An incident responder is analyzing a memory dump from a Linux server and needs to find evidence of a process that was running but has since exited. Which Volatility plugin should the responder use to recover information about terminated processes?

linux_pslist_cache to recover information about terminated processes from the kernel's process cache.

linux_pstree to visualize the process tree.

linux_psaux to list processes with command-line arguments.

linux_pslist to list active processes.

GIAC Linux Incident Responder

Domain 4Objective 1

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 5)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

7concepts

Questions 21–24

21foundation · easy
Which Volatility plugin would you use to extract network connection information from a Linux memory dump?
Select an answer first
22application · medium
A forensic analyst is analyzing a memory dump from a Linux server. The analyst needs to identify all files that were opened by a specific process suspected of being malicious. Which Volatility plugin would be most appropriate?
Select an answer first
23application · medium
An incident responder is analyzing a memory dump from a Linux server and needs to find evidence of a process that was running but has since exited. Which Volatility plugin should the responder use to recover information about terminated processes?
Select an answer first
24foundation · easy
Which command is used to display detailed information about the CPU, memory, and other hardware on a Linux system?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux Memory and Device Profiling Analysis GLIR Practice Questions (Page 5)

Questions 21–24

Which Volatility plugin would you use to extract network connection information from a Linux memory dump?

A forensic analyst is analyzing a memory dump from a Linux server. The analyst needs to identify all files that were opened by a specific process suspected of being malicious. Which Volatility plugin would be most appropriate?

An incident responder is analyzing a memory dump from a Linux server and needs to find evidence of a process that was running but has since exited. Which Volatility plugin should the responder use to recover information about terminated processes?

Which command is used to display detailed information about the CPU, memory, and other hardware on a Linux system?

Keep studying — Advanced Analysis and Threat Hunting