Linux File System Fundamentals and Analysis GLIR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What happens to a hard link when the original file it points to is deleted?

   • AThe hard link becomes a broken link
   • BThe hard link is automatically deleted
   • CThe hard link continues to access the file's data
   • DThe hard link is converted to a symbolic link
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   During a forensic investigation, you need to locate a list of user accounts on a compromised Linux system. You also need to find the home directory of a specific user to look for malicious scripts. Which two directories/files would you examine?

   • A/proc and /root
   • B/etc/passwd and /home
   • C/usr and /tmp
   • D/etc/group and /var
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are analyzing a Linux system where the /home partition is mounted with the noexec option. A user reports that they cannot execute a script from their home directory. What is the most likely cause, and what is the appropriate action?

   • AThe noexec mount option prevents execution of binaries and scripts from the /home partition, so the user must copy the script to an executable partition like /tmp or /usr/local/bin.
   • BThe user does not have read permission on the script, so they need to change the file permissions to allow reading.
   • CThe script has a syntax error, so the shell cannot execute it, and the user needs to fix the script.
   • DThe script does not have the execute permission bit set, so the user needs to run chmod +x on the script.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A junior analyst reports that a critical configuration file in /etc has permissions of -rw-r--r-- and is owned by root:root. The incident response team needs to modify this file to contain a new threat-intel feed. The analyst is logged in as a user in the 'security' group, which is not root. What is the most appropriate action to allow the analyst to edit the file while maintaining least privilege?

   • AChange permissions to -rw-rw-rw-
   • BAdd the analyst to the root group
   • CChange ownership to security:security using chown
   • DUse sudo to edit the file as root
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which command would you use to display the disk space usage of file systems in a human-readable format?

   • Afree -h
   • Bdu -h
   • Cls -lh
   • Ddf -h
   Reveal Solution Discussion Select an answer first