Linux Memory and File System Analysis DFE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An analyst has a memory dump from a compromised Linux web server. The analyst needs to determine if the attacker established a reverse shell and what commands were executed. Using Volatility, which set of plugins should the analyst run to gather this evidence?

   • ARun `linux_pslist` and `linux_bash` to list processes and recover bash command history.
   • BRun `linux_pstree` and `linux_pslist` to view the process tree and list all processes.
   • CRun `linux_netstat` and `linux_bash` to list network connections and recover bash command history.
   • DRun `linux_malfind` and `linux_dmesg` to find injected code and kernel messages.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which command displays file metadata such as timestamps, permissions, and ownership in Linux?

   • Acat
   • Bchmod
   • Cstat
   • Dls
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A forensic analyst is investigating a Linux system where an attacker deleted a critical configuration file. The file system is ext4 and the partition has been unmounted. Which technique should the analyst use to attempt recovery of the deleted file?

   • AUse `extundelete` on the unmounted partition to restore the deleted file.
   • BRun `grep` on the raw partition device to search for known content strings from the file.
   • CMount the partition read-only and use `rm -rf` to undo the deletion.
   • DRun `fsck` on the partition to repair the file system and recover the file.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An analyst is investigating a Linux server that may have been used to exfiltrate data. The analyst needs to determine if there were any outbound connections to unusual IP addresses. Which command or log would provide the most useful evidence?

   • AExamine firewall logs (e.g., iptables logs) for outbound connections.
   • BExamine `/var/log/auth.log` for SSH outbound connections.
   • CUse `tcpdump` to capture live traffic.
   • DUse `netstat -an` or `ss -an` to view current connections.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A forensic team is responding to a live incident on a Linux server. The server is running a custom kernel that does not have the LiME module pre-compiled. The team needs to capture memory but also needs to preserve the ability to analyze network connections and running processes later. The server has limited disk space, and the team has a network-mounted forensic share available. Which approach is most appropriate?

   • AUse `dd if=/dev/mem` to capture memory to the local disk, then transfer the image to the network share.
   • BPerform a cold boot attack to capture memory from RAM modules.
   • CUse `gcore` on each running process to capture process memory individually.
   • DCompile the LiME module on a matching kernel build system, load it, and capture memory directly to the network share.
   Reveal Solution Discussion Select an answer first