An analyst is investigating a possible brute-force attack on a Linux server. The analyst wants to identify the source IP addresses that repeatedly failed authentication and the times of those attempts. Which log file and command combination would provide the most direct evidence?

Examine `/var/log/dmesg` and run `grep 'sshd' /var/log/dmesg`

Examine `/var/log/auth.log` and run `grep 'Failed password' /var/log/auth.log`

Examine `/var/log/syslog` and run `grep 'authentication failure' /var/log/syslog`

Examine `/var/log/kern.log` and run `grep 'ssh' /var/log/kern.log`

A forensic analyst is investigating a Mac system to determine when a specific application was first launched. The system uses unified logging. Which command would be most effective in finding this information?

ls -la /Applications/appname.app

defaults read com.apple.appname LastLaunch

log show --predicate 'process == "appname"' --start "2023-01-01" --end "2023-12-31"

EC-CouncilCertified Security Specialist

Domain 6Objective 2

Linux and Mac Forensics ECSS Practice Questions (Page 7)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

8concepts

Questions 31–35

31application · medium
An analyst is investigating a possible brute-force attack on a Linux server. The analyst wants to identify the source IP addresses that repeatedly failed authentication and the times of those attempts. Which log file and command combination would provide the most direct evidence?
Select an answer first
32foundation · easy
What is the default file system used by modern macOS versions (starting with macOS High Sierra)?
Select an answer first
33foundation · easy
When investigating a live Linux system, which command would an examiner use to list all running processes with their process IDs?
Select an answer first
34application · medium
A forensic analyst is investigating a Mac system to determine when a specific application was first launched. The system uses unified logging. Which command would be most effective in finding this information?
Select an answer first
35foundation · easy
A forensic examiner needs to identify the Linux file system type on a seized drive. Which file system is the default for most modern Linux distributions and supports journaling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Linux and Mac Forensics ECSS Practice Questions (Page 7)

Questions 31–35

An analyst is investigating a possible brute-force attack on a Linux server. The analyst wants to identify the source IP addresses that repeatedly failed authentication and the times of those attempts. Which log file and command combination would provide the most direct evidence?

What is the default file system used by modern macOS versions (starting with macOS High Sierra)?

When investigating a live Linux system, which command would an examiner use to list all running processes with their process IDs?

A forensic analyst is investigating a Mac system to determine when a specific application was first launched. The system uses unified logging. Which command would be most effective in finding this information?

A forensic examiner needs to identify the Linux file system type on a seized drive. Which file system is the default for most modern Linux distributions and supports journaling?

Keep studying — Digital Forensics Investigations