Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You are analyzing a memory dump from a Linux server that was compromised. You suspect a kernel rootkit. Which technique would be most effective in detecting it?

   • ARun 'lsmod' on the live system
   • BScan the memory dump with YARA rules for known rootkit signatures
   • CCompare the loaded kernel modules in memory with the on-disk module list
   • DCheck the system logs for kernel errors
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a key advantage of analyzing a memory dump compared to only examining files on disk?

   • AMemory dumps provide a complete history of all files ever created on the system
   • BMemory dumps are always encrypted and therefore more secure
   • CMemory dumps are smaller and easier to store than disk images
   • DMemory dumps contain evidence of running processes and network connections that may not be present on disk
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of Sysmon for Linux?

   • ATo replace the need for antivirus software on Linux systems
   • BTo automatically block malicious IP addresses
   • CTo manage user permissions and access control lists
   • DTo provide detailed logging of system activity, including process creation and network connections
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   Your organization has an incident response playbook for Linux compromise. During an active incident, you discover a new systemd service that was created minutes ago. According to best practices, what should the playbook instruct you to do FIRST?

   • AImmediately disable the service and remove the unit file
   • BCollect the unit file and any associated scripts, then disable the service
   • CReboot the server to clear the service from memory
   • DRun a full antivirus scan before taking any action
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are updating your incident response playbook for Linux. You need to balance the need for thorough evidence collection with the need to contain an active ransomware outbreak. Which approach best balances these competing priorities?

   • AImmediately isolate the host from the network and then collect evidence
   • BCollect volatile evidence first, then isolate the host
   • CPower off the host immediately to stop encryption
   • DWait for the ransomware to finish before collecting evidence
   Reveal Solution Discussion Select an answer first