Evidence Collection and Mounting GLIR Practice Questions (Page 6)

Questions 26–28

1. 26expert · hard

   You are leading an incident response team. The team needs to collect evidence from a compromised Linux server, but the server is also a production system that cannot be taken offline. You must balance the need for evidence integrity with system availability. Which approach is most appropriate?

   • AUse a live forensic tool to collect only the files related to the incident.
   • BMount the filesystem read-only and copy all files to an external drive.
   • CImmediately shut down the server and create a physical image of the disk.
   • DCollect volatile data first, then create a logical image of the filesystem while the system is running.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   During an incident response, you need to mount a LVM logical volume that contains the root filesystem of a compromised server. The volume group is not active. You have a forensic image of the physical volume. Which sequence of steps is most appropriate to access the logical volume without altering the evidence?

   • AUse lvchange -ay to activate the logical volume directly on the image file without using a loop device.
   • BUse losetup to attach the image to a loop device, then run vgscan and vgchange -ay to activate the volume group, then mount the logical volume read-only.
   • CUse kpartx to map partitions from the image, then mount the logical volume directly without activating the volume group.
   • DUse vgscan to scan the image, then mount the logical volume read-write to allow the filesystem to repair itself.
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   You have a forensic image of a Linux system that used LVM with LUKS encryption on the logical volume. You have the passphrase. You need to mount the filesystem read-only. Which sequence of steps is correct?

   • AAttach the image to a loop device, activate the volume group, then use cryptsetup luksOpen on the logical volume, then mount the mapper device read-only.
   • BActivate the volume group directly on the image file without a loop device, then decrypt and mount.
   • CUse cryptsetup luksOpen on the image file, then activate the volume group, then mount the logical volume read-only.
   • DMount the image file directly with the loop option and the passphrase as a mount option.
   Reveal Solution Discussion Select an answer first