A Linux server is suspected of being used as a command-and-control relay. You need to identify which process is maintaining an outbound connection to a known malicious IP and also see what files that process has open. Which command combination provides this information?

Use `ss -tunap` to list active connections with the owning process, then `lsof -p ` to list files opened by that process.

Use `netstat -r` to view the routing table and `ps aux` to list all processes.

Use `tcpdump -i any` to capture traffic and `fuser -v` on the suspicious IP.

Use `ifconfig -a` to list interfaces and `cat /proc/net/tcp` to view connection states.

You are investigating a Linux system where a user account was used to execute a series of privileged commands. The system uses both /var/log/auth.log and a separate sudo log file. You need to determine the exact commands executed with sudo and the user who ran them. Which approach is most reliable?

Only examine /var/log/auth.log because it contains all authentication events.

Check the shell history files of all users.

Only examine the sudo log file because it is the authoritative source.

Parse /var/log/auth.log for 'sudo' entries and correlate with the sudo log file.

A compromised Linux server is running a custom application that writes logs to /opt/app/logs. The system's /var partition is nearly full, and the application is failing to write logs. You need to preserve forensic evidence while restoring service. Which action is most appropriate?

Increase the size of the /var partition using LVM and continue logging.

Compress the logs in place using gzip and then restart the application.

Mount a new forensic disk and copy the contents of /var/log and /opt/app/logs to it, then truncate the original logs to free space.

Delete the oldest log files in /var/log to free space immediately.

You are acquiring forensic evidence from a Linux system. You have limited time and need to prioritize which data to collect. The system is running a critical production service, and you cannot take it offline. Which of the following is the most appropriate strategy?

Collect a memory dump and a logical file copy of key directories, then perform a full disk image later.

Only collect a memory dump and skip disk evidence.

Shut down the system and then perform a full disk image.

Perform a full disk image immediately, even if it takes hours.

GIAC Enterprise Incident Responder

Domain 4Objective 2

Linux DFIR Fundamentals GEIR Practice Questions (Page 4)

Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 16–20

16foundation · easy
Which command shows which files are currently open by processes on a Linux system?
Select an answer first
17application · medium
A Linux server is suspected of being used as a command-and-control relay. You need to identify which process is maintaining an outbound connection to a known malicious IP and also see what files that process has open. Which command combination provides this information?
Select an answer first
18expert · hard
You are investigating a Linux system where a user account was used to execute a series of privileged commands. The system uses both /var/log/auth.log and a separate sudo log file. You need to determine the exact commands executed with sudo and the user who ran them. Which approach is most reliable?
Select an answer first
19expert · hard
A compromised Linux server is running a custom application that writes logs to /opt/app/logs. The system's /var partition is nearly full, and the application is failing to write logs. You need to preserve forensic evidence while restoring service. Which action is most appropriate?
Select an answer first
20expert · hard
You are acquiring forensic evidence from a Linux system. You have limited time and need to prioritize which data to collect. The system is running a critical production service, and you cannot take it offline. Which of the following is the most appropriate strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.