Linux Timeline Analysis GLIR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are correlating events from a Linux system that uses local time (CST, UTC-6) for its logs, but the filesystem timestamps are stored in UTC. You notice an SSH login at 01:30 CST and a file creation at 07:30 UTC. What is the relationship between these events?

   • AThe file was created 30 minutes before the SSH login.
   • BThe relationship cannot be determined without more information.
   • CThe events occurred at the same time.
   • DThe file was created 30 minutes after the SSH login.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is timeline analysis considered a critical step in Linux incident response?

   • AIt provides a definitive method for attributing the attack to a specific individual
   • BIt automatically generates a report suitable for legal proceedings
   • CIt helps identify the exact malware family used in the attack
   • DIt enables investigators to understand the order and relationship of events leading to and during an incident
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are building a super timeline from a compromised system. You have a filesystem timeline from `fls`/`mactime`, syslog, and process accounting. The filesystem timeline shows a file creation at 12:00:00, but the syslog shows a related event at 12:00:05. However, the process accounting log shows the process that created the file started at 11:59:55. What is the most accurate interpretation?

   • AThe syslog event is unrelated to the file creation.
   • BThe process started before the file was created, which is consistent with the process creating the file.
   • CThe timestamps are inconsistent and cannot be used for correlation.
   • DThe file was created before the process started, indicating the process did not create it.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of applying a time range filter to a timeline?

   • ATo highlight events that are suspicious
   • BTo change the timezone of all events
   • CTo sort events by time in ascending order
   • DTo reduce the timeline to events that occurred during a specific period of interest
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which combination of events would be most useful for correlating to identify a potential data exfiltration?

   • ASystem boot times and kernel log entries
   • BUser login times and password changes
   • CFile access, outbound network connections, and process execution
   • DFilesystem free space and disk usage
   Reveal Solution Discussion Select an answer first