Linux Timeline Analysis GLIR Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   In a super timeline, you need to find all events related to a specific user `alice` who is suspected of unauthorized activity. The timeline contains filesystem events, process executions, and network connections. Which search/filter approach is most effective?

   • AFilter by the username `alice` across all event types.
   • BSearch for the user's IP address in network logs and correlate with file and process events.
   • CUse a combination of filters: username, user ID, home directory, and processes spawned by the user's session.
   • DFilter by the user's home directory path and processes started by that user.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   In a timeline, you see that a user 'admin' logged in at 02:00, which is outside normal hours. At 02:05, a file /etc/crontab was modified. At 02:10, the user logged out. However, the user 'admin' is a service account that is not supposed to have interactive logins. What is the most likely conclusion?

   • AThe crontab modification was performed by the system automatically.
   • BThe service account was compromised and used to modify crontab for persistence.
   • CThe login and crontab modification are unrelated because they come from different sources.
   • DAn administrator used the service account for legitimate maintenance.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   You have a super timeline and need to isolate all events related to a specific process name 'bash' that occurred between 14:00 and 14:30. Which filter combination is most effective?

   • AFilter by time range only, then manually search for 'bash'.
   • BFilter by process name 'bash' and time range 14:00-14:30.
   • CFilter by user 'root' because bash is often run by root.
   • DUse grep to search for 'bash' in the entire timeline, ignoring time.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following would be considered an anomalous event in a timeline?

   • AA scheduled backup job running at its usual time
   • BA user accessing a file they regularly use
   • CA user logging in at 3:00 AM when they normally log in during business hours
   • DA system update occurring during the maintenance window
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   You are collecting timestamps from a compromised Linux host. The filesystem shows file access times in local time (UTC+5), while the auth.log uses UTC, and process accounting logs use epoch time. To build a coherent timeline, what is the first step you should take?

   • AConvert all timestamps to a single timezone (e.g., UTC) and a consistent format before merging them.
   • BOnly use filesystem timestamps because they are the most reliable.
   • CUse the local timezone of the analyst as the standard for all timestamps.
   • DKeep each source in its original timezone and note the differences in the final report.
   Reveal Solution Discussion Select an answer first