Linux and Mac Forensics CHFI Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic examiner is analyzing a macOS system that was used to download a suspicious file from the internet. The examiner needs to determine when the file was downloaded and whether it was quarantined by macOS. Which artifact would provide this information?

   • AThe user's shell history file (~/.bash_history)
   • BThe /var/log/system.log file
   • CThe /Library/Receipts directory
   • DThe file's extended attributes, specifically com.apple.quarantine
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In Linux, the /proc directory is often examined during forensic analysis. What is the primary purpose of /proc?

   • AIt holds configuration files for system services.
   • BIt contains system log files for troubleshooting.
   • CIt stores user home directories and personal files.
   • DIt is a virtual filesystem that provides real-time information about running processes and kernel parameters.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Linux server is behaving abnormally. The investigator needs to identify any suspicious processes and correlate them with network connections. Which command sequence would be most effective?

   • ARun `top` and then `ifconfig -a`
   • BRun `ps aux` and then `netstat -tunap`
   • CRun `ls -l /proc` and then `cat /etc/services`
   • DRun `pstree` and then `route -n`
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst notices unusual outbound network traffic from a Linux server. The analyst suspects a malicious process is running. Which command would provide the most comprehensive view of running processes along with their network connections?

   • Anetstat -tulpn
   • Bps aux
   • Clsof -i
   • Dtop -b -n 1
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A forensic examiner is analyzing a macOS system that has an APFS volume. The examiner needs to recover a deleted file that was stored in the user's Documents folder. The system has been used since the deletion. Which approach is most likely to succeed while maintaining forensic integrity?

   • ACreate a forensic image of the APFS container and use APFS-aware recovery tools on the image.
   • BSearch the raw disk for the file's content using 'grep' after mounting the volume read-only.
   • CBoot from a macOS recovery partition and use Disk Utility to recover the file.
   • DUse the 'undelete' command in Finder to restore the file from the Trash.
   Reveal Solution Discussion Select an answer first