Incident Response Triage GLIR Practice Questions (Page 10)

Questions 46–48

1. 46application · medium

   After completing triage on a Linux server, the responder must document the findings. What is the most important element to include for reproducibility?

   • AThe names of the team members involved.
   • BThe exact sequence of commands and tools used during triage.
   • CThe cost of the incident response effort.
   • DThe final conclusion without supporting details.
   Reveal Solution Discussion Select an answer first
2. 47application · medium · select all that apply

   You are responding to a Linux incident and need to identify potential digital evidence sources. Which of the following are valid evidence sources that should be considered for preservation? Select all that apply.

   • AThe bash history of users
   • BThe contents of /proc (process information)
   • CThe current timezone setting
   • DThe server's hostname
   • ESystem logs in /var/log
   Check answers Discussion Select an answer first
3. 48expert · medium

   An incident responder is assessing a potential breach. The only indicator is a single unusual outbound connection from a database server. The server is not business-critical, but it contains customer data. The responder must decide whether to escalate the incident. Which factor should be most influential in the escalation decision?

   • AThe time of day the connection was observed.
   • BThe fact that the connection was outbound.
   • CThe presence of customer data on the server.
   • DThe fact that the server is not business-critical.
   Reveal Solution Discussion Select an answer first