During an investigation, an analyst needs to determine if an attacker created a new user account with root privileges. The analyst has access to the file system image. Which files should the analyst examine to confirm this?

Review /etc/group for group memberships and /var/log/syslog for system messages.

Check /etc/passwd for new users and /etc/sudoers for sudo privileges.

Inspect /home directory for new user folders and /etc/profile for environment settings.

Examine /etc/shadow for password hashes and /var/log/auth.log for login attempts.

A security analyst is investigating a possible brute-force attack on a Linux server's SSH service. The analyst needs to identify the source IP addresses and the usernames attempted. Which log file and command would provide this information?

Examine /var/log/secure and use `grep 'sshd' /var/log/secure`

Examine /var/log/auth.log and use `grep 'Failed password' /var/log/auth.log`

Examine /var/log/syslog and use `grep 'sshd' /var/log/syslog`

Examine /var/log/messages and use `grep 'sshd' /var/log/messages`

During a forensic analysis, an investigator needs to determine if any user accounts have been recently added or modified. The investigator has access to the system's authentication files. Which files should be compared to identify changes?

Look at /etc/sudoers for new sudo entries.

Check /var/log/auth.log for 'useradd' or 'usermod' commands.

Compare the current /etc/passwd and /etc/shadow with backup copies or logs of changes.

Examine /etc/group to see if new groups were added.

EC-CouncilDigital Forensics Essentials

Domain 4Objective 4

Linux Memory and File System Analysis DFE Practice Questions (Page 5)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

50questions here

10free pages

10concepts

Questions 21–25

21foundation · easy
In Volatility, which plugin is used to extract network connection information from a Linux memory dump?
Select an answer first
22application · medium
During an investigation, an analyst needs to determine if an attacker created a new user account with root privileges. The analyst has access to the file system image. Which files should the analyst examine to confirm this?
Select an answer first
23foundation · easy
Which Linux directory is most likely to contain forensic evidence of user activity, such as downloaded files and browser history?
Select an answer first
24expert · medium
A security analyst is investigating a possible brute-force attack on a Linux server's SSH service. The analyst needs to identify the source IP addresses and the usernames attempted. Which log file and command would provide this information?
Select an answer first
25expert · hard
During a forensic analysis, an investigator needs to determine if any user accounts have been recently added or modified. The investigator has access to the system's authentication files. Which files should be compared to identify changes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Linux Memory and File System Analysis DFE Practice Questions (Page 5)

Questions 21–25

In Volatility, which plugin is used to extract network connection information from a Linux memory dump?

During an investigation, an analyst needs to determine if an attacker created a new user account with root privileges. The analyst has access to the file system image. Which files should the analyst examine to confirm this?

Which Linux directory is most likely to contain forensic evidence of user activity, such as downloaded files and browser history?

A security analyst is investigating a possible brute-force attack on a Linux server's SSH service. The analyst needs to identify the source IP addresses and the usernames attempted. Which log file and command would provide this information?

During a forensic analysis, an investigator needs to determine if any user accounts have been recently added or modified. The investigator has access to the system's authentication files. Which files should be compared to identify changes?

Keep studying — Operating System Forensics