~/giac-glir · study ▊

practice sheet · all objectives switch to smart practice →

GIAC Linux Incident Responder

0/30 checked

Q_01 domain/d1 · medium single discuss →

During a Linux intrusion investigation, an analyst suspects a malicious binary's timestamps were altered. According to the SANS whitepaper on timestomping across FAT, Ext3, and Ext4, what determines the specific methods an adversary can use to timestomp files?

A The physical size of the disk being investigated
B The available system access and permissions the adversary has
C Whether the file system uses journaling exclusively
D The number of entries remaining in the Prefetch cache

Q_02 domain/d1 · medium single discuss →

An analyst examining an NTFS volume finds that a suspect executable's $STANDARD_INFORMATION timestamps do not match its $FILE_NAME timestamps. Why does comparing these two attribute sets help detect timestamp manipulation?

A The $FILE_NAME attribute stores UTC while $STANDARD_INFORMATION stores local time, so a difference always indicates tampering
B Windows does not typically update $FILE_NAME timestamps the way it updates $STANDARD_INFORMATION, so they frequently reflect creation, move, or rename events
C The $FILE_NAME attribute is updated every time a file is accessed, providing a continuous access history
D $STANDARD_INFORMATION timestamps cannot be modified by any tool, so they are always authoritative

Q_03 domain/d1 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_04 domain/d1 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_05 domain/d2 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_06 domain/d2 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_07 domain/d2 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_08 domain/d3 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_09 domain/d3 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_10 domain/d3 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_11 domain/d4 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_12 domain/d4 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_13 domain/d4 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_14 domain/d5 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_15 domain/d5 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_16 domain/d5 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_17 domain/d6 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_18 domain/d6 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_19 domain/d6 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_20 domain/d7 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_21 domain/d8 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_22 domain/d8 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_23 domain/d8 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_24 domain/d9 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_25 domain/d11 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_26 domain/d12 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_27 domain/d12 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_28 domain/d12 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_29 domain/d13 · medium multi

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

Q_30 domain/d13 · medium single

Locked question — unlock this exam to view it.

🔒 locked — unlock to review

28 questions locked

unlock all 28 questions