You are investigating a Linux system and find a file that appears to be a legitimate system binary, but you suspect it has been replaced with a trojanized version. Which technique would be most effective for detecting this type of data hiding?

Compare the file's hash with the known good hash from the package manager.

Use 'strings' to look for suspicious strings in the binary.

Check the binary's modification time to see if it was recently changed.

Use 'file' to check if the binary is a valid executable.

During a forensic examination of a Linux system, you notice that a file's size is smaller than the allocated blocks on the filesystem. What could this indicate?

The file is compressed by the filesystem.

The file has been partially deleted and remnants remain in slack space.

The file is sparse and contains holes.

To mitigate the effects of anti-forensics techniques and preserve evidence integrity, which of the following is a forensic sound practice?

Create a forensic image of the storage media

Delete suspicious files to prevent further damage

Run antivirus scans on the live system

Reboot the system to clear memory

During an incident, you find a suspicious binary on a compromised Linux host. The binary is packed with UPX, and when you run 'strings' on it, you see very few readable strings. You need to analyze the binary to understand its behavior. Which approach is most effective for analyzing this packed binary?

Use 'objdump' to disassemble the packed binary directly.

Use 'strings' with the '-a' flag to scan the entire binary for hidden strings.

Run the binary in a sandbox and capture network traffic and system calls.

Use 'upx -d' to unpack the binary before performing static analysis.

GIAC Linux Incident Responder

Domain 3Objective 3

Analyzing Anti-Forensics Techniques GLIR Practice Questions (Page 3)

Part of the Incident Response and Evidence Handling domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 11–15

11application · medium
You are investigating a Linux system and find a file that appears to be a legitimate system binary, but you suspect it has been replaced with a trojanized version. Which technique would be most effective for detecting this type of data hiding?
Select an answer first
12application · medium
During a forensic examination of a Linux system, you notice that a file's size is smaller than the allocated blocks on the filesystem. What could this indicate?
Select an answer first
13foundation · easy
To mitigate the effects of anti-forensics techniques and preserve evidence integrity, which of the following is a forensic sound practice?
Select an answer first
14foundation · easy
Which of the following tools is commonly used to create a forensic image of a Linux storage device while preserving evidence integrity?
Select an answer first
15application · medium
During an incident, you find a suspicious binary on a compromised Linux host. The binary is packed with UPX, and when you run 'strings' on it, you see very few readable strings. You need to analyze the binary to understand its behavior. Which approach is most effective for analyzing this packed binary?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Analyzing Anti-Forensics Techniques GLIR Practice Questions (Page 3)

Questions 11–15

You are investigating a Linux system and find a file that appears to be a legitimate system binary, but you suspect it has been replaced with a trojanized version. Which technique would be most effective for detecting this type of data hiding?

During a forensic examination of a Linux system, you notice that a file's size is smaller than the allocated blocks on the filesystem. What could this indicate?

To mitigate the effects of anti-forensics techniques and preserve evidence integrity, which of the following is a forensic sound practice?

Which of the following tools is commonly used to create a forensic image of a Linux storage device while preserving evidence integrity?

Keep studying — Incident Response and Evidence Handling