GIAC iOS and macOS Examiner
Domain 4Objective 4
User Data and System Configuration GIME Practice Questions (Page 6)
Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)
35questions here
7free pages
4concepts
Questions 26–30
- 26
An employee's iPhone was used to access corporate email and then was returned to the employee after a security incident. You need to determine whether any corporate email attachments were saved to the device. Which location should you examine first?
Select an answer first - 27
An employee is suspected of exfiltrating data by saving files to a cloud storage folder on their macOS device. Which user data artifact would be most useful to confirm that files were placed in the cloud storage folder and potentially synced?
Select an answer first - 28
You are examining a macOS system and need to determine whether a configuration profile has restricted the use of the camera. Which file would contain the restriction setting?
Select an answer first - 29
During a macOS incident response, you need to identify which applications launch automatically at user login. Which file system location would you examine to find this information?
Select an answer first - 30
Which of the following is an example of a user data artifact on a macOS system?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.