Free GLIR practice test: 30 questions with answers

A change in behavior toward an administrative upload endpoint at an unusual hour is a strong indicator of abuse. HTTP 200 means the server accepted the request, so the uploads may have succeeded.

The binary log records committed changes in a replayable form, which supports point-in-time recovery and forensic reconstruction. The slow query log tracks performance and the error log tracks server events, and the general log is not a complete record of committed changes.

An nftables log statement placed before drop records each matching packet with a prefix that makes it searchable. Disabling the drop or adding comments does not record packets, and forwarding is unrelated.

sshd writes authentication events to the journal, and Debian-based systems also write them to auth.log. The hosts file and apt cache contain no authentication records.

ausearch filters the audit log by key, so -k identity returns events matching the rule tag. logrotate manages log rotation, tcpdump reads packet captures, and journalctl does not read audit keys this way.

The -b option selects a boot by its offset, and -1 means the previous boot. The other commands list boots, filter by time, or print the current boot time, and do not return the earlier boot's entries.

LiME, the Linux Memory Extractor, loads as a kernel module and writes physical memory to a file. The Sleuth Kit analyzes disk file systems, and ss and logrotate do not capture memory.

The linux.pslist plugin walks the kernel task list and lists processes from the memory image. The bash plugin recovers shell history, and the windows and mac plugins apply to other operating systems.

When a running binary is deleted from disk, the kernel keeps the mapped copy and /proc shows the deleted path, which is a common malware tactic. Kernel threads have no executable file, and the other options do not match this suffix.

System cron jobs are defined in /etc/crontab and drop-in files under /etc/cron.d, while per-user jobs live in spool directories. Documentation, login records, and CPU data do not define scheduled execution.

The account database, password hashes, and sudo policy directly control who exists and who can escalate privileges. Manual pages and the login banner do not govern accounts or privileges.

The third field of each shadow entry stores the last password change date as days since the Unix epoch. The first field is the username, the seventh is the expiry, and the second field contains a hash rather than plaintext.

The caret anchors the pattern to the start of each line, so grep returns only lines beginning with Failed password. The second command inverts the match, the third searches file names rather than contents, and the fourth reads the wrong file.

/etc/os-release is the standard identification file that holds the distribution name and version fields. /proc/version reports the kernel build, which is a different fact.

A read-only mount or hardware write blocker prevents changes to the original media. Repair tools and writes to the source device alter evidence, which undermines its integrity.

Matching cryptographic hashes and documented acquisition details establish that the image is an exact, attributable copy. Installing tools or repairing the source changes the evidence before it is captured.

Volatile data such as memory and live process and network state disappears at reboot or over time, so it is captured first. Archived logs and static configuration persist and can be gathered later.

A hash is a verifiable fingerprint that proves the copy equals the source and remains unchanged later. Hashing does not compress or encrypt the data.

Tools such as touch can set mtime and atime to arbitrary values, but ctime is updated by the kernel whenever the inode changes, so it exposes the manipulation. A plain read does not change mtime or ctime.

shred overwrites file contents with patterns before unlinking, which reduces recoverability on some media. touch changes timestamps, chmod changes permissions, and ln creates links, so none of them erase data.

ATT&CK maps adversary behaviors to observable evidence, and STIX/TAXII delivers machine-readable indicators. The other two items carry no hunting value.

Containment stops further damage and lateral movement while keeping evidence intact for investigation. Deleting artifacts too early and rebuilding before collection both destroy evidence.

/dev holds device nodes that give user space access to kernel-managed hardware and virtual devices. /lib contains shared libraries, and the other directories hold configuration or cache data.

The /proc filesystem exposes each process's command line and executable link as virtual files. The other paths do not describe running processes.

fls lists file names and entries in a directory, including deleted ones when the flag is used. mmls shows partition layout, fsstat reports file system metadata, and blkcalc maps block addresses.

istat displays the metadata stored in an inode, such as times, size, and data block addresses. icat outputs file content, mactime builds timelines, and sorter groups files by type.

A new unit and its enable symlink, or a new cron entry pointing to a temporary script, are both persistence artifacts. Documentation and rotated logs do not establish a persistence mechanism.

mactime reads a body file and produces a chronological timeline of MAC times. The other tools report file system details, search for file signatures, or check hash sets.

lastb reads the btmp file, which stores failed login attempts. last reads wtmp for successful sessions, and uptime and who report current state rather than historical failures.

dmesg prints the kernel ring buffer, which contains hardware detection and driver messages from boot. lastlog reports login times, crontab lists scheduled jobs, and ss lists sockets.