Unit 4: Linux and Network Forensics - Practice Quiz

1 Which type of Linux data is typically lost when the system is powered off?

2 Which item is an example of non-volatile data on a Linux system?

3 What is a forensic image of a Linux storage device?

4 Why is a hash value calculated for a forensic image?

5 Which source is primarily examined during Linux memory forensics?

6 Which evidence can commonly be identified in a Linux memory image?

7 What is the main focus of network forensics?

8 Which device commonly records summaries of network communication flows?

9 What is the basic purpose of a system log?

10 Which Linux directory traditionally contains many system log files?

11 Why are accurate timestamps important in forensic logs?

12 What does network forensic readiness aim to achieve?

13 Which practice best supports network forensic readiness?

14 What is event correlation?

15 Which field is especially useful when correlating firewall and authentication logs?

16 Which network log pattern may be an Indicator of Compromise (IoC)?

17 Which item can be used as a network-based IoC?

18 What does a packet capture contain?

19 Which tool is commonly used to inspect packet capture files?

20 Which filter would help an investigator focus on traffic involving one specific host?

21 A Linux server is suspected of running a reverse shell. Which evidence should an investigator collect first?

22 After an unexpected shutdown, which source is most likely to retain evidence of earlier SSH authentication attempts?

23 An investigator must examine an ext4 image without allowing journal recovery to modify evidence. Which approach is most appropriate?

24 A file's modification time is months earlier than the creation of its owning user account, but its metadata-change time matches the incident date. What should the investigator suspect?

25 A deleted file's directory entry and inode remain available, but its data blocks have been reallocated. What is the most likely recovery outcome?

26 A standard process listing does not show a suspected malware process, but a scan of process structures in memory finds it. What is the best interpretation?

27 Why should an investigator record the acquisition tool, start time, end time, and hash when capturing Linux memory?

28 A firewall log shows malicious traffic from a public IP address shared by many internal users through NAT. Which additional records are most useful for identifying the originating host?

29 Payload inspection is unavailable because a connection uses TLS. Which combination can still help identify suspicious communication?

30 On a systemd-based Linux host, which command is most suitable for reviewing logs associated with the SSH daemon unit?

31 An investigator finds auth.log, auth.log.1, and auth.log.2.gz. What is the correct way to build a complete authentication timeline?

32 Why is consistent time synchronization important across firewalls, servers, and intrusion-detection systems?

33 A sensor records an average of Mbps continuously for seven days. Ignoring overhead and compression, approximately how much storage is required?

34 A packet-capture sensor connected to a switch mirror port frequently drops packets during peak hours. Which readiness improvement best addresses the problem?

35 Logs show repeated failed SSH logins, one successful login, and a sudo command shortly afterward. Which correlation rule would provide the strongest alert?

36 A proxy records usernames, while a firewall records only internal IP addresses. What additional data best supports correlation between their events?

37 DNS logs show one workstation querying hundreds of newly registered domains with long, random-looking subdomain labels. What is the most likely concern?

38 A host sends a small outbound connection to the same rare IP address every 60 seconds, including overnight. Which IoC does this pattern most strongly suggest?

39 A packet capture shows an internal host sending repeated HTTP POST requests containing several megabytes of encoded data to an unfamiliar external server. What should be investigated first?

40 A capture shows one source sending TCP SYN packets to many ports on a server, with very few completed handshakes. Which activity is most consistent with this evidence?

41 A live Linux server uses full-disk encryption, and responders suspect a memory-resident implant. Which acquisition strategy best preserves evidence that would otherwise become inaccessible?

42 A process is executing a malicious file that has been unlinked. /proc/4821/fd/7 points to /tmp/.x (deleted). What is the most direct way to preserve the file's current content before the process exits?

43 On ext4, a file is renamed from /srv/a/report to /srv/b/report without changing its content. Assuming normal Linux behavior, which timestamp pattern is most consistent with that operation?

44 An ext4 volume was mounted with the default data=ordered journaling mode. What conclusion about a previous version of an overwritten file can safely be drawn from the journal alone?

45 An investigator creates an LVM snapshot of a single logical volume containing a mounted ext4 file system and an active database, then images the snapshot. How should the resulting image be characterized?

46 A Linux memory analyzer identifies implausible PIDs and invalid task-list pointers after being supplied symbols from a kernel with the same version number but a different distribution build. What is the best corrective action?

47 A slab scan finds a task_struct that is absent from the normal process list. Which additional finding most strongly supports a hidden live process rather than a stale terminated-process object?

48 A public IP address is shared by thousands of subscribers through carrier-grade NAT. Which evidence is essential for reliably attributing an observed outbound TCP connection to one subscriber?

49 A packet capture contains overlapping TCP segments with conflicting bytes. The IDS alert reflects one byte sequence, but the destination host's operating-system behavior is unknown. What is the most defensible forensic approach?

50 A Linux host uses systemd-journald with Storage=auto. No /var/log/journal directory exists. What should an investigator expect after an ungraceful reboot?

51 A single Linux Audit event is represented by SYSCALL, EXECVE, CWD, and several PATH records. Which field should primarily be used to assemble those records into one event?

52 Host A records event at 12:00:00 with a clock uncertainty of seconds. Host B records event at 12:01:00 with a clock uncertainty of seconds. What ordering is justified from timestamps alone?

53 A sensor records an average traffic rate of 250 Mbps for 30 days. Stored captures achieve a 2.5:1 compression ratio. Ignoring overhead and using decimal units, approximately how much storage is required?

54 An organization wants the ability to inspect approved TLS sessions retrospectively. Most services use ephemeral ECDHE. Which readiness control is technically effective?

55 Which DNS-log pattern should receive the highest investigative priority as a possible command-and-control beacon, while still requiring corroboration?

56 A TLS fingerprint associated with malware is also produced by a widely deployed legitimate runtime. How should analysts use this fingerprint?

57 A web service accepts direct Internet connections and connections through trusted reverse proxies. Proxies append forwarding addresses to X-Forwarded-For. Which method best identifies the probable client without trusting spoofed headers?

58 A PCAP was collected with a 96-byte snapshot length. Flow records show a 500 MB TLS transfer, but the PCAP contains only headers and short payload prefixes. What is the correct conclusion?

59 A host-based packet capture marks nearly every outbound TCP checksum as invalid, while inbound checksums validate and a downstream network sensor sees valid outbound packets. What is the most likely explanation?

60 During suspected ARP spoofing, a capture shows repeated unsolicited ARP replies mapping the default gateway's IP to a new MAC address. Which additional observation most strongly demonstrates an active man-in-the-middle path?