An incident responder is analyzing a memory dump from a compromised Linux server. The responder suspects a rootkit because the linux_pslist plugin shows no suspicious processes, but the linux_netstat plugin shows a connection to a known command-and-control server. Which Volatility plugin should the responder use to detect a rootkit that hides network connections?

linux_check_modules to verify the integrity of loaded kernel modules.

linux_check_afinfo to verify the integrity of network protocol structures.

linux_check_syscall to verify the integrity of system call handlers.

linux_check_tty to verify the integrity of TTY structures.

Why is it important to correlate memory analysis findings with device profiling data during incident response?

To confirm that a malicious process is using a specific hardware device

To determine the operating system version

To identify the IP address of the attacker

A system administrator is investigating a potential hardware-based attack on a Linux server. The administrator needs to determine if any unauthorized kernel modules were loaded. Which command should the administrator use to list currently loaded kernel modules?

Run 'lsmod' to list loaded kernel modules.

Run 'modprobe -l' to list available kernel modules.

Run 'dmesg | grep module' to view kernel messages about modules.

Run 'cat /proc/modules' to list loaded kernel modules.

GIAC Linux Incident Responder

Domain 4Objective 1

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 2)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

7concepts

Questions 6–10

6expert · hard
An incident responder is analyzing a memory dump from a compromised Linux server. The responder suspects a rootkit because the linux_pslist plugin shows no suspicious processes, but the linux_netstat plugin shows a connection to a known command-and-control server. Which Volatility plugin should the responder use to detect a rootkit that hides network connections?
Select an answer first
7foundation · easy
Which file or directory contains a history of USB devices that have been connected to a Linux system?
Select an answer first
8foundation · easy
Why is it important to correlate memory analysis findings with device profiling data during incident response?
Select an answer first
9application · medium
A system administrator is investigating a potential hardware-based attack on a Linux server. The administrator needs to determine if any unauthorized kernel modules were loaded. Which command should the administrator use to list currently loaded kernel modules?
Select an answer first
10expert · medium
A security analyst is investigating a memory dump from a compromised Linux server. The analyst suspects a rootkit has modified the system call table. Which Volatility plugin would be the most direct way to check for this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 2)

Questions 6–10

Which file or directory contains a history of USB devices that have been connected to a Linux system?

Why is it important to correlate memory analysis findings with device profiling data during incident response?

A system administrator is investigating a potential hardware-based attack on a Linux server. The administrator needs to determine if any unauthorized kernel modules were loaded. Which command should the administrator use to list currently loaded kernel modules?

A security analyst is investigating a memory dump from a compromised Linux server. The analyst suspects a rootkit has modified the system call table. Which Volatility plugin would be the most direct way to check for this?

Keep studying — Advanced Analysis and Threat Hunting