During an incident response, you need to collect evidence from a running system. You have limited time and must prioritize. Which data should you collect first?

Network connections and running processes

Filesystem metadata and log files

The system's hostname and IP address

The contents of /etc/passwd and /etc/shadow

When encountering an LVM logical volume during evidence collection, what is the correct approach to mount it read-only?

Use the lvchange -ay command to activate the logical volume before mounting.

Mount the logical volume using /dev/mapper/vg-lv with the rw option, then remount read-only.

Mount the physical volume directly using /dev/sdb1 with the ro option.

Activate the volume group with vgchange -ay, then mount the logical volume with the ro option.

Which of the following should be recorded when documenting a mounting procedure for forensic evidence?

The analyst's name and the case number, but not the command details.

The output of the mount command after mounting, but not the command itself.

Only the device name and the mount point, because other details are not relevant.

The exact command, all mount options, the device and mount point, and the date and time of the action.

You are examining a forensic image of a Linux filesystem. You need to mount it read-only to avoid any changes. However, the filesystem has a journal that may be replayed by the kernel when mounted. Which mount option should you use to prevent journal replay?

mount -o ro,remount /dev/loop0 /mnt/evidence

mount -o ro,sync /dev/loop0 /mnt/evidence

mount -o ro,noload /dev/loop0 /mnt/evidence

mount -o ro,noatime /dev/loop0 /mnt/evidence

GIAC Linux Incident Responder

Domain 3Objective 2

Evidence Collection and Mounting GLIR Practice Questions (Page 3)

Part of the Incident Response and Evidence Handling domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

5concepts

Questions 11–15

11application · medium
During an incident response, you need to collect evidence from a running system. You have limited time and must prioritize. Which data should you collect first?
Select an answer first
12application · medium
During an incident response, you collect a memory dump and then create a disk image. You record the hash values of both. Which principle of evidence collection does this primarily support?
Select an answer first
13foundation · easy
When encountering an LVM logical volume during evidence collection, what is the correct approach to mount it read-only?
Select an answer first
14foundation · easy
Which of the following should be recorded when documenting a mounting procedure for forensic evidence?
Select an answer first
15application · medium
You are examining a forensic image of a Linux filesystem. You need to mount it read-only to avoid any changes. However, the filesystem has a journal that may be replayed by the kernel when mounted. Which mount option should you use to prevent journal replay?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.