Linux File System Fundamentals and Analysis GLIR Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During an incident, you need to quickly identify which processes are running from deleted binaries. You suspect an attacker replaced a binary and then deleted it. Which of the following would be the most effective approach?

   • ARun ls -l /bin
   • BUse df to check disk usage
   • CCheck /proc/*/exe symlinks for processes with '(deleted)' in the target
   • DCheck /var/log/syslog
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A Linux server has a separate /var partition. During an incident, the /var partition becomes full, causing services to fail. You need to identify which files are consuming the most space to determine if any are related to the incident. Which command would be most effective for this task?

   • Adf -h /var
   • Bfind /var -type f -size +100M
   • Cdu -sh /var/* | sort -rh | head -20
   • Dls -la /var
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   During a forensic examination, you find a file with the permission string -rwsr-xr-x owned by root:root in a user's home directory. The file is a binary that the user claims was not installed by them. What is the most significant security concern, and what is the appropriate immediate action?

   • AThe file should be deleted immediately, and the user's account should be locked because they are responsible for the file.
   • BThe setuid bit allows the binary to run with root privileges, so the file should be quarantined immediately and the system should be checked for other setuid binaries.
   • CThe file is owned by root, so it is likely a legitimate system file that was accidentally placed in the user's directory; no action is needed.
   • DThe file has world-execute permission, so any user can run it, but it does not pose a security risk because it is in a user's home directory.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   You are examining a suspicious file in /tmp that has the permission string -rwsr-xr-x and is owned by root. What does the 's' in the owner execute position indicate, and what is the primary security concern?

   • AIt indicates the setuid bit is set, meaning the file runs with the privileges of its owner (root), which is a significant security risk if the file is malicious.
   • BIt indicates the sticky bit is set, which prevents users from deleting files they do not own in shared directories.
   • CIt indicates the file is a symbolic link, and the 's' represents the target file's permissions.
   • DIt indicates the file is a setgid binary, meaning it runs with the privileges of the group owner, which is a moderate security risk.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A junior analyst reports that a suspicious script in /tmp has the permission string -rwxrwxrwx and is owned by root. The analyst wants to execute it to observe its behavior. What is the most appropriate response?

   • AChange the permissions to 700 and execute it as root, since the script is owned by root and should be run with elevated privileges.
   • BDo not execute it; instead, copy it to a sandboxed environment and analyze it there, because executing an untrusted world-writable script on the live system could cause further compromise.
   • CExecute it as a non-privileged user to observe its behavior, since the permissions allow anyone to run it.
   • DUse the file command to determine the script type, then execute it in a chroot jail on the same system.
   Reveal Solution Discussion Select an answer first