A Mac system was compromised. The investigator has a memory dump and a full disk image. The attacker is suspected of using a legitimate application to access sensitive files and send them over the network. The unified logs have been partially cleared. Which approach would provide the most reliable evidence of the data exfiltration?

Review the user's shell history for commands related to file transfer

Correlate the memory dump's network connections and open file handles with the remaining unified logs for file access events

Examine the application's plist files for usage records

Analyze the APFS snapshots to recover the files that were accessed

An investigator is examining a Linux system where an attacker is suspected of creating a backdoor account. The investigator wants to find accounts with UID 0 (root privileges) that are not the standard root account. Which file and command would reveal this?

`/etc/passwd` and `awk -F: '$3 == 0 {print $1}' /etc/passwd`

`/etc/group` and `grep 'root' /etc/group`

`/etc/shadow` and `awk -F: '$2 == "" {print $1}' /etc/shadow`

`/var/log/auth.log` and `grep 'new user' /var/log/auth.log`

A Linux system was compromised. The investigator has a memory dump and a forensic image. The attacker is suspected of running a memory-resident rootkit that hides processes and files. The system's /etc/passwd has been modified. Which approach would provide the most reliable evidence of the rootkit's presence and the attacker's actions?

Check the system's auth.log for login events from the attacker

Examine the ext4 journal for file creation events related to the rootkit

Rely on the system's current process list to identify the rootkit

Analyze the memory dump for hidden processes and kernel modules, and compare the /etc/passwd file against a known-good baseline

EC-CouncilCertified Security Specialist

Domain 6Objective 2

Linux and Mac Forensics ECSS Practice Questions (Page 8)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

8concepts

Questions 36–40

36expert · hard
A Mac system was compromised. The investigator has a memory dump and a full disk image. The attacker is suspected of using a legitimate application to access sensitive files and send them over the network. The unified logs have been partially cleared. Which approach would provide the most reliable evidence of the data exfiltration?
Select an answer first
37foundation · easy
In macOS, which type of file is used to store application preferences and configuration settings in a property list format?
Select an answer first
38application · medium
An investigator is examining a Linux system where an attacker is suspected of creating a backdoor account. The investigator wants to find accounts with UID 0 (root privileges) that are not the standard root account. Which file and command would reveal this?
Select an answer first
39expert · hard
A Linux system was compromised. The investigator has a memory dump and a forensic image. The attacker is suspected of running a memory-resident rootkit that hides processes and files. The system's /etc/passwd has been modified. Which approach would provide the most reliable evidence of the rootkit's presence and the attacker's actions?
Select an answer first
40foundation · easy
A forensic examiner needs to capture the memory of a running Linux system to analyze for malicious processes. Which command-line tool is commonly used for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Linux and Mac Forensics ECSS Practice Questions (Page 8)

Questions 36–40

In macOS, which type of file is used to store application preferences and configuration settings in a property list format?

An investigator is examining a Linux system where an attacker is suspected of creating a backdoor account. The investigator wants to find accounts with UID 0 (root privileges) that are not the standard root account. Which file and command would reveal this?

A forensic examiner needs to capture the memory of a running Linux system to analyze for malicious processes. Which command-line tool is commonly used for this purpose?

Keep studying — Digital Forensics Investigations