Unit 4: Linux, Mac and Network Forensics - Practice Quiz

1 Which of the following is an example of volatile data in a Linux system?

2 Which Linux command displays the current running processes, useful for collecting volatile data?

3 Non-volatile data in Linux is best described as data that:

4 The Sleuth Kit (TSK) is primarily used for:

5 Which graphical interface is commonly used together with The Sleuth Kit?

6 Which Sleuth Kit command is used to list files and directories in a filesystem image?

7 Volatility is a framework primarily used for:

8 PhotoRec is a tool mainly used to:

9 A memory dump used in Volatility analysis represents:

10 Which file system is most commonly associated with modern macOS systems?

11 Which file format is commonly used for property list configuration files on macOS?

12 Network forensics primarily focuses on:

13 Which tool is widely used to capture and inspect network packets?

14 In Linux, which directory typically stores system log files?

15 Network forensic readiness refers to an organization's ability to:

16 Event correlation in security analysis means:

17 Which of the following is a common Indicator of Compromise (IoC)?

18 The process of capturing packets flowing across a network is called:

19 What does the acronym SIEM stand for?

20 Which of the following is an example of a wireless network attack?

21 During live acquisition of a compromised Linux server, an investigator must collect data following the order of volatility. Which data source should be collected first?

22 An investigator wants to view all active network connections and the processes bound to them on a live Linux host. Which command provides this volatile data most directly?

23 Given a raw disk image, which sequence of Sleuth Kit tools correctly lists partitions and then lists the files in a chosen partition?

24 An analyst finds a deleted file's inode number 24580 using fls. Which Sleuth Kit command extracts the file's content by inode from the image?

25 Which Sleuth Kit tool would you use to display filesystem-level details such as block size, layout, and last mount time from an image?

26 An investigator has a memory dump but does not know the OS profile. Which Volatility plugin/command helps identify the correct profile before further analysis?

27 A suspicious process may be hiding by unlinking itself from the active process list. Which Volatility approach best reveals such a hidden process?

28 PhotoRec is used on a formatted SD card to recover lost images. On which principle does PhotoRec primarily rely to recover files?

29 On a macOS system, application preferences and configuration are commonly stored in property list files. What is the typical binary format and extension of these files?

30 An examiner needs to determine when files were last accessed and any extended metadata on an APFS volume. Which macOS artifact records Spotlight metadata useful for this?

31 Which macOS file records details about recently mounted disks, USB devices, and system activity that is valuable during timeline analysis?

32 A network forensic investigator wants a full packet capture for later deep analysis rather than only summary flow records. Which data type should be collected?

33 Which statement best distinguishes NetFlow data from full packet capture in a network investigation?

34 To ensure logs are trustworthy across many hosts during an investigation, which practice is most critical for accurate event correlation?

35 An organization wants to prevent attackers from tampering with logs on a compromised host. Which control best supports forensic readiness?

36 A SIEM raises an alert only when a failed VPN login is followed within 5 minutes by a successful login from a new country. This detection is an example of which correlation technique?

37 Which scenario best illustrates the value of cross-source event correlation?

38 While reviewing proxy logs, an analyst notices a host making regular HTTPS requests to a newly registered domain every 60 seconds with tiny, uniform payloads. This pattern most strongly indicates which IoC?

39 DNS logs show many queries for long, random-looking subdomains of a single domain (e.g., a8f3k2.example.com, 9x2p1z.example.com). This is a common indicator of which technique?

40 In Wireshark, an analyst wants to reconstruct and read the full application-layer conversation of a single TCP session. Which feature should they use?

41 During live acquisition of a compromised Linux host, an analyst runs cat /proc/1234/maps and cat /proc/1234/mem. Which statement best explains the forensic value and risk of this technique?

42 An investigator must preserve evidence following the order of volatility (RFC 3227). Given: (1) routing tables, (2) archival media, (3) process memory, (4) disk. What is the correct collection order from most to least volatile?

43 Using The Sleuth Kit on an Ext4 image, an analyst finds a file entry via fls showing an inode marked with * prefix and reallocated. Which combined command sequence best recovers its original content if the inode has not been overwritten?

44 An analyst runs mmls disk.dd and sees a partition starting at sector 2048. To run fls on that filesystem, which option correctly maps the byte offset?

45 In Volatility 3, an analyst suspects process hollowing. Which combination of plugins most effectively confirms that a legitimate process image was replaced in memory?

46 PhotoRec recovers a fragmented JPEG partially but truncates it. What is the fundamental reason file carvers like PhotoRec often fail on fragmented files?

47 An analyst captures a memory image but Volatility reports no valid profile/symbol table for a Linux target. What is the most correct root cause and remedy?

48 Investigating a macOS system with APFS, an analyst needs to recover deleted files but finds standard carving ineffective. Which APFS feature most complicates recovery and why?

49 An examiner wants to establish a timeline of application usage on macOS. Which artifact provides the most authoritative record of app launches and durations?

50 An analyst reconstructs a TCP session from a PCAP but observes overlapping segments with different payloads for the same sequence numbers. What is the primary forensic concern this raises?

51 When would a full-packet capture (PCAP) be forensically insufficient, requiring flow data (NetFlow/IPFIX) instead?

52 An organization uses UDP-based syslog to a central collector. During an incident, gaps appear in the logs. Which design flaw most directly explains missing entries and what mitigates it?

53 To ensure log integrity for court admissibility, which mechanism best prevents undetected tampering of stored logs?

54 A SIEM correlation rule fires when a single source generates failed logins within 60s followed by one success. This alerts on many legitimate users mistyping passwords. Which refinement best reduces false positives while preserving detection?

55 In event correlation, what distinguishes rule-based correlation from statistical (anomaly-based) correlation in detecting a novel, slow data-exfiltration campaign?

56 Reviewing DNS logs, an analyst notices many queries to subdomains like a8f3.example.net, b91c.example.net with high entropy and short TTLs. Which IoC does this most strongly indicate?

57 An analyst sees periodic outbound HTTPS connections every 300 seconds to one IP, each transferring nearly identical small byte counts. Even without payload visibility, which IoC is most consistent with this pattern?

58 Using Wireshark on a capture, an analyst applies the filter tcp.analysis.retransmission && tcp.flags.syn==1. Beyond troubleshooting, why might a security analyst use this specific filter during an investigation?

59 A SIEM ingests logs from sources in different time zones without normalization. During cross-source correlation of an intrusion, what is the most severe consequence?

60 An analyst captures 802.11 frames and observes a burst of deauthentication frames with the spoofed BSSID of a legitimate AP followed by clients associating to a new AP with the same SSID. Which attack does this evidence chain most strongly indicate?