Incident Response Triage GLIR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of creating a forensic image of a storage device?

   • ATo preserve the exact state of the device for analysis without altering the original
   • BTo speed up the system by removing unnecessary data
   • CTo verify that the system is free of malware
   • DTo create a backup for disaster recovery purposes
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What should be included in triage documentation to ensure reproducibility?

   • AOnly the final conclusion
   • BTimestamps, commands run, and evidence collected
   • CThe system's hardware specifications
   • DThe analyst's personal opinions about the attacker
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Linux server is suspected of being compromised. The responder needs to identify potential evidence sources. Which combination of sources is most appropriate for initial triage?

   • ASystem logs, memory dump, and filesystem artifacts.
   • BNetwork traffic captures and the system's uptime.
   • COnly the system logs, as they contain all relevant information.
   • DThe server's hardware inventory and BIOS settings.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Linux server is suspected of being compromised. You need to identify potential digital evidence sources. Which of the following is a volatile evidence source that should be captured FIRST?

   • AThe filesystem superblock
   • BContents of RAM (memory)
   • CThe /var/log/auth.log file
   • DThe /etc/passwd file
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During an incident, a responder needs to preserve the contents of a Linux server's memory and disk. The server is still running and cannot be taken offline immediately. Which approach best preserves evidence integrity while allowing the server to continue operating?

   • ACreate a memory dump using a tool like `dd` on /dev/mem and then shut down the server to copy the disk.
   • BUse a trusted forensic tool to capture memory to an external drive, then create a forensic image of the disk using a write-blocker.
   • CRun `fsck` on the disk to ensure filesystem consistency before imaging.
   • DCopy the entire filesystem using `cp -a` to a network share for later analysis.
   Reveal Solution Discussion Select an answer first