An investigator is examining a macOS system and finds a file in the user's ~/Downloads folder that has a quarantine attribute. What does this attribute indicate?

The file was deleted and is in the Trash

The file is encrypted and requires a password to open

The file was created by a system process

The file was downloaded from the internet and has been checked by Gatekeeper

On an iOS device, where are user data artifacts such as app documents and databases typically stored?

In the app's sandboxed container

In the root filesystem's /etc directory

An incident responder is investigating a macOS system where a user's browser homepage was changed to a malicious URL. The user claims they did not change it. The system has a configuration profile that is supposed to lock the homepage. The responder finds that the managed preference file exists but the homepage is still changed. What is the most likely explanation?

The managed preference file was deleted by the user

The configuration profile is not actually enforced because the device is not enrolled in MDM

The user's browser is ignoring the managed preference because it is not a supported key

The browser was reinstalled after the profile was applied

A macOS system is enrolled in an MDM solution. A user reports that a specific restriction is not being applied, even though the MDM profile shows as installed. You need to determine whether the restriction is actually enforced. Which approach would be most effective?

Check the MDM server logs for profile delivery status

Check the user's ~/Library/Preferences for the relevant preference key

Check /Library/Managed Preferences/ for the relevant managed preference file

Check /var/db/ConfigurationProfiles/Store/profiles.plist for the profile's payload

GIAC iOS and macOS Examiner

Domain 4Objective 4

User Data and System Configuration GIME Practice Questions (Page 7)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

4concepts

Questions 31–35

31expert · medium
An investigator is examining a macOS system and finds a file in the user's ~/Downloads folder that has a quarantine attribute. What does this attribute indicate?
Select an answer first
32foundation · easy
On an iOS device, which artifact is most likely to contain user-generated content such as photos or messages?
Select an answer first
33foundation · easy
On an iOS device, where are user data artifacts such as app documents and databases typically stored?
Select an answer first
34expert · hard
An incident responder is investigating a macOS system where a user's browser homepage was changed to a malicious URL. The user claims they did not change it. The system has a configuration profile that is supposed to lock the homepage. The responder finds that the managed preference file exists but the homepage is still changed. What is the most likely explanation?
Select an answer first
35expert · hard
A macOS system is enrolled in an MDM solution. A user reports that a specific restriction is not being applied, even though the MDM profile shows as installed. You need to determine whether the restriction is actually enforced. Which approach would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

User Data and System Configuration GIME Practice Questions (Page 7)

Questions 31–35

An investigator is examining a macOS system and finds a file in the user's ~/Downloads folder that has a quarantine attribute. What does this attribute indicate?

On an iOS device, which artifact is most likely to contain user-generated content such as photos or messages?

On an iOS device, where are user data artifacts such as app documents and databases typically stored?

A macOS system is enrolled in an MDM solution. A user reports that a specific restriction is not being applied, even though the MDM profile shows as installed. You need to determine whether the restriction is actually enforced. Which approach would be most effective?

Keep studying — Incident Response and Advanced Techniques