You are analyzing a suspicious file in /home/user/.config. You need to determine when the file was last modified, when its metadata was last changed, and when it was last accessed. Which command provides all three timestamps?

readlink /home/user/.config/suspicious_file

file /home/user/.config/suspicious_file

stat /home/user/.config/suspicious_file

ls -l /home/user/.config/suspicious_file

You are responding to a live incident on a Linux system. You need to preserve volatile data before powering off the system. Which of the following should you collect FIRST?

File system metadata and timestamps

Running processes and network connections

User account information and group memberships

System logs and authentication records

You are responding to a live Linux server that is part of a critical production environment. The server is actively communicating with a known malicious IP, but taking it offline would cause a major business outage. You need to collect evidence while keeping the system running. Which approach best balances forensic integrity with operational continuity?

Run a full disk image over the network while the system is live, then collect memory afterward.

Collect volatile data (memory, network connections, process list) first, then perform a live acquisition of critical files and logs, and schedule a full disk image during a maintenance window.

Immediately shut down the server and remove the disk for imaging in a lab.

Only collect network traffic captures and defer all other evidence collection until after the incident is contained.

You suspect that a critical system binary, `/usr/bin/sshd`, may have been replaced by an attacker. You have a known-good copy from the original installation media. Which method best verifies whether the binary has been altered?

Check the file's modification time with `stat` and compare it to the system installation date.

Use `strings` to search for known error messages and compare them to the original.

Run `file` on the binary and verify it reports the expected file type.

Compute the SHA-256 hash of the installed binary and compare it to the hash of the known-good copy from the installation media.

GIAC Enterprise Incident Responder

Domain 4Objective 2

Linux DFIR Fundamentals GEIR Practice Questions (Page 10)

Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 46–50

46foundation · easy
Which command is used to display active network connections and listening ports on a Linux system?
Select an answer first
47application · medium
You are analyzing a suspicious file in /home/user/.config. You need to determine when the file was last modified, when its metadata was last changed, and when it was last accessed. Which command provides all three timestamps?
Select an answer first
48application · medium
You are responding to a live incident on a Linux system. You need to preserve volatile data before powering off the system. Which of the following should you collect FIRST?
Select an answer first
49expert · hard
You are responding to a live Linux server that is part of a critical production environment. The server is actively communicating with a known malicious IP, but taking it offline would cause a major business outage. You need to collect evidence while keeping the system running. Which approach best balances forensic integrity with operational continuity?
Select an answer first
50application · medium
You suspect that a critical system binary, `/usr/bin/sshd`, may have been replaced by an attacker. You have a known-good copy from the original installation media. Which method best verifies whether the binary has been altered?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Linux DFIR Fundamentals GEIR Practice Questions (Page 10)

Questions 46–50

Which command is used to display active network connections and listening ports on a Linux system?

You are analyzing a suspicious file in /home/user/.config. You need to determine when the file was last modified, when its metadata was last changed, and when it was last accessed. Which command provides all three timestamps?

You are responding to a live incident on a Linux system. You need to preserve volatile data before powering off the system. Which of the following should you collect FIRST?

You suspect that a critical system binary, `/usr/bin/sshd`, may have been replaced by an attacker. You have a known-good copy from the original installation media. Which method best verifies whether the binary has been altered?

Keep studying — Linux Forensics