Linux File System Fundamentals and Analysis GLIR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During an incident response investigation, you discover a suspicious file in /tmp. The file's inode number is 524289, and it has a link count of 2. You check /home/user and find another file with the same inode number. Which command would you use to confirm that both filenames reference the same underlying data without modifying the file system?

   • Als -li /tmp/suspicious /home/user/suspicious
   • Bdiff /tmp/suspicious /home/user/suspicious
   • Cfile /tmp/suspicious && file /home/user/suspicious
   • Dstat /tmp/suspicious && stat /home/user/suspicious
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   You are investigating a Linux system where an attacker created a symbolic link from /etc/passwd to /tmp/evil_passwd. What is the most likely impact on the system, and what is the appropriate immediate action?

   • AThe symbolic link will cause a system crash because /etc/passwd is a critical system file and cannot be a symbolic link.
   • BThe system will continue to use the original /etc/passwd because symbolic links are only for convenience and do not affect system files.
   • CAuthentication and user management tools will read the malicious /tmp/evil_passwd file, so the system should be taken offline and the original /etc/passwd restored from backup.
   • DThe symbolic link will be ignored by authentication tools because they check for regular files, so the original /etc/passwd will be used.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are investigating a Linux server where an attacker is suspected of using a bind mount to hide malicious files. You notice that /etc appears to contain an unusual file that is not present in the original /etc directory. Which command would be most effective for identifying the bind mount?

   • Acat /etc/fstab
   • Bls -la /etc
   • Cdf -h /etc
   • Dmount | grep /etc
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During an incident response investigation, you need to examine files on a mounted USB drive that was attached to a compromised Linux server. The server's /etc/fstab does not contain an entry for this device. You have successfully mounted the device at /mnt/evidence. Which command will provide the most useful information about the file system type and mount options currently in effect for this device?

   • Adf -h /mnt/evidence
   • Blsblk -f /dev/sdb1
   • Cmount | grep /mnt/evidence
   • Dcat /etc/fstab | grep /mnt/evidence
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   You are analyzing a compromised system and need to determine if a specific directory is a separate mount point or just a subdirectory. You have access to the /proc/mounts file. Which approach would be most reliable?

   • AUse mount and look for the directory
   • BUse lsblk and look for the directory
   • CSearch /proc/mounts for the directory path
   • DUse df -h and look for the directory
   Reveal Solution Discussion Select an answer first