GIAC iOS and macOS Examiner GIME Prüfungsfragen mit Lösungen:
1. Which data types are typically found in the Notes application on iOS and can aid in a forensic investigation? (Select two)
A) Internet browsing history
B) Password-protected notes
C) System error logs
D) Plain text entries with timestamps
2. You are investigating a macOS device that is suspected to contain encrypted containers with valuable evidence. The suspect has used FileVault 2 encryption, and you need to access the data stored in these containers.
What steps can you take to gain access and analyze the contents? (Choose three)
A) Mount the encrypted container using the suspect's credentials
B) Attempt brute-force decryption using forensic tools
C) Analyze logs for previous decryption attempts
D) Disable FileVault to prevent further encryption
E) Extract the encryption key from volatile memory
3. What network information is crucial during an Apple System triage?
A) Nearby Bluetooth devices
B) Active VPN connections
C) Installed network printers
D) Previous Wi-Fi networks
4. Which Apple application is crucial for analyzing user's location history?
A) Mail
B) Maps
C) Notes
D) Safari
5. Which log file provides details on Safari browser usage on macOS?
A) /var/log/safari.log
B) /Users/[username]/Library/Safari/History.db
C) /private/var/log/httpd
D) /Library/Logs/SafariHistory.log
Fragen und Antworten:
| 1. Frage Antwort: B,D | 2. Frage Antwort: A,B,E | 3. Frage Antwort: D | 4. Frage Antwort: B | 5. Frage Antwort: B |
12 Kundenbewertungen
