An incident responder is analyzing a memory dump from a compromised Linux server. The responder suspects a kernel rootkit because the linux_pslist plugin shows no suspicious processes, but network connections indicate active communication with a known command-and-control server. Which Volatility plugin should the responder use to detect a kernel-level rootkit that hides processes?

linux_lsmod to list loaded kernel modules and identify suspicious ones.

linux_psxview to cross-reference process lists from multiple kernel sources.

linux_check_syscall to verify the integrity of system call handlers.

linux_pstree to visualize the process hierarchy and identify hidden processes.

GIAC Linux Incident Responder

Domain 4Objective 1

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 4)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

7concepts

Questions 16–20

16foundation · easy
Which tool is specifically designed to load a kernel module and capture a Linux memory image for forensic analysis?
Select an answer first
17application · medium
A system administrator is troubleshooting a hardware issue on a Linux server. The administrator needs to see the details of all PCI devices, including the vendor and device IDs. Which command would provide this information?
Select an answer first
18foundation · easy
Which command would you use to list USB devices connected to a Linux system to identify unauthorized hardware?
Select an answer first
19expert · hard
An incident responder is analyzing a memory dump from a compromised Linux server. The responder suspects a kernel rootkit because the linux_pslist plugin shows no suspicious processes, but network connections indicate active communication with a known command-and-control server. Which Volatility plugin should the responder use to detect a kernel-level rootkit that hides processes?
Select an answer first
20foundation · easy
Which Volatility plugin would you use to list open files for a process from a Linux memory dump?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 4)

Questions 16–20

Which tool is specifically designed to load a kernel module and capture a Linux memory image for forensic analysis?

A system administrator is troubleshooting a hardware issue on a Linux server. The administrator needs to see the details of all PCI devices, including the vendor and device IDs. Which command would provide this information?

Which command would you use to list USB devices connected to a Linux system to identify unauthorized hardware?

Which Volatility plugin would you use to list open files for a process from a Linux memory dump?

Keep studying — Advanced Analysis and Threat Hunting