GIAC GIME Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC iOS and macOS Examiner (GIME) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GIME certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GIME Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC iOS and macOS Examiner (GIME) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC iOS and macOS Examiner exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GIME Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GIME Sample Questions:
01. Files in a home directory on a macOS image are owned by a numeric account identifier, which the examiner resolved to a name using the account records recovered from the image itself. The report will attribute those files to that account's holder.
What weakens the attribution?
a) The identifier is reissued whenever the account's password changes, so a name resolved from the records now applies to files written since the most recent change and not to earlier ones
b) Ownership is recorded against the containing directory rather than each file, so the value describes the folder and not the items in it
c) An identifier freed by a deleted account can be issued again, which means the name it resolves to now need not be the name it carried when the files were written
d) The identifier is written by the application that created each file, so it names a process rather than an account
02. A Mac is configured to log one account in automatically when the machine starts. A console session for that account is recorded at the time of the incident, and the case attributes that session to the account's holder.
What does the configuration contribute?
a) That the session could begin from a power-on alone, with no credential entered by anyone
b) Nothing: an automatic login still records the account's credential at each start, and the session record reflects it
c) That the configuration is machine-wide, so it describes the machine's behavior at start rather than anything about the account it names
d) That the holder configured the machine to open that session, which places them at it when the session began
03. You are working on a live Mac under authority and must record a user-facing setting exactly as it stands at this moment. A colleague suggests copying the account's preference file and reading it back at the laboratory.
What is the better step?
a) Open the file in a text editor or a plain viewer on the live machine, which presents the stored values as text and shows the same content the service holds
b) Restart the machine so that pending preferences are written out, then read the file from a settled state
c) Take the copy as suggested and hash it first, since the reading can then be repeated against a file that is demonstrably unchanged and holds the value that was in force
d) Query the value through the system's preferences service with defaults or an equivalent, since a running system can hold a value the file on disk has not yet been written with
04. A Mac with three local accounts carries a background job that starts an unfamiliar tool. The job is defined either in one account's own library or in the system's daemon location, and its definition names no user of its own. You must state who the job runs for and with what privilege.
Which two of these does the job's location on the volume establish?
(Select two)
a) Whether it was put there by the account it runs for or by another account with rights over that account's library
b) Whether it runs with the privilege of the account that is logged in or with the privilege of the system
c) Whether it starts for a single account or for the machine regardless of who logs in
d) Whether it started the tool recently or has been dormant, which the item's own record carries alongside its schedule
05. You must report whether a particular protection was switched on for one account on a Mac at the time of seizure. That account's own preference domain holds no stored value for it, and the machine carries an installed configuration profile.
What follows for the report?
a) The profile's payloads apply to whichever account installed it, so this account is unaffected unless it was the installer
b) With nothing stored in the account's domain the protection was off: a profile supplies a value where the account has already stored one for it to replace
c) The machine-wide store holds the value that applied across the machine's accounts, so reading it settles what was in force for this one
d) The value in force may have been supplied by the profile, so the account's domain cannot be read as the whole answer
06. A full-file-system extraction from an iPhone contains no location records for the period in question, and the investigation is being invited to read that as evidence the handset was not moved.
Which step bears directly on whether such records would have been written at all?
a) Establish whether another device on the same account holds location records or route history for the period, which would show the movements independently
b) Establish what the handset's own configuration permitted, since a setting or a profile restriction can stop the records being written
c) Establish whether the records exist in the account's cloud copy, since the handset holds only what has synced down to it
d) Establish whether the times were read in the wrong reference frame, which can place records outside the window being searched
07. During live response on a Mac, a process of interest is running from a path that no longer exists on the volume: the executable was removed after the process started.
Which step has to be taken before the process is terminated?
a) Terminate the process so that the executable is written back to the volume as it exits, then collect it from there.
b) Search the volume's unallocated space for it once the machine has been imaged, although the executable's blocks stay reachable there only until the space is reused.
c) Recover the executable from the running process itself, because termination releases it.
d) Rebuild the executable from the persistence definition that launched it, which names the path it was started from.
08. Triage of a Mac finds an installed configuration profile that the account holder does not recognize. Among its payloads is a certificate authority added to the system's trust settings.
What does that payload most directly bear on?
a) Traffic the machine treated as securely encrypted, which may have been presented with certificates issued by whoever controls that authority
b) The confidentiality of the profile's other payloads, which are encrypted to that authority and cannot be read without its key
c) The date of enrollment, since the certificate is issued by the service when the machine enrolls and carries the time it was signed
d) Which applications the machine will run, since an authority in its trust settings governs the signatures the machine accepts on executable code, so software signed outside it is refused at launch
09. You have authorized live access to a Mac and must record which configuration profiles are installed on it before the machine is shut down.
Which built-in utility reports that directly?
a) log, which surfaces the management client's activity and the set of profiles it reports as installed
b) hdiutil, which attaches disk images and reports the volumes each one contains
c) dscl, which reads the directory service and lists the local accounts the machine holds
d) profiles, which lists the configuration profiles installed on the machine and the level each one is scoped to
10. On a Mac, an intruder's tool read documents out of a folder the operating system protects, and the examiner must show whether the tool had been granted that access.
Which record answers it?
a) The unified log's entries for the tool, which record each access it made to the protected folder.
b) The account's login records, which place a session around the time the access happened.
c) The system's privacy consent records, which hold what each application was permitted to reach.
d) The folder's own permissions, which show which accounts may read it.
Answers:
|
Question: 01 Answer: c |
Question: 02 Answer: a |
Question: 03 Answer: d |
Question: 04 Answer: b, c |
Question: 05 Answer: d |
|
Question: 06 Answer: b |
Question: 07 Answer: c |
Question: 08 Answer: a |
Question: 09 Answer: d |
Question: 10 Answer: c |
Note: For any error in GIAC iOS and macOS Examiner (GIME) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
