During a Mac forensic investigation, you suspect that a malicious process is running but hiding its executable from the filesystem. Which technique would be most effective in identifying this process?

Perform a memory dump and analyze it with a tool like Volatility to list processes and their parent-child relationships

Examine the APFS snapshots for the executable file

Use the 'ps aux' command in Terminal to list all running processes

Check the LaunchAgents and LaunchDaemons folders for persistent agents

A Linux server was compromised, and the attacker deleted several critical files. The incident responder needs to recover deleted files from an ext4 filesystem. The server is still running, and the filesystem is mounted. Which approach is most appropriate for the responder to attempt first?

Use `grep` on the raw disk device to search for file signatures and manually reconstruct the files.

Create a forensic image of the filesystem using `dd` or `dcfldd`, then run `extundelete` or `ext4magic` on the image.

Run `extundelete` on the mounted filesystem to restore the deleted files immediately.

Reboot the server into single-user mode and then run `fsck` to recover the deleted files.

EC-CouncilCertified Security Specialist

Domain 6Objective 2

Linux and Mac Forensics ECSS Practice Questions (Page 1)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

8concepts

Questions 1–5

1foundation · easy
Which file system was the primary default for macOS before the introduction of APFS?
Select an answer first
2application · medium
During a Mac forensic investigation, you suspect that a malicious process is running but hiding its executable from the filesystem. Which technique would be most effective in identifying this process?
Select an answer first
3foundation · easy
A Linux administrator wants to review authentication-related events, such as successful and failed login attempts. Which log file typically contains this information?
Select an answer first
4application · medium
A Linux server was compromised, and the attacker deleted several critical files. The incident responder needs to recover deleted files from an ext4 filesystem. The server is still running, and the filesystem is mounted. Which approach is most appropriate for the responder to attempt first?
Select an answer first
5application · medium
A Mac forensic examiner needs to determine which files a user accessed on an APFS volume. The examiner has a full disk image. Which feature of APFS can provide historical versions of files and directories, potentially revealing earlier access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Linux and Mac Forensics ECSS Practice Questions (Page 1)

Questions 1–5

Which file system was the primary default for macOS before the introduction of APFS?

During a Mac forensic investigation, you suspect that a malicious process is running but hiding its executable from the filesystem. Which technique would be most effective in identifying this process?

A Linux administrator wants to review authentication-related events, such as successful and failed login attempts. Which log file typically contains this information?

A Linux server was compromised, and the attacker deleted several critical files. The incident responder needs to recover deleted files from an ext4 filesystem. The server is still running, and the filesystem is mounted. Which approach is most appropriate for the responder to attempt first?

A Mac forensic examiner needs to determine which files a user accessed on an APFS volume. The examiner has a full disk image. Which feature of APFS can provide historical versions of files and directories, potentially revealing earlier access?

Keep studying — Digital Forensics Investigations