Linux and Mac Forensics CHFI Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A Linux server was compromised, and the attacker used a reverse shell to maintain access. The investigator needs to identify the command used to establish the reverse shell and the external IP it connected to. Which evidence source would be most useful?

   • AThe /etc/crontab file and the /var/log/syslog
   • BThe process list from the time of compromise and the network connection logs
   • CThe shell history of the compromised user and the /var/log/auth.log
   • DThe /var/log/wtmp and the /var/log/btmp
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An investigator is examining a macOS user's activity to determine which websites were visited. The user primarily uses Safari. Where should the investigator look for the most detailed browsing history?

   • A~/Library/Caches/com.apple.Safari
   • B/var/log/system.log
   • C~/Library/Safari/History.db
   • D~/Library/Preferences/com.apple.Safari.plist
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A network administrator is investigating a potential intrusion on a Linux server. The administrator needs to determine which IP addresses have established active connections to the server. Which command would provide a list of current network connections?

   • Aiptables -L
   • Bss -tunap
   • Cifconfig -a
   • Droute -n
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A forensic examiner is analyzing a macOS system and needs to determine which applications were downloaded from the internet and when. Which artifact would provide this information?

   • AThe quarantine extended attributes on the application files
   • BThe /Library/Receipts directory
   • CThe /var/log/system.log
   • DThe user's Safari history
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A forensic examiner is investigating a Mac where the user is suspected of using a VPN to hide their activity. Which artifacts would provide the most reliable evidence of VPN usage?

   • ACheck the unified log for network configuration changes and the user's browser history
   • BCheck the system log for DHCP and DNS requests
   • CCheck the network configuration files in /etc/ppp and /etc/racoon
   • DCheck the Keychain for saved VPN passwords and the system log for VPN connection events
   Reveal Solution Discussion Select an answer first