Linux File System Fundamentals and Analysis GLIR Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   A file has permissions represented by the octal value 754. What does this permission set allow the group owner to do?

   • ARead and write
   • BRead and execute
   • CWrite and execute
   • DRead, write, and execute
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the purpose of a mount point in Linux?

   • AIt is a command used to unmount a file system
   • BIt is a special file that stores the file system's superblock
   • CIt is a configuration file that lists all file systems to be mounted at boot
   • DIt is a directory where a file system is attached to the directory tree
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You are investigating a Linux system where an attacker is suspected of hiding files. You notice that the /tmp directory has the sticky bit set (drwxrwxrwt). What is the purpose of the sticky bit on /tmp, and how does it affect your investigation?

   • AThe sticky bit makes all files in /tmp immutable, preventing any modification or deletion, which protects evidence but also prevents legitimate cleanup.
   • BThe sticky bit has no effect on file deletion; it only affects file execution, so it is irrelevant to your investigation.
   • CThe sticky bit causes all files in /tmp to be automatically deleted after a certain period, which may have already removed evidence.
   • DThe sticky bit prevents users from deleting files they do not own in /tmp, which means the attacker's files can only be deleted by the attacker or root, preserving evidence.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which command displays currently mounted file systems along with their mount points and options?

   • Adu
   • Bmount
   • Cfdisk
   • Dlsblk
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An attacker has replaced a commonly used system binary, /usr/bin/ps, with a malicious version. During your investigation, you find that /bin/ps is a symbolic link to /usr/bin/ps. You need to restore the original binary. Which action is most appropriate?

   • ADelete /bin/ps and recreate it as a regular file
   • BReplace the contents of /usr/bin/ps with the original binary
   • CChange /bin/ps to point to a different binary
   • DRemove /usr/bin/ps and keep only /bin/ps
   Reveal Solution Discussion Select an answer first