During incident response, why is it important to collect volatile data before powering off a compromised Linux system?

Volatile data such as running processes and network connections is lost when the system is powered off.

It is easier to image the hard drive while the system is running.

Powering off the system will erase all data on the hard drive.

The system will automatically delete log files when powered off.

GIAC Enterprise Incident Responder

Domain 4Objective 2

Linux DFIR Fundamentals GEIR Practice Questions (Page 11)

Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 51–53

51foundation · easy
During incident response, why is it important to collect volatile data before powering off a compromised Linux system?
Select an answer first
52application · medium
You are responding to a potential data exfiltration incident. You need to identify any established outbound connections from the compromised Linux host. Which command provides a real-time view of active network connections with associated process IDs?
Select an answer first
53application · easy
During an investigation, you find an unknown script in `/var/tmp/` that is set to run at reboot via a systemd service. Which directory is the correct location for systemd unit files that would be loaded at boot?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Linux DFIR Fundamentals GEIR Practice Questions (Page 11)

Questions 51–53

During incident response, why is it important to collect volatile data before powering off a compromised Linux system?

You are responding to a potential data exfiltration incident. You need to identify any established outbound connections from the compromised Linux host. Which command provides a real-time view of active network connections with associated process IDs?

During an investigation, you find an unknown script in `/var/tmp/` that is set to run at reboot via a systemd service. Which directory is the correct location for systemd unit files that would be loaded at boot?

Keep studying — Linux Forensics