Linux Timeline Analysis GLIR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the first step in identifying anomalous activity in a timeline?

   • AEstablishing a baseline of normal system behavior
   • BRebooting the system to clear logs
   • CRunning a virus scan on the timeline file
   • DDeleting all events older than one month
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which step is essential when building a super timeline?

   • AConverting all events to a proprietary format
   • BDeleting events that appear benign
   • CSorting all collected events by timestamp
   • DRunning the timeline on the compromised system
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A timeline shows that a user `alice` logged in at 09:00, then a file in `/home/alice/secret.txt` was accessed at 09:05, and then a process named `curl` made an outbound connection to an external IP at 09:10. The user `alice` is known to be on vacation. What is the most likely conclusion?

   • AAn attacker is using `alice`'s account to access sensitive files and exfiltrate them.
   • BThe events are unrelated and coincidental.
   • CThe timeline is incorrect because `alice` is on vacation and cannot log in.
   • DAlice returned from vacation early and is working remotely.
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   You need to build a super timeline that includes filesystem timestamps, auth.log entries, and process accounting logs. Which tool is best suited to parse all these sources and produce a unified timeline?

   • Agrep
   • Bplaso (log2timeline)
   • Cfls
   • Dmactime
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   You have a raw disk image from a compromised Linux system. You need to generate a timeline that includes filesystem metadata and also want to incorporate log file entries. Which tool combination is most appropriate?

   • AUse `mactime` to parse the raw image directly without `fls`.
   • BUse `fls` and `mactime` to generate a body file, then use `plaso` to parse logs and merge the results.
   • CUse `plaso` alone to parse both the filesystem and logs directly from the image.
   • DUse `fls` to list files and `mactime` to create a timeline, then manually add log entries.
   Reveal Solution Discussion Select an answer first