An administrator needs to create a new user account named 'jdoe' with a home directory and set the user's password. Which sequence of commands accomplishes this?

useradd -m jdoe && chpasswd jdoe

A forensic analyst needs to determine which processes are currently running from a deleted binary on a Linux system. The analyst also needs to identify the original file path from /proc. Which commands should be used?

cat /proc/*/maps | grep deleted

ls -l /proc/*/exe and readlink /proc/*/exe

find /proc -name exe -exec ls -l {} \;

GIAC Enterprise Incident Responder

Domain 4Objective 1

Linux Essentials GEIR Practice Questions (Page 4)

Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

Questions 16–20

16foundation · easy
An incident responder needs to terminate a misbehaving process with PID 1234. Which command sends the default SIGTERM signal to that process?
Select an answer first
17foundation · easy
An administrator needs to create a new user account named 'jdoe' with a home directory and set the user's password. Which sequence of commands accomplishes this?
Select an answer first
18expert · hard
A forensic analyst needs to determine which processes are currently running from a deleted binary on a Linux system. The analyst also needs to identify the original file path from /proc. Which commands should be used?
Select an answer first
19expert · hard
During an incident, a Linux server's network interface has been compromised. The analyst needs to determine if there are any suspicious outbound connections. The analyst runs `netstat -tulpn` but sees no established connections. Which additional command would be most effective in revealing hidden or unusual network activity?
Select an answer first
20application · medium
A system administrator notices that a process is consuming high CPU and suspects it may be malicious. The administrator needs to identify the process, its parent, and the network connections it has established. Which set of commands will provide this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Linux Essentials GEIR Practice Questions (Page 4)

Questions 16–20

An incident responder needs to terminate a misbehaving process with PID 1234. Which command sends the default SIGTERM signal to that process?

An administrator needs to create a new user account named 'jdoe' with a home directory and set the user's password. Which sequence of commands accomplishes this?

A forensic analyst needs to determine which processes are currently running from a deleted binary on a Linux system. The analyst also needs to identify the original file path from /proc. Which commands should be used?

A system administrator notices that a process is consuming high CPU and suspects it may be malicious. The administrator needs to identify the process, its parent, and the network connections it has established. Which set of commands will provide this information?

Keep studying — Linux Forensics