During a forensic investigation, you run `mount` and see that /var is a separate partition mounted with the 'noexec' option. What is the most likely reason for this configuration?

To prevent attackers from executing binaries from /var

To improve disk I/O performance for log writes

To ensure that log files are written in a specific format

To allow the partition to be mounted read-only

An attacker deleted a critical file from an ext4 filesystem. The filesystem is still mounted and the system is running. You need to maximize the chance of recovering the file. Which approach should you take first?

Copy the filesystem image to another drive and then recover from the image

Run `extundelete` on the mounted filesystem

Use `grep` on the raw device to search for file content

Immediately unmount the filesystem and use debugfs to recover the inode

You are analyzing a Linux system that uses the ext4 filesystem. You need to determine whether a file was created or modified during a specific time window. Which artifact would provide the most reliable evidence?

The file's ctime from the change log

The file's birth time (btime) from stat

The file's atime from the access log

The file's mtime from the modification log

You need to determine which commands a user executed during their SSH session. Which file would you examine?

/home/user/.ssh/authorized_keys

An attacker deleted a critical file from an ext4 filesystem. The system has been in use since the deletion. You need to attempt recovery. Which approach is most likely to succeed?

Use grep on the raw disk device to find file signatures

Search the journal for the file content

Use extundelete on the live filesystem immediately

Power off the system and create a forensic image before attempting recovery

GIAC Linux Incident Responder

Domain 1Objective 4

Linux File System Artifacts GLIR Practice Questions (Page 2)

Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

6concepts

Questions 6–10

6application · medium
During a forensic investigation, you run `mount` and see that /var is a separate partition mounted with the 'noexec' option. What is the most likely reason for this configuration?
Select an answer first
7expert · hard
An attacker deleted a critical file from an ext4 filesystem. The filesystem is still mounted and the system is running. You need to maximize the chance of recovering the file. Which approach should you take first?
Select an answer first
8application · medium
You are analyzing a Linux system that uses the ext4 filesystem. You need to determine whether a file was created or modified during a specific time window. Which artifact would provide the most reliable evidence?
Select an answer first
9application · medium
You need to determine which commands a user executed during their SSH session. Which file would you examine?
Select an answer first
10application · medium
An attacker deleted a critical file from an ext4 filesystem. The system has been in use since the deletion. You need to attempt recovery. Which approach is most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.