GIAC iOS and macOS Examiner - GIME Exam Questions [2026]

QUESTION NO: 1
Which tool can be used to download and examine iCloud backups during a forensic investigation?

A. Blacklight B. Terminal C. iCloud Extractor D. Activity Monitor

Correct Answer: C

QUESTION NO: 2
Which artifacts are commonly examined during a macOS triage to determine user accounts and system information? (Select two)

A. /var/log/asl/ directory B. /etc/passwd file C. /private/var/db/dslocal/nodes/Default/users/ D. /Library/Preferences/SystemConfiguration/com.apple.preferences.accounts.plist

Correct Answer: C,D

QUESTION NO: 3
During an incident response investigation, which macOS artifacts can provide evidence of malware execution? (Select two)

A. /Library/LaunchAgents B. /var/mobile/Containers/Data/ C. /private/var/db/receipts D. /etc/crontab

Correct Answer: A,D

QUESTION NO: 4
How can an investigator use Unified Logs in macOS for timeline creation?

A. By focusing solely on application crash reports B. By correlating system events across different log levels C. By tracking user logins only D. By analyzing hardware-related messages exclusively

Correct Answer: B

QUESTION NO: 5
Which macOS feature can be analyzed to determine the amount of time a user spends on specific applications?

A. Keychain Access B. Screen Time C. Launchpad D. Activity Monitor

Correct Answer: B

QUESTION NO: 6
During an investigation of an iPhone, you need to gather evidence of a suspect's recent locations. The Maps application shows several recent trips, but you are unsure of their exact destinations.
Which steps will you take to analyze the Maps application data to confirm the locations? (Select three correct answers)

A. Use timestamp data to correlate trips with other device activities B. Compare GPS data with the suspect's physical movements via Wi-Fi connection logs C. Extract GPS coordinates from the Maps application history D. Analyze web browsing history for location-based searches E. Review call logs for related phone numbers

Correct Answer: A,B,C

QUESTION NO: 7
What type of metadata is stored in APFS snapshots?

A. System event logs B. File and directory states at specific points in time C. Wi-Fi connection history D. File permissions

Correct Answer: B

QUESTION NO: 8
Which macOS tool allows users to manage and analyze data synced with iCloud?

A. Keychain Access B. System Preferences C. iCloud Drive D. Activity Monitor

Correct Answer: C

QUESTION NO: 9
You are conducting a triage of a macOS device involved in an insider threat investigation. The device has multiple user accounts, and you need to quickly determine which accounts have administrative privileges and whether any new accounts were created recently.
What steps would you take to gather this information? (Choose three)

A. Check /etc/hosts for administrative user activity B. Use the sudo dscacheutil -q user command to list user accounts and groups C. Examine /private/var/db/dslocal/nodes/Default/users/ for user account details D. Analyze the system log /var/log/system.log for administrative access events E. Review /var/log/account.log for recent user account changes

Correct Answer: B,C,D

QUESTION NO: 10
What type of data can be extracted from the Mail application on iOS devices?

A. File system snapshots B. Installed applications C. Wi-Fi connection logs D. Message headers, sender, and recipient details

Correct Answer: D

QUESTION NO: 11
Which tool is commonly used to analyze and parse system logs to create a forensic timeline on macOS?

A. Plist Editor B. Log Parser C. fsck D. Log-Analysis-Toolkit

Correct Answer: B

QUESTION NO: 12
What is the primary goal of analyzing memory captures in digital forensics?

A. To identify inactive memory regions B. To evaluate the physical condition of memory C. To extract real-time operational data D. To increase storage space

Correct Answer: C

QUESTION NO: 13
During Apple Systems Triage, what is essential for identifying user accounts?

A. Account creation dates B. Spotlight search history C. User preference files D. Application usage statistics

Correct Answer: A

QUESTION NO: 14
In productivity application analysis, what data can be extracted from the Mail application?

A. Network configuration B. Printing preferences C. Email content and metadata D. Web browsing history

Correct Answer: C