Evidence Collection and Mounting GLIR Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   You are mounting a forensic image of a filesystem that was created with the 'discard' mount option (TRIM). You want to mount it read-only for analysis. Which mount option should you use to prevent the filesystem from issuing discard operations?

   • Anoatime
   • Bnodiscard
   • Csync
   • Dnoload
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo ensure the evidence is stored in a secure location that only the incident responder can access.
   • BTo verify that the evidence was collected using the correct forensic tools.
   • CTo create a backup of the evidence in case the original is lost or damaged.
   • DTo document every person who handled the evidence and every transfer, ensuring the evidence's integrity and admissibility.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Linux server was compromised, and you must collect volatile evidence before powering it down. The incident response plan requires that you preserve the current state of running processes, network connections, and loaded kernel modules. Which action best aligns with the order of volatility principle?

   • ARun a series of commands that write their output to files on the same disk to preserve evidence.
   • BCapture the contents of /proc, /sys, and running process memory before touching the disk.
   • CReboot the system into a live forensic environment to safely collect memory and process data.
   • DImmediately create a full disk image using dd, then analyze the image for process information.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is it important to document the exact mount commands and options used during evidence collection?

   • ATo ensure that the evidence is automatically hashed after mounting.
   • BTo allow the evidence to be mounted on any system without additional configuration.
   • CTo prove that the evidence was collected quickly and efficiently.
   • DTo ensure the process can be reproduced and to maintain a clear chain of custody.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   You have a forensic image of a Linux system that uses LVM and LUKS encryption. You need to mount the logical volume read-only. Which sequence of commands is correct?

   • Avgchange -a y, then cryptsetup luksOpen, then mount -o ro /dev/vg/lv /mnt/evidence
   • Bcryptsetup luksOpen, then vgchange -a y, then lvchange -a y, then mount -o ro,noatime /dev/vg/lv /mnt/evidence
   • Ccryptsetup luksOpen, then mount -o ro /dev/mapper/luks-device /mnt/evidence
   • Dlvchange -a y, then cryptsetup luksOpen, then mount -o ro /dev/vg/lv /mnt/evidence
   Reveal Solution Discussion Select an answer first