A macOS system has a configuration profile that sets a custom wallpaper. The user reports that the wallpaper is not applied. The profile is installed and shows as active. What is the most likely reason?

The profile is not enrolled in MDM

The user changed the wallpaper after the profile was applied

The profile is not signed by a trusted certificate

The wallpaper image file is not accessible to the system

You are investigating a macOS device that was configured with a custom DNS setting. The setting was applied via a configuration profile. Where would you find the most authoritative record of this DNS configuration?

In the system log entries for the configd process

In the configuration profile stored in /var/db/ConfigurationProfiles/

In the /Library/Preferences/SystemConfiguration/preferences.plist file

GIAC iOS and macOS Examiner

Domain 4Objective 4

User Data and System Configuration GIME Practice Questions (Page 5)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

4concepts

Questions 21–25

21expert · hard
A macOS system has a configuration profile that sets a custom wallpaper. The user reports that the wallpaper is not applied. The profile is installed and shows as active. What is the most likely reason?
Select an answer first
22foundation · easy
During a macOS incident response examination, an analyst wants to review user-specific application preferences. Which type of file is most commonly used to store these settings?
Select an answer first
23foundation · easy
An examiner is analyzing an iOS device and finds a file that enforces restrictions and settings for the device. Which artifact is this?
Select an answer first
24foundation · easy
In macOS, where are user-specific application preferences typically stored?
Select an answer first
25application · medium
You are investigating a macOS device that was configured with a custom DNS setting. The setting was applied via a configuration profile. Where would you find the most authoritative record of this DNS configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

User Data and System Configuration GIME Practice Questions (Page 5)

Questions 21–25

A macOS system has a configuration profile that sets a custom wallpaper. The user reports that the wallpaper is not applied. The profile is installed and shows as active. What is the most likely reason?

During a macOS incident response examination, an analyst wants to review user-specific application preferences. Which type of file is most commonly used to store these settings?

An examiner is analyzing an iOS device and finds a file that enforces restrictions and settings for the device. Which artifact is this?

In macOS, where are user-specific application preferences typically stored?

You are investigating a macOS device that was configured with a custom DNS setting. The setting was applied via a configuration profile. Where would you find the most authoritative record of this DNS configuration?

Keep studying — Incident Response and Advanced Techniques