An incident responder needs to acquire memory from a Linux system that is suspected of being compromised. The system is running a custom kernel that is not supported by standard memory acquisition tools. Which approach is the most practical?

Use the 'dd' command to copy /dev/mem to an external drive.

Use the '/proc/kcore' file with 'dd' to copy the kernel's memory image.

Use the 'LiME' tool, which can be compiled for the specific kernel version.

Use the 'fmem' tool, which is a kernel module that can be loaded on any kernel.

A security team is investigating a rootkit on a Linux server. The memory dump shows that the 'sys_call_table' has been modified. The team also finds a suspicious kernel module loaded. Which of the following actions would be the most effective to determine if the module is responsible for the sys_call_table modification?

Check the module's source code to see if it contains any syscall hooking code.

Compare the sys_call_table in memory with the one from the kernel's System.map file.

Remove the module from the system and see if the sys_call_table returns to normal.

Use 'linux_check_syscall' to identify the addresses of the modified entries and then check if those addresses fall within the module's memory range.

GIAC Linux Incident Responder

Domain 4Objective 1

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 3)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

7concepts

Questions 11–15

11application · medium
A forensic analyst is analyzing a memory dump from a Linux server. The analyst needs to see the command line arguments for all running processes to identify any suspicious commands. Which Volatility plugin would be most appropriate?
Select an answer first
12application · medium
An incident responder needs to acquire memory from a Linux system that is suspected of being compromised. The system is running a custom kernel that is not supported by standard memory acquisition tools. Which approach is the most practical?
Select an answer first
13foundation · easy
Which memory analysis artifact would you examine to identify a process that has an open network socket?
Select an answer first
14expert · hard
A security team is investigating a rootkit on a Linux server. The memory dump shows that the 'sys_call_table' has been modified. The team also finds a suspicious kernel module loaded. Which of the following actions would be the most effective to determine if the module is responsible for the sys_call_table modification?
Select an answer first
15foundation · easy
Which tool is commonly used to analyze a Linux memory dump to list running processes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 3)

Questions 11–15

A forensic analyst is analyzing a memory dump from a Linux server. The analyst needs to see the command line arguments for all running processes to identify any suspicious commands. Which Volatility plugin would be most appropriate?

An incident responder needs to acquire memory from a Linux system that is suspected of being compromised. The system is running a custom kernel that is not supported by standard memory acquisition tools. Which approach is the most practical?

Which memory analysis artifact would you examine to identify a process that has an open network socket?

Which tool is commonly used to analyze a Linux memory dump to list running processes?

Keep studying — Advanced Analysis and Threat Hunting