Linux Timeline Analysis GLIR Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When interpreting timeline results, what is the key to distinguishing between benign and malicious events?

   • AThe context of the event relative to other events and system behavior
   • BThe number of events in the timeline
   • CThe color of the event in the visualization tool
   • DThe file size of the timeline data
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   In a super timeline, you see that at 02:13:44 a file /etc/passwd was modified, at 02:13:45 a new user account 'support' was added (from auth.log), and at 02:14:02 an SSH login from an external IP occurred as 'support'. What is the most reasonable conclusion?

   • AThe timeline is corrupted because events from different sources cannot be correlated that closely.
   • BThe file modification and user creation are unrelated because they are from different artifact sources.
   • CAn attacker likely modified /etc/passwd to add a backdoor account, then used it to gain access via SSH.
   • DThe SSH login caused the /etc/passwd modification, so the file change is benign.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   In a timeline of a web server, you notice that every night at 03:00 the file /var/www/html/index.php is accessed, but the access log shows the request comes from a different internal IP each time. The server has no scheduled maintenance. What does this pattern most likely indicate?

   • AA legitimate backup process that rotates IPs.
   • BAn attacker using a rotating proxy or compromised hosts to probe the file.
   • CA cron job on multiple machines that is misconfigured.
   • DA network load balancer that distributes health checks.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a common source of timestamps used in Linux timeline analysis?

   • ADNS resolver cache
   • BFilesystem metadata (MAC times)
   • CWindows Registry hives
   • DSMART disk health logs
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You are building a super timeline for a Linux server compromise. You have collected the filesystem timeline from `fls`/`mactime`, syslog entries, and process accounting logs (acct). All sources use different timestamp formats and timezones. What is the most important step before merging them into a single timeline?

   • ARemove any timestamps that appear to be outliers to avoid skewing the timeline.
   • BConvert all timestamps to a consistent timezone and format, such as UTC and ISO 8601.
   • CSort each source separately and then concatenate them in the order of collection.
   • DUse the filesystem timeline as the master and adjust other sources to match its timezone.
   Reveal Solution Discussion Select an answer first