An incident responder is analyzing a memory dump from a compromised Linux server. The responder needs to identify which process has an open file descriptor to a suspicious file in /tmp. Which Volatility plugin should the responder use?

linux_netstat to list network connections.

linux_lsof to list open file descriptors for each process.

linux_pslist to list active processes.

linux_bash to recover bash command history.

Which scenario best demonstrates the value of correlating memory and device evidence?

A process in memory is found to have an open handle to a suspicious USB device, and device logs show the USB was recently connected

The system has a large amount of RAM

The system has multiple network interfaces

GIAC Linux Incident Responder

Domain 4Objective 1

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 1)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

7concepts

Questions 1–5

1application · medium
An incident responder is analyzing a memory dump from a compromised Linux server. The responder needs to identify which process has an open file descriptor to a suspicious file in /tmp. Which Volatility plugin should the responder use?
Select an answer first
2foundation · easy
Which directory in the Linux filesystem contains device files that represent hardware devices?
Select an answer first
3foundation · easy
Which scenario best demonstrates the value of correlating memory and device evidence?
Select an answer first
4foundation · easy
Which Volatility plugin is used to detect kernel modules that may indicate a rootkit in a Linux memory dump?
Select an answer first
5foundation · easy
Which kernel data structure is commonly hooked by rootkits to hide processes from system calls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 1)

Questions 1–5

An incident responder is analyzing a memory dump from a compromised Linux server. The responder needs to identify which process has an open file descriptor to a suspicious file in /tmp. Which Volatility plugin should the responder use?

Which directory in the Linux filesystem contains device files that represent hardware devices?

Which scenario best demonstrates the value of correlating memory and device evidence?

Which Volatility plugin is used to detect kernel modules that may indicate a rootkit in a Linux memory dump?

Which kernel data structure is commonly hooked by rootkits to hide processes from system calls?

Keep studying — Advanced Analysis and Threat Hunting