You are responding to an incident on a Linux server that hosts a critical database. The attacker may have used anti-forensics techniques such as file wiping and log tampering. You need to preserve evidence while minimizing downtime for the business. Which approach best balances these competing needs?

Perform a live forensic acquisition using 'dd' to image the disk while the system is running.

Immediately power off the server and take a forensic image.

Use a logical acquisition to copy only relevant files, then take the server offline for a full image.

Use a snapshot of the virtual machine (if applicable) to preserve the state, then continue operations.

During an investigation, you find that the attacker used a kernel module to hide processes and network connections. You need to assess the impact on evidence. What is the most important consideration?

The evidence is still valid because the kernel module only affects the live system, not the forensic image.

The evidence from the live system may be incomplete because the kernel module can hide processes and network activity.

The evidence is admissible because the kernel module is part of the system.

The evidence is unaffected because the kernel module is not a forensic tool.

GIAC Linux Incident Responder

Domain 3Objective 3

Analyzing Anti-Forensics Techniques GLIR Practice Questions (Page 4)

Part of the Incident Response and Evidence Handling domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 16–20

16expert · hard
You are responding to an incident on a Linux server that hosts a critical database. The attacker may have used anti-forensics techniques such as file wiping and log tampering. You need to preserve evidence while minimizing downtime for the business. Which approach best balances these competing needs?
Select an answer first
17foundation · easy
An investigator finds a script on a compromised Linux system that is heavily obfuscated, making it difficult to understand its purpose. Which anti-forensics technique is being used?
Select an answer first
18expert · hard
During an investigation, you find that the attacker used a kernel module to hide processes and network connections. You need to assess the impact on evidence. What is the most important consideration?
Select an answer first
19foundation · easy
During an investigation, an analyst finds that a file's contents have been overwritten with random data, making the original content unrecoverable. Which anti-forensics technique is being used?
Select an answer first
20foundation · easy
A forensic analyst is reviewing the /var/log/auth.log file and finds that a series of failed login attempts have been replaced with successful login entries. What is the most likely anti-forensics technique being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Analyzing Anti-Forensics Techniques GLIR Practice Questions (Page 4)

Questions 16–20

An investigator finds a script on a compromised Linux system that is heavily obfuscated, making it difficult to understand its purpose. Which anti-forensics technique is being used?

During an investigation, you find that the attacker used a kernel module to hide processes and network connections. You need to assess the impact on evidence. What is the most important consideration?

During an investigation, an analyst finds that a file's contents have been overwritten with random data, making the original content unrecoverable. Which anti-forensics technique is being used?

A forensic analyst is reviewing the /var/log/auth.log file and finds that a series of failed login attempts have been replaced with successful login entries. What is the most likely anti-forensics technique being used?

Keep studying — Incident Response and Evidence Handling