GIAC Enterprise Incident Responder
Domain 4Objective 2
Linux DFIR Fundamentals GEIR Practice Questions (Page 9)
Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)
53questions here
11free pages
9concepts
Questions 41–45
- 41
You are verifying the integrity of critical system binaries after a suspected rootkit infection. You have a known-good hash list from the vendor. Which command should you use to verify the binaries?
Select an answer first - 42
You are investigating a Linux system that was compromised. The attacker likely established persistence. Which of the following locations should you check FIRST for common persistence mechanisms?
Select an answer first - 43
During a forensic examination of a compromised Linux system, an investigator needs to locate system-wide configuration files that affect all users. Which directory is the standard location for such files?
Select an answer first - 44
Which of the following is a common Linux persistence mechanism that schedules tasks to run at specific times?
Select an answer first - 45
You suspect that an attacker created a new user account on a Linux system. Which files should you examine to confirm the account exists and to see when it was last used?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.