Linux Timeline Analysis GLIR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You are constructing a super timeline from multiple sources: filesystem metadata, syslog, and process accounting. After merging, you notice that some events have duplicate timestamps and overlapping information. What is the best practice to handle this?

   • ASort the timeline by source rather than by time to avoid confusion.
   • BRemove duplicate events to reduce noise, but keep the source information for each event.
   • CMerge events that have the same timestamp and description into a single entry, noting the multiple sources.
   • DKeep all events, even if they appear duplicated, because they may come from different sources.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What does the sequence of events in a timeline help an investigator determine?

   • AThe exact identity of the attacker
   • BThe order of actions taken during an incident
   • CThe effectiveness of the security controls in place
   • DThe total number of compromised systems
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   In a timeline, you see that a user 'john' logged in at 23:00, which is unusual for his normal working hours (9-5). At 23:05, a file /home/john/.ssh/authorized_keys was modified. What is the most likely conclusion?

   • AThe system automatically updated the SSH keys.
   • BAn attacker has compromised John's account and added an SSH key for persistence.
   • CThe timeline is showing unrelated events.
   • DJohn is working late and adding a new SSH key for convenience.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A server's timeline shows that a file `/usr/lib/libc.so.6` was modified at 03:00, and at 03:01 a process named `httpd` started. The system administrator says no updates were scheduled. What is the most likely explanation?

   • AThe file modification is a false positive from the timeline tool.
   • BThe server was rebooted and the library was updated during boot.
   • CAn attacker replaced the libc library to hide malicious activity.
   • DThe httpd process legitimately updated the library.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   In a timeline, you notice that a system binary /usr/bin/ssh has been modified recently, and the modification time is outside the normal patch window. What should you do next?

   • ACheck the access time to see if it was executed recently.
   • BIgnore it because system binaries are often updated by administrators.
   • CCompare the binary's hash to the known-good hash from the package manager or a baseline.
   • DImmediately reinstall the operating system.
   Reveal Solution Discussion Select an answer first