I suspect that they are asking about finding settings which get used, but aren't documented. Like, how to find hidden settings that programs will use.

In my experience with plist settings is that they are rarely sparse. But sure finding hidden settings is a tricky issue.

Unfortunately, that only seems to print those defaults that are set, not all defaults that are possible.

For example, the NSToolbarTitleViewRolloverDelay setting, while valid per the article, isn't listed in the output of `defaults read`

Per sibling comments, you run strings on binaries, find out informally from Apple engineers, or dig through settings in the System Preferences and then use `defaults` to look for changes in output.