You are investigating a suspicious binary in /tmp. You need to determine whether the file was modified after it was initially placed on the system and whether it matches a known-good hash from the vendor. Which command sequence provides the most useful forensic data?

stat /tmp/binary and sha256sum /tmp/binary

ls -la /tmp/binary and md5sum /tmp/binary

cat /tmp/binary and wc -c /tmp/binary

file /tmp/binary and strings /tmp/binary

You are performing live response on a compromised Linux system. You need to collect volatile data while minimizing the impact on the system. Which of the following is the most appropriate order of collection?

Memory dump first, then process list, then network connections, then disk image

Process list first, then disk image, then memory dump

Disk image first, then memory dump, then process list

Network connections first, then memory dump, then disk image

During an incident investigation, you discover a suspicious process that is not visible in the normal process list. You suspect it may be hidden using a rootkit. Which of the following actions is most likely to reveal the hidden process?

Run top and look for high CPU usage

Review the /etc/rc.local file for startup scripts

Check the systemd journal for process startup messages

Compare the output of ps aux with the entries in /proc

GIAC Enterprise Incident Responder

Domain 4Objective 2

Linux DFIR Fundamentals GEIR Practice Questions (Page 8)

Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

9concepts

Questions 36–40

36foundation · easy
Which command displays the current routing table on a Linux system?
Select an answer first
37foundation · easy
Which log file records successful and failed login attempts on a typical Debian-based Linux system?
Select an answer first
38application · medium
You are investigating a suspicious binary in /tmp. You need to determine whether the file was modified after it was initially placed on the system and whether it matches a known-good hash from the vendor. Which command sequence provides the most useful forensic data?
Select an answer first
39application · medium
You are performing live response on a compromised Linux system. You need to collect volatile data while minimizing the impact on the system. Which of the following is the most appropriate order of collection?
Select an answer first
40application · medium
During an incident investigation, you discover a suspicious process that is not visible in the normal process list. You suspect it may be hidden using a rootkit. Which of the following actions is most likely to reveal the hidden process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Linux DFIR Fundamentals GEIR Practice Questions (Page 8)

Questions 36–40

Which command displays the current routing table on a Linux system?

Which log file records successful and failed login attempts on a typical Debian-based Linux system?

You are investigating a suspicious binary in /tmp. You need to determine whether the file was modified after it was initially placed on the system and whether it matches a known-good hash from the vendor. Which command sequence provides the most useful forensic data?

You are performing live response on a compromised Linux system. You need to collect volatile data while minimizing the impact on the system. Which of the following is the most appropriate order of collection?

During an incident investigation, you discover a suspicious process that is not visible in the normal process list. You suspect it may be hidden using a rootkit. Which of the following actions is most likely to reveal the hidden process?

Keep studying — Linux Forensics