Linux Timeline Analysis GLIR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During an investigation, you find that a file /tmp/exploit was created at 10:00, and at 10:01 the process 'nc' (netcat) was executed, and at 10:02 a network connection to an external IP was established. What does this sequence indicate?

   • AAn attacker uploaded a tool, executed it, and established a network connection for data exfiltration or a shell.
   • BThe system is running a scheduled security scan.
   • CThe events are unrelated because they come from different artifact sources.
   • DA user is testing network connectivity with a legitimate tool.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a 'super timeline' in the context of Linux incident response?

   • AA timeline that includes only filesystem events from a single partition
   • BA timeline that is generated automatically by the operating system
   • CA timeline that uses a special timezone to display all events
   • DA timeline that combines events from multiple artifact sources into a single chronological view
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   You have a super timeline with millions of events. You need to identify all events related to a specific user 'bob' between 12:00 and 13:00 on a given day. Which filtering approach is most effective?

   • AGenerate a new timeline that only includes events from /var/log/auth.log.
   • BSearch the raw timeline text for 'bob' using grep and then manually check timestamps.
   • CUse a timeline tool's filter to select events where the user field is 'bob' and the timestamp is within the range.
   • DUse mactime to filter by user, since it supports user-based filtering.
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   You have a body file from a compromised system and need to generate a timeline that shows file access, modification, and change times in a readable format. Which command-line tool is specifically designed for this task?

   • Astat /etc/passwd
   • Bgrep -r 'access' /var/log
   • Cmactime -b bodyfile
   • Dfls -r /dev/sda1
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which filter would be most effective for isolating events related to a specific file path in a timeline?

   • AFilter by user ID
   • BFilter by file path
   • CFilter by process name
   • DFilter by event type
   Reveal Solution Discussion Select an answer first