPhone to share confidential files. Which iOS artifact would contain the most direct evidence of the files shared through the app?

The device's system log, which may record file transfers.

The iCloud backup, which may contain a backup of the app data.

The user's photo library, which may contain screenshots of the conversation.

The app's container in /var/mobile/Containers/Data/Application/ /

An employee is suspected of using a personal iCloud account on a company-issued iPhone to store work documents. Which iOS artifact would provide evidence of iCloud Drive usage?

The device's backup logs, which record iCloud backup activity.

The iCloud Drive app's local cache and database in the app container.

The keychain, which stores iCloud credentials.

The user's Safari history, which may show iCloud.com visits.

A forensic examiner is analyzing a macOS system and needs to determine which configuration profiles are currently installed on the system. Which command-line tool would provide a comprehensive list of installed configuration profiles?

system_profiler SPConfigurationProfileDataType

GIAC iOS and macOS Examiner

Domain 4Objective 4

User Data and System Configuration GIME Practice Questions (Page 4)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

4concepts

Questions 16–20

16foundation · easy
In an iOS incident response, which artifact would be most useful for determining which apps were installed on the device?
Select an answer first
17application · medium
During a forensic examination of an iPhone, you need to locate user-created documents that were synced from a computer. Which location on the iOS file system would you examine?
Select an answer first
18application · medium
An employee is suspected of using a messaging app on their company-issued iPhone to share confidential files. Which iOS artifact would contain the most direct evidence of the files shared through the app?
Select an answer first
19application · medium
An employee is suspected of using a personal iCloud account on a company-issued iPhone to store work documents. Which iOS artifact would provide evidence of iCloud Drive usage?
Select an answer first
20application · medium
A forensic examiner is analyzing a macOS system and needs to determine which configuration profiles are currently installed on the system. Which command-line tool would provide a comprehensive list of installed configuration profiles?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.