Free GIME Practice Questions

Question 1

Two read-only examinations of a consistent Safari acquisition disagree about a visit. A query returns it from history_visits when History.db is read with its matching History.db-wal. The row is on a WAL page used by that query; a scan of History.db alone cannot find it. How should the examiner resolve the discrepancy?

Accepted Answer

Treat the visit as committed database content that has not yet been checkpointed.

Answer

Use the main database's result because WAL pages are relevant only during crash recovery.

Answer

Classify the visit as deleted content because it is absent from the main database.

Answer

Repeat the acquisition because every committed visit must already appear in the main database.

Question 2

A disputed image was cropped in Photos, and the edit has synchronized to an iPhone and a Mac. iCloud Photos was enabled when the image was taken and remains enabled. Synchronization is complete; both devices use storage optimization, and the acquisitions contain previews but no full-resolution original. Which acquisition target should provide the original for comparison?

Accepted Answer

The unmodified original downloaded from iCloud Photos.

Answer

A JPEG export of the edited image displayed on the Mac.

Answer

A fresh encrypted computer backup of the iPhone.

Answer

The iPhone's latest iCloud device backup after the edit.

Question 3

A persistence investigation recovers these fields from a launchd property list:

Program = "/usr/local/bin/indexd"
ProgramArguments = ["/usr/local/bin/worker", "--mode", "audit"]
StartCalendarInterval = { Minute = 45; Hour = 13; Day = 7; }

Month and Weekday are absent, and this is the only configured launch trigger. What executable and calendar schedule does the configuration specify?

Accepted Answer

/usr/local/bin/indexd, scheduled for 13:45 on the seventh day of each month.

Answer

/usr/local/bin/worker, scheduled for 13:45 on the seventh day of each month.

Answer

/usr/local/bin/indexd, scheduled for 13:45 on every day of each month.

Answer

/usr/local/bin/indexd, scheduled for 07:45 on the thirteenth day of each month.

Question 4

An examiner is plotting a seized iPhone's location at approximately 08:00 UTC. Three sensor-derived fixes have verified source-device identities and preserve their native CLLocation.horizontalAccuracy values:

Fix 1: seized iPhone; 08:00:01 UTC; -1 m.
Fix 2: seized iPhone; 08:00:03 UTC; 40 m.
Fix 3: paired Apple Watch; 08:00:02 UTC; 5 m.

Choose the fix and uncertainty representation appropriate to the iPhone observation.

Accepted Answer

Fix 2, with an uncertainty circle of 40 m radius.

Answer

Fix 1, with an uncertainty circle of 1 m radius.

Answer

Fix 2, with an uncertainty circle of 40 m diameter.

Answer

Fix 3, with an uncertainty circle of 5 m radius.

Question 5

A macOS process-and-connection capture is stored in two SQLite tables: process(pid, path) and socket(socket_id, pid, state, remote_addr). The field socket.pid identifies the owning process. A report must retain every process and show remote addresses only for its ESTABLISHED sockets, using NULL when none exist. Select the query that satisfies both requirements.

Accepted Answer

SELECT p.pid, s.remote_addr FROM process p LEFT JOIN socket s ON s.pid=p.pid AND s.state='ESTABLISHED';

Answer

SELECT p.pid, s.remote_addr FROM process p LEFT JOIN socket s ON s.pid=p.pid WHERE s.state='ESTABLISHED' OR s.socket_id IS NULL;

Answer

SELECT p.pid, s.remote_addr FROM process p INNER JOIN socket s ON s.pid=p.pid AND s.state='ESTABLISHED';

Answer

SELECT p.pid, s.remote_addr FROM process p LEFT JOIN socket s ON s.socket_id=p.pid AND s.state='ESTABLISHED';

Question 6

During response to a data-theft alert, network telemetry confirms that a Mac is still uploading confidential design files. The incident lead directs the responder to stop the transfer immediately. The responder is at the console; endpoint isolation will block the transfer while leaving the Mac running and local collection available. The full volatile-data collection would take several minutes. Which sequence best contains the incident while retaining available evidence?

Accepted Answer

Apply isolation, record its time, and collect the remaining volatile data locally while the Mac stays powered on.

Answer

Complete the full volatile collection before applying endpoint isolation, preserving the active connection throughout the collection.

Answer

Shut down the Mac to stop the transfer, then image its storage before restarting it for further examination.

Answer

Enable Block All Incoming Connections in the macOS firewall, then collect the live evidence with networking still enabled.

Question 7

On iOS 18, a delivery app has CNAuthorizationStatus.limited. The user grants it access to Maya's existing contact, and the app subsequently creates a new depot contact. Both records appear in the app's export while its authorization remains limited. Which Contacts access rule explains these two readable records?

Accepted Answer

The app can access selected contacts and contacts it creates.

Answer

Limited access applies only to updates, so all contacts remain readable.

Answer

App-created contacts remain readable only until the app next launches.

Answer

Contacts from the same account inherit access from the selected contact.

Question 8

Two regular files in the same live APFS volume have distinct file identifiers, yet their extent records initially point to the same data blocks. A later content change affects only one file; unchanged blocks remain shared. These observations distinguish which relationship?

Accepted Answer

Independent APFS files that share cloned extents.

Answer

Two hard links that name one underlying file.

Answer

A symbolic link and the file at its target path.

Answer

A volume snapshot paired with its current live view.

Question 9

An examiner is separating a complete Apple Mail .emlx file into its email message and trailing Apple property list. The body quotes an XML configuration, including an XML declaration. Which value should control extraction of the message portion?

Accepted Answer

The decimal byte count on the file's first line.

Answer

The byte position of the first XML declaration in the file.

Answer

The byte position of the blank line after the message headers.

Answer

The file's total byte length after subtracting its first line.

Question 10

A network alert labels a returning macOS 15 laptop as a new device after its Wi-Fi MAC address changes on the same SSID. Endpoint records before and after the change agree on hardware serial number and hardware UUID. Both show Private Wi-Fi Address set to Rotating for that network. How should this address-change alert be handled initially?

Accepted Answer

Correlate both observations to this laptop; the address change fits its configured privacy mode.

Answer

Quarantine the laptop for impersonation; changing its MAC on the same SSID indicates identity tampering.

Answer

Create a second physical-device record; the new MAC outweighs the agreement in hardware identifiers.

Answer

Correlate the observations only if their DHCP leases use the same IP address on that network.

Free GIME Practice Questions

Domain 1: Apple Application Analysis

Question 1

Question 2

Domain 3: Apple Systems Triage

Question 3

Domain 4: Application Fundamentals

Question 4

Question 5

Domain 7: Incident Response

Question 6

Question 7

Domain 9: Introduction to Disk and File Systems

Question 8

Domain 11: Pattern of Life

Question 9

Domain 12: Productivity Application Analysis

Question 10

The rest of the GIME blueprint

That's 10 of 1,030