Linux DFIR Fundamentals GEIR Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Linux host is beaconing to an external IP every 5 minutes. You need to confirm the beaconing behavior and identify the process responsible. Which combination of commands would provide the most direct evidence?

   • AUse `ifconfig eth0` to check the interface status and `route -n` to view the routing table.
   • BUse `ping <external-IP>` to test connectivity and `ps aux` to list all processes.
   • CUse `tcpdump -i eth0 -n 'host <external-IP>'` to capture traffic to that IP, then use `ss -tunap` to identify the process making the connections.
   • DUse `cat /proc/net/arp` to view the ARP cache and `last` to review login history.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a suspected account compromise, you need to determine which user accounts were recently added, when successful logins occurred, and whether any sudo commands were executed. Which files and logs should you examine?

   • A/etc/group, /var/log/messages, and /var/log/dmesg
   • B/etc/login.defs, /var/log/wtmp, and /var/log/faillog
   • C/etc/shadow, /var/log/syslog, and /var/log/kern.log
   • D/etc/passwd, /var/log/auth.log, and /var/log/sudo.log
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Linux server experienced a security incident. You need to determine whether any user logged in via SSH during the incident window and whether any failed login attempts occurred. Which log file should you examine?

   • A/var/log/boot.log
   • B/var/log/auth.log
   • C/var/log/syslog
   • D/var/log/dmesg
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   You are investigating a Linux server that is communicating with an external IP address on port 4444. The connection is established, but you cannot determine which process owns the connection using standard tools like ss or lsof. Which of the following is the most likely reason, and what should you do next?

   • AThe process is hidden by a rootkit, so you need to compare /proc entries with ps output.
   • BThe process is using a raw socket, so you need to use netstat -p.
   • CThe process is running as a different user, so you need to run ss with sudo.
   • DThe connection is a kernel-level backdoor, so you need to capture network traffic with tcpdump.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   You are investigating a possible unauthorized SSH login. You need to determine which user accounts were used, from which IP addresses, and whether any logins succeeded. Which log files and commands would provide this information?

   • AExamine `/var/log/auth.log` for SSH authentication events and use `last` to review successful login sessions from `/var/log/wtmp`.
   • BExamine `/var/log/syslog` for kernel messages and use `who` to show currently logged-in users.
   • CExamine `/var/log/dmesg` for boot messages and use `lastb` to list failed logins.
   • DExamine `/var/log/faillog` for all login attempts and use `id` to list user IDs.
   Reveal Solution Discussion Select an answer first