CHFI Mobile and Malware Forensics Practice Question
A security analyst is reviewing the output from a forensic tool examining an iOS Keychain. The analyst finds an entry with the attribute 'kSecAttrAccessible' set to 'kSecAttrAccessibleWhenUnlockedThisDeviceOnly'. What does this indicate?
⚠ Common exam trap
EC-Council often tests the misconception that 'ThisDeviceOnly' only affects backup behavior, when in fact it also prevents restoration to another device, and candidates may confuse 'WhenUnlocked' with 'AfterFirstUnlock' or 'Always', which have different lock-state requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The item is only accessible when the device is unlocked and is not backed up to iCloud
The attribute 'kSecAttrAccessibleWhenUnlockedThisDeviceOnly' in iOS Keychain indicates that the item can only be accessed when the device is unlocked and is not included in any backup (iCloud or iTunes). This is because the 'ThisDeviceOnly' suffix ties the encryption key to the device's UID, preventing migration to another device or restoration from backup. Option C correctly captures both conditions: accessibility only when unlocked and exclusion from backups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The item is backed up to iCloud and can be restored to another device
Why it's wrong here
The ThisDeviceOnly component of the attribute does the opposite of backing up: kSecAttrAccessibleWhenUnlockedThisDeviceOnly excludes the item from iCloud and iTunes/iOS device backups, and it is not migrated when restoring to a different device. Because the item is bound to the original device's keychain, a forensic backup would not contain it, so this interpretation is incorrect.
- ✗
The item is accessible even when the device is locked
Why it's wrong here
The WhenUnlocked portion of the constant explicitly restricts access to periods when the device has been unlocked by the user. Once the device is locked, the keychain item is no longer accessible to apps or to forensic extraction without the passcode, so the statement claiming it is accessible while locked is false. This is distinct from kSecAttrAccessibleAfterFirstUnlock constants, which do allow access after lock.
- ✓
The item is only accessible when the device is unlocked and is not backed up to iCloud
Why this is correct
This is the accurate reading of kSecAttrAccessibleWhenUnlockedThisDeviceOnly: it couples a time-based access gate (only after device unlock) with a device-scoped protection boundary (no iCloud backup and no restoration to another device). Keychain items with this attribute are available to apps only while the user has unlocked the device, and they do not appear in encrypted backups. A forensic examiner needs the unlocked device or the passcode to obtain the item.
- ✗
The item is stored in the Secure Enclave and cannot be extracted
Why it's wrong here
The accessibility attribute does not specify storage location; keychain items are kept in an encrypted keychain database whose keys are protected by the device's UID and passcode, often via the Secure Enclave, but the plaintext item is not literally stored inside the Secure Enclave. Moreover, forensic tools can extract keychain entries from a forensic image or running device when the passcode is known or while the device is unlocked, so saying the item cannot be extracted is incorrect.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.