Linux Memory and File System Analysis DFE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which log file in Linux typically records authentication-related events, such as successful and failed login attempts?

   • A/var/log/kern.log
   • B/var/log/boot.log
   • C/var/log/auth.log
   • D/var/log/syslog
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which file typically stores the command history for the Bash shell in a user's home directory?

   • A.bash_history
   • B.profile
   • C.bashrc
   • D.bash_logout
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A forensic analyst is examining a Linux server that was used to launch outbound attacks. The analyst needs to trace the network connections made from this system. Which files and commands should the analyst use to reconstruct the network activity?

   • AExamine /var/log/auth.log for login events and run `netstat` to see current connections.
   • BCheck /var/log/ufw.log for firewall logs and /var/log/kern.log for kernel messages.
   • CReview /var/log/syslog for network messages and run `ifconfig` to see current interfaces.
   • DAnalyze the memory dump with Volatility's linux_netstat plugin and review /var/log/syslog.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which directory in Linux contains startup scripts that run when the system boots?

   • A/etc/init.d
   • B/var/spool
   • C/tmp
   • D/proc
   Reveal Solution Discussion Select an answer first
6. 30application · easy

   During a forensic examination of a Linux system, an investigator needs to locate the system's primary log files, user home directories, and temporary files. Which directories should the investigator focus on?

   • A/opt, /mnt, and /media
   • B/root, /bin, and /srv
   • C/var/log, /home, and /tmp
   • D/etc, /usr, and /var
   Reveal Solution Discussion Select an answer first