Linux DFIR Fundamentals GEIR Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A process is running with an unusual name and is listening on a high-numbered port. You need to determine the full command line that started the process and which executable file it is running from. Which command provides both?

   • A`top` and `free -m`
   • B`lsof -i` and `cat /etc/passwd`
   • C`ps -ef` and `ls -l /proc/<PID>/exe`
   • D`netstat -tulpn` and `ifconfig -a`
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A Linux server has been compromised and is sending data to an external IP. You need to identify the process responsible, but the system is under heavy load and you must minimize the impact on the live system. Which approach best balances evidence collection with system stability?

   • AImmediately run `dd` to image the entire disk before collecting any volatile data.
   • BUse `ss -tunap` to identify the connection and process, then use `lsof -p <PID>` to list open files, and finally capture a memory dump.
   • CReboot the system into single-user mode to stop the malicious process, then collect evidence.
   • DRun `tcpdump` for an extended period to capture all traffic, then analyze the pcap file offline.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which command is commonly used to search for patterns within log files?

   • Acp
   • Bls
   • Cfind
   • Dgrep
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   You are investigating a potential brute-force attack on a Linux server. You need to identify the source IP addresses that have failed to authenticate multiple times. Which log file and command would be most effective?

   • Agrep 'Accepted password' /var/log/auth.log | awk '{print $9}' | sort | uniq -c
   • Bgrep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -nr
   • Ccat /var/log/syslog | grep 'sshd' | head -50
   • Dlast -f /var/log/wtmp | head -20
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   You are responding to a live Linux server that is actively communicating with a known malicious IP. You need to preserve the most volatile evidence first while minimizing changes to the system. Which sequence of actions best follows forensic best practices?

   • ACapture a memory dump, record active network connections, then image the disk.
   • BRun `shutdown -h now` to halt the system, then remove the disk and image it in a lab.
   • CImage the disk first, then capture memory, then record network connections.
   • DRecord network connections first, then image the disk, then capture memory.
   Reveal Solution Discussion Select an answer first