After a suspected compromise, you find a script in `/usr/local/bin/` that downloads and executes a payload. You need to determine how the script is being launched automatically on system startup. Which locations should you check first?

Check `/var/log/auth.log`, `/etc/passwd`, and `/etc/shadow` for the script's execution history.

Check `/var/spool/mail/`, `/home/*/.bash_history`, and `/root/.bashrc` for the script's path.

Check `/etc/cron*`, `/etc/systemd/system/`, and `/etc/rc.local` for references to the script.

Check `/proc/sys/kernel/hostname`, `/etc/hostname`, and `/etc/hosts` for the script's name.

You are creating a forensic image of a Linux disk and need to ensure the image is an exact bit-for-bit copy. Which tool and approach should you use?

Use `dd if=/dev/sda of=/evidence/disk.img bs=4M` and then compute a SHA-256 hash of both the source and the image to verify they match.

Use `cp -a / /evidence/rootcopy` to copy the filesystem, then compare file sizes.

Use `rsync -a / /evidence/rsync_copy` to synchronize the filesystem.

Use `tar -czf /evidence/backup.tar.gz /` to archive the filesystem.

GIAC Enterprise Incident Responder

Domain 4Objective 2

Linux DFIR Fundamentals GEIR Practice Questions (Page 3)

Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 11–15

11application · medium
After a suspected compromise, you find a script in `/usr/local/bin/` that downloads and executes a payload. You need to determine how the script is being launched automatically on system startup. Which locations should you check first?
Select an answer first
12application · medium
You are creating a forensic image of a Linux disk and need to ensure the image is an exact bit-for-bit copy. Which tool and approach should you use?
Select an answer first
13application · medium
You are investigating a Linux system that may be part of a botnet. You need to identify which process is communicating with a known command-and-control server. Which command would you use to correlate network connections with processes?
Select an answer first
14foundation · easy
Which command computes the SHA-256 hash of a file on a Linux system?
Select an answer first
15foundation · easy
Which log file is the central system log on many Linux distributions, capturing messages from various services?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Linux DFIR Fundamentals GEIR Practice Questions (Page 3)

Questions 11–15

After a suspected compromise, you find a script in `/usr/local/bin/` that downloads and executes a payload. You need to determine how the script is being launched automatically on system startup. Which locations should you check first?

You are creating a forensic image of a Linux disk and need to ensure the image is an exact bit-for-bit copy. Which tool and approach should you use?

You are investigating a Linux system that may be part of a botnet. You need to identify which process is communicating with a known command-and-control server. Which command would you use to correlate network connections with processes?

Which command computes the SHA-256 hash of a file on a Linux system?

Which log file is the central system log on many Linux distributions, capturing messages from various services?

Keep studying — Linux Forensics