You are the lead incident responder for a company that experienced a breach. The attacker used multiple anti-forensics techniques, including log tampering, file wiping, and encryption. You have a forensic image of the compromised server, but the attacker also wiped the system logs and encrypted some files. You need to present evidence in court. Which factor is most likely to affect the admissibility of the evidence?

The chain of custody documentation for the forensic image.

The fact that the attacker wiped the system logs.

The use of a write blocker during imaging.

The fact that the attacker used encryption to hide data.

You are the incident responder for a company that experienced a data breach. The attacker used anti-forensics techniques, including log tampering and file wiping. You have collected evidence, but the logs are incomplete. You need to determine the scope of the breach. Which factor is most important for assessing the impact of the anti-forensics techniques on your investigation?

The number of files that were wiped.

The type of encryption used by the attacker.

The skill level of the attacker.

The availability of alternative data sources, such as network logs or backups.

You are examining a Linux system and suspect that an attacker hid data in the slack space of a file. Which tool or method would be most effective for detecting data hidden in slack space?

Use 'grep' to search for hidden text within the file's content.

Use 'ls -la' to check for unusual file sizes that might indicate hidden data.

Use 'sleuthkit' tools like 'blkls' to extract slack space from the disk image.

Use 'file' to identify the file type and see if it is unusual.

On a Linux system, an investigator discovers that a file has been deliberately placed in the slack space of an existing file's allocated cluster. What is the primary purpose of this technique?

To encrypt the file so that it cannot be read without a key

To alter the file's timestamps to confuse investigators

To hide data in unused disk space that is not normally indexed by the file system

To create a hidden partition on the disk

GIAC Linux Incident Responder

Domain 3Objective 3

Analyzing Anti-Forensics Techniques GLIR Practice Questions (Page 1)

Part of the Incident Response and Evidence Handling domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 1–5

1expert · hard
You are the lead incident responder for a company that experienced a breach. The attacker used multiple anti-forensics techniques, including log tampering, file wiping, and encryption. You have a forensic image of the compromised server, but the attacker also wiped the system logs and encrypted some files. You need to present evidence in court. Which factor is most likely to affect the admissibility of the evidence?
Select an answer first
2expert · hard
You are the incident responder for a company that experienced a data breach. The attacker used anti-forensics techniques, including log tampering and file wiping. You have collected evidence, but the logs are incomplete. You need to determine the scope of the breach. Which factor is most important for assessing the impact of the anti-forensics techniques on your investigation?
Select an answer first
3foundation · easy
A forensic examiner discovers a binary file on a Linux system that has been compressed and then encrypted, making it impossible to analyze without the decryption key. Which anti-forensics technique is being used?
Select an answer first
4application · medium
You are examining a Linux system and suspect that an attacker hid data in the slack space of a file. Which tool or method would be most effective for detecting data hidden in slack space?
Select an answer first
5foundation · easy
On a Linux system, an investigator discovers that a file has been deliberately placed in the slack space of an existing file's allocated cluster. What is the primary purpose of this technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Analyzing Anti-Forensics Techniques GLIR Practice Questions (Page 1)

Questions 1–5

A forensic examiner discovers a binary file on a Linux system that has been compressed and then encrypted, making it impossible to analyze without the decryption key. Which anti-forensics technique is being used?

You are examining a Linux system and suspect that an attacker hid data in the slack space of a file. Which tool or method would be most effective for detecting data hidden in slack space?

On a Linux system, an investigator discovers that a file has been deliberately placed in the slack space of an existing file's allocated cluster. What is the primary purpose of this technique?

Keep studying — Incident Response and Evidence Handling