You are investigating a Linux system where the attacker cleared the bash history and also modified the /var/log/wtmp file to remove evidence of their login. Which of the following actions would best help you recover evidence of the attacker's activities?

Check the system's audit logs (if enabled) for login events.

Use 'last' to view the wtmp file and look for gaps.

Search for core dumps or memory images that might contain the attacker's commands.

Look for shell history files in other locations, such as /root/.bash_history or user home directories.

A Linux server was compromised, and the attacker used a secure erase tool to wipe specific files before you could acquire evidence. During your investigation, you notice that the filesystem journal (e.g., ext4 journal) still contains remnants of the deleted files. Which action would best preserve this potential evidence?

Use 'fsck' to check the filesystem and recover deleted files from the journal.

Immediately power off the server and remove the hard drive for forensic imaging.

Create a forensic image of the entire disk using 'dd' or 'dcfldd' while the system is still running.

Run 'debugfs' on the live filesystem to extract the journal entries before they are overwritten.

An attacker is known to have cleared the bash history and modified the `/var/log/wtmp` file to hide their login activity. Which of the following actions would best help you recover evidence of the attacker's commands?

Look at the `~/.bash_history` file of the compromised user.

Check the process accounting logs (`acct`/`psacct`) if enabled.

Search for core dump files that might contain command history.

Use `last` to view the wtmp file.

You are setting up a Linux server that will be used for incident response investigations. To mitigate log tampering by attackers, which configuration would be most effective?

Use `logrotate` to compress and rotate logs daily.

Enable auditd and configure it to send logs to a remote syslog server.

Set log files to be read-only using `chattr +i`.

Store logs in a separate partition with limited permissions.

GIAC Linux Incident Responder

Domain 3Objective 3

Analyzing Anti-Forensics Techniques GLIR Practice Questions (Page 2)

Part of the Incident Response and Evidence Handling domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 6–10

6foundation · easy
During an incident response engagement, an analyst discovers that a Linux system has been configured with a hidden directory that is only accessible via a specific command, and the system logs show no record of the directory's creation. Which anti-forensics technique is being demonstrated?
Select an answer first
7application · medium
You are investigating a Linux system where the attacker cleared the bash history and also modified the /var/log/wtmp file to remove evidence of their login. Which of the following actions would best help you recover evidence of the attacker's activities?
Select an answer first
8application · medium
A Linux server was compromised, and the attacker used a secure erase tool to wipe specific files before you could acquire evidence. During your investigation, you notice that the filesystem journal (e.g., ext4 journal) still contains remnants of the deleted files. Which action would best preserve this potential evidence?
Select an answer first
9application · medium
An attacker is known to have cleared the bash history and modified the `/var/log/wtmp` file to hide their login activity. Which of the following actions would best help you recover evidence of the attacker's commands?
Select an answer first
10application · medium
You are setting up a Linux server that will be used for incident response investigations. To mitigate log tampering by attackers, which configuration would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Analyzing Anti-Forensics Techniques GLIR Practice Questions (Page 2)

Questions 6–10

During an incident response engagement, an analyst discovers that a Linux system has been configured with a hidden directory that is only accessible via a specific command, and the system logs show no record of the directory's creation. Which anti-forensics technique is being demonstrated?

You are investigating a Linux system where the attacker cleared the bash history and also modified the /var/log/wtmp file to remove evidence of their login. Which of the following actions would best help you recover evidence of the attacker's activities?

An attacker is known to have cleared the bash history and modified the `/var/log/wtmp` file to hide their login activity. Which of the following actions would best help you recover evidence of the attacker's commands?

You are setting up a Linux server that will be used for incident response investigations. To mitigate log tampering by attackers, which configuration would be most effective?

Keep studying — Incident Response and Evidence Handling