Linux Timeline Analysis GLIR Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   You have a super timeline in a CSV format with millions of events. You need to quickly find all events related to a specific file path `/var/www/html/index.php` that occurred between 12:00 and 13:00. Which tool or method is most efficient?

   • ALoad the timeline into a spreadsheet and use filters.
   • BUse `awk` to filter by both the file path and the time range in one pass.
   • CUse `grep` to search for the file path and then manually filter by time.
   • DUse `plaso` to re-parse the timeline with filters.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Why is normalizing timestamps to a consistent timezone and format important in timeline analysis?

   • ATo encrypt the timeline data for secure storage
   • BTo ensure that events from different sources can be accurately compared and correlated
   • CTo make the timeline data readable by all operating systems
   • DTo reduce the storage space required for timeline data
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   You are investigating a breach. The timeline shows that at 01:00, a file /tmp/exploit was created. At 01:01, the process 'python' executed /tmp/exploit. At 01:02, a network connection to an external IP on port 8080 was established. However, the system's clock was later found to be 5 minutes ahead. What is the correct interpretation?

   • AThe events actually occurred at 00:55, 00:56, and 00:57, and the sequence remains the same.
   • BThe clock skew makes the timeline unusable for correlation.
   • CThe events occurred at 01:05, 01:06, and 01:07, and the sequence is reversed.
   • DThe events occurred at 00:55, 00:56, and 00:57, but the sequence is now reversed.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   You have a super timeline with millions of events. You need to identify all events that occurred within 5 minutes of a specific file modification, but the timeline is too large to manually inspect. What is the most efficient approach?

   • AUse a timeline analysis tool that supports time-based filtering, such as `plaso` or `mactime` with a time range.
   • BUse `grep` to find the file modification event and then manually look at surrounding events.
   • CFirst find the timestamp of the file modification, then filter the timeline to that timestamp ±5 minutes.
   • DSort the timeline by file path and then look for the modification event.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   You are using `plaso` to parse a disk image and generate a timeline. The timeline includes events from the filesystem, logs, and other artifacts. However, you notice that some events have timestamps that are clearly wrong (e.g., in the future). What is the best course of action?

   • AIgnore the future timestamps because they are likely errors.
   • BInvestigate the source of the future timestamps, such as clock skew or malicious tampering, and document them.
   • CRemove the events with future timestamps from the timeline.
   • DAdjust the future timestamps to the current time.
   Reveal Solution Discussion Select an answer first