Linux Memory and File System Analysis DFE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A forensic analyst is examining a Linux system where an attacker deleted several log files and a critical binary. The file system is ext4 and the system was shut down cleanly after the incident. The analyst needs to recover the deleted files and determine the timeline of deletion. Which approach should the analyst take?

   • ARun `fsck` on the partition to repair the file system and recover deleted files.
   • BUse `grep` on the raw partition to search for file content and reconstruct them.
   • CUse `debugfs` on the raw partition to examine the journal and recover deleted files.
   • DMount the file system read-only and use `extundelete` to recover the files.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security analyst is investigating a Linux server where an attacker gained access via a compromised user account. The analyst needs to determine the exact commands the attacker ran and whether they attempted to escalate privileges. The system has auditd enabled. Which log files should the analyst examine?

   • AExamine /var/log/audit/audit.log for audit events and /var/log/auth.log for authentication.
   • BCheck /var/log/kern.log for kernel messages and /var/log/dmesg for boot messages.
   • CLook at /var/log/messages for general system messages and /var/log/cron for scheduled tasks.
   • DReview /var/log/auth.log for login events and /var/log/syslog for system messages.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which command displays the current IP address, netmask, and other network interface configuration on a Linux system?

   • Aifconfig
   • Bping
   • Ctraceroute
   • Dnetstat
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which command is used to view system log files in real time as new entries are added?

   • Ahead /var/log/syslog
   • Bless /var/log/syslog
   • Ccat /var/log/syslog
   • Dtail -f /var/log/syslog
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a critical best practice when attempting to recover deleted files from a Linux file system?

   • ARun fsck to repair the file system
   • BReboot the system to clear memory
   • CImmediately unmount the file system or make a forensic image before recovery
   • DCreate new files in the same directory to test recovery
   Reveal Solution Discussion Select an answer first