Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   You are analyzing a packet capture from a compromised Linux host. You notice repeated connections to an external IP address on port 4444. The traffic is encrypted, but the host also makes DNS queries for a domain that matches a threat intelligence indicator. Which action would best confirm the malicious communication?

   • ACorrelate the DNS query timestamps with the connection timestamps to the external IP
   • BBlock the external IP and see if the host stops communicating
   • CRun a YARA rule on the packet capture to find malware signatures
   • DDecrypt the traffic using the host's private key
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary benefit of integrating threat intelligence feeds into Linux threat hunting?

   • AIt replaces the need for manual log analysis
   • BIt guarantees that all malware will be detected
   • CIt enriches detection by providing known indicators of compromise that can be searched for
   • DIt automatically patches vulnerabilities in Linux systems
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which log file on a Linux system would most likely contain evidence of successful SSH logins from a remote host, indicating potential lateral movement?

   • A/var/log/dpkg.log
   • B/var/log/syslog
   • C/var/log/kern.log
   • D/var/log/auth.log
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which Linux artifact would provide the most direct evidence of a user executing a command that modified system files?

   • AThe /etc/passwd file
   • BThe /var/log/auth.log file
   • CThe /proc/cpuinfo file
   • DThe shell history file in the user's home directory
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   You are responding to a Linux server compromise. The attacker has established persistence using a systemd service that runs a script from /var/tmp. You need to remove the persistence while preserving evidence for forensic analysis. Which sequence of actions best achieves this?

   • ARun a YARA scan on the script, then disable the service
   • BCopy the service file and script to a forensic image, then disable the service and delete the script
   • CReboot the server to stop the service, then delete the script
   • DImmediately disable the service and delete the script to contain the threat
   Reveal Solution Discussion Select an answer first