A Linux system was compromised, and the attacker established persistence by creating a systemd service that runs a script from /tmp. The service is named 'systemd-update.service'. You need to disable the persistence mechanism while preserving evidence for analysis. Which sequence of actions is most appropriate?

Kill the running process and delete the service file.

Copy the service file and the script to a forensic drive, then stop and disable the service and remove the service file.

Rename the service file to .bak and reboot the system.

Immediately run systemctl disable systemd-update.service and delete the script.

During an incident response, you need to determine when a suspicious binary was first introduced to a compromised Linux host. You have a full disk image and want to correlate the binary's creation time with entries in the system's authentication logs. Which approach best establishes this timeline?

Run `ls -la` on the directory containing the binary and compare the modification time of the directory with entries in `/var/log/syslog`.

Use `file` on the binary to identify its compilation timestamp and match that to the system's boot time in `/var/log/kern.log`.

Check the binary's atime with `stat` and compare it to the last system reboot recorded in `/var/log/wtmp`.

Run `stat` on the binary to read its birth time (btime) and then grep `/var/log/auth.log` for logins that occurred around that timestamp.

You are preserving evidence from a compromised Linux server. You need to create a forensic image of the root filesystem while ensuring the hash of the image matches the original data. Which approach is most appropriate?

Use tar to archive the filesystem and store the archive on the same server.

Use dd to copy the block device to an external drive and compute SHA-256 hashes of both the source and the image.

Use cp -a to copy all files to an external drive and compute MD5 hashes of each file.

Use rsync to synchronize the filesystem to a network share and verify with checksums.

GIAC Enterprise Incident Responder

Domain 4Objective 2

Linux DFIR Fundamentals GEIR Practice Questions (Page 6)

Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 26–30

26expert · hard
A Linux system was compromised, and the attacker established persistence by creating a systemd service that runs a script from /tmp. The service is named 'systemd-update.service'. You need to disable the persistence mechanism while preserving evidence for analysis. Which sequence of actions is most appropriate?
Select an answer first
27application · medium
During an incident response, you need to determine when a suspicious binary was first introduced to a compromised Linux host. You have a full disk image and want to correlate the binary's creation time with entries in the system's authentication logs. Which approach best establishes this timeline?
Select an answer first
28foundation · easy
Which command displays the access, modification, and change times of a file in a format suitable for forensic timeline analysis?
Select an answer first
29application · medium
You are preserving evidence from a compromised Linux server. You need to create a forensic image of the root filesystem while ensuring the hash of the image matches the original data. Which approach is most appropriate?
Select an answer first
30foundation · easy
Which file contains the list of local user accounts on a Linux system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Linux DFIR Fundamentals GEIR Practice Questions (Page 6)

Questions 26–30

During an incident response, you need to determine when a suspicious binary was first introduced to a compromised Linux host. You have a full disk image and want to correlate the binary's creation time with entries in the system's authentication logs. Which approach best establishes this timeline?

Which command displays the access, modification, and change times of a file in a format suitable for forensic timeline analysis?

You are preserving evidence from a compromised Linux server. You need to create a forensic image of the root filesystem while ensuring the hash of the image matches the original data. Which approach is most appropriate?

Which file contains the list of local user accounts on a Linux system?

Keep studying — Linux Forensics