Linux File System Fundamentals and Analysis GLIR Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   You need to identify the type of a suspicious file (e.g., whether it is a script, binary, or archive) during an investigation. Which command is best suited for this task?

   • Afile
   • Bls
   • Cstat
   • Dcat
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an incident response, you need to determine which file system contains a specific file located at /var/log/auth.log. The /var directory is a separate partition. Which command would provide the most direct answer?

   • Afind / -name auth.log
   • Bmount | grep /var
   • Cdf /var/log/auth.log
   • Dlsblk
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During an investigation, you find that a critical system library /lib/x86_64-linux-gnu/libc.so.6 has been replaced with a symbolic link to /tmp/malicious.so. The original library file is still present at /lib/x86_64-linux-gnu/libc-2.31.so. Which statement about the system's behavior is correct?

   • AOnly programs that explicitly reference libc-2.31.so will be affected; programs using libc.so.6 will use the original library.
   • BPrograms will continue to use the original library because the symbolic link is only a convenience and the dynamic linker resolves the real file.
   • CPrograms that dynamically link against libc will load /tmp/malicious.so instead of the original library, potentially executing malicious code.
   • DThe system will fail to boot because the symbolic link is invalid and the dynamic linker cannot resolve the library path.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   You are investigating a system where an attacker has deleted a critical log file. You have a forensic image of the file system. You know the file was recently deleted and you have its inode number. Which tool would be most likely to recover the file's content?

   • Als
   • Bstat
   • Cextundelete
   • Dgrep
   Reveal Solution Discussion Select an answer first
6. 20expert · easy

   You are analyzing a compromised system and find a directory with a large number of hard links to a single file. You need to understand the relationship between these files. Which command would show you the inode number and link count for all files in that directory?

   • Adu -a /path/to/directory
   • Bfind /path/to/directory -type f -exec ls -li {} \;
   • Cstat /path/to/directory/*
   • Dls -li /path/to/directory
   Reveal Solution Discussion Select an answer first