Linux Memory and File System Analysis DFE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which command is used to list currently running processes on a Linux system?

   • Adf
   • Bdu
   • Cps
   • Dls
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which tool is commonly used to analyze a Linux memory dump to list running processes?

   • ANmap
   • BAutopsy
   • CWireshark
   • DVolatility
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic analyst responds to a suspected network intrusion on a Linux database server. The system is still running, and the analyst must preserve volatile data before shutting down the server for imaging. The analyst has root access and a USB drive mounted at /mnt/evidence. Which action should the analyst take FIRST to capture the most volatile data in a forensically sound manner?

   • ARun `volatility -f /proc/kcore --profile=LinuxUbuntu memorydump -D /mnt/evidence/` to extract memory directly.
   • BExecute `dd if=/dev/mem of=/mnt/evidence/mem.dump bs=1M` to create a raw physical memory image.
   • CUse `lime-forensics` module to acquire memory and write the output to /mnt/evidence/mem.lime.
   • DRun `cat /proc/kcore > /mnt/evidence/kcore.dump` to capture the entire kernel memory space.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which command can be used to display the current session's command history in Bash?

   • Als -a
   • Bhistory
   • Cecho $PATH
   • Dcat .bashrc
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which file in Linux contains user account information such as usernames, UIDs, and home directories?

   • A/etc/group
   • B/etc/passwd
   • C/etc/shadow
   • D/etc/hostname
   Reveal Solution Discussion Select an answer first