A forensic analyst is investigating a Linux system where an attacker is suspected of creating a backdoor user account. Which set of files and logs would provide the most direct evidence of this activity?

Review the system's memory dump for running processes

Compare /etc/passwd and /etc/shadow against a known-good baseline, and review auth.log for useradd or groupadd commands

Examine the /var/log/syslog for system startup messages

Check the system's crontab for scheduled tasks

A Linux system was compromised. The investigator has a forensic image and a memory dump. The attacker is suspected of using a compromised user account to escalate privileges and run a malicious script. The auth.log has been rotated and the old logs are unavailable. Which approach would provide the most reliable evidence of the privilege escalation?

Rely on the current auth.log to trace the user's login and sudo usage

Examine the /etc/sudoers file for recent modifications

Check the system's crontab for scheduled tasks that may have been used

Analyze the memory dump for processes running with elevated privileges and correlate with the bash history from the user's shell process

A Mac was used to access sensitive files, and the investigator needs to determine if the user copied files to an external drive. The investigator has a full disk image. Which combination of artifacts would provide the strongest evidence?

Only the `/var/log/install.log`.

Only the user's browser history.

Only the file system timestamps of the sensitive files.

Unified logs for USB device connections, the QuarantineEventsV2 database, and file system timestamps of the sensitive files.

During a Mac forensic investigation, you need to determine if a specific application was running at the time of a security incident. The system has been rebooted since the incident. Which source of evidence would be most useful?

Analyze a memory dump that was captured during the incident

Review the system's unified logs for application launch events

Examine the application's plist file for a 'LastLaunch' timestamp

Check the system's current process list with Activity Monitor

EC-CouncilCertified Security Specialist

Domain 6Objective 2

Linux and Mac Forensics ECSS Practice Questions (Page 9)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

8concepts

Questions 41–45

41application · medium
A forensic analyst is investigating a Linux system where an attacker is suspected of creating a backdoor user account. Which set of files and logs would provide the most direct evidence of this activity?
Select an answer first
42foundation · easy
Which macOS database stores user account information, including user IDs and home directories?
Select an answer first
43expert · hard
A Linux system was compromised. The investigator has a forensic image and a memory dump. The attacker is suspected of using a compromised user account to escalate privileges and run a malicious script. The auth.log has been rotated and the old logs are unavailable. Which approach would provide the most reliable evidence of the privilege escalation?
Select an answer first
44expert · hard
A Mac was used to access sensitive files, and the investigator needs to determine if the user copied files to an external drive. The investigator has a full disk image. Which combination of artifacts would provide the strongest evidence?
Select an answer first
45application · medium
During a Mac forensic investigation, you need to determine if a specific application was running at the time of a security incident. The system has been rebooted since the incident. Which source of evidence would be most useful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Linux and Mac Forensics ECSS Practice Questions (Page 9)

Questions 41–45

A forensic analyst is investigating a Linux system where an attacker is suspected of creating a backdoor user account. Which set of files and logs would provide the most direct evidence of this activity?

Which macOS database stores user account information, including user IDs and home directories?

A Mac was used to access sensitive files, and the investigator needs to determine if the user copied files to an external drive. The investigator has a full disk image. Which combination of artifacts would provide the strongest evidence?

During a Mac forensic investigation, you need to determine if a specific application was running at the time of a security incident. The system has been rebooted since the incident. Which source of evidence would be most useful?

Keep studying — Digital Forensics Investigations