Which of the following would be used in forensic analysis of a compromised Linux system? (Select THREE).

The correct answer is A. Check log files for logins from unauthorized IPs. D. Check timestamps for files modified around time of compromise. G. Verify the MD5 checksum of system binaries. The MD5 checksum of the system binaries will allow you to carry out a forensic analysis of the compromised Linux system. Together with the log files of logins into the compromised system from unauthorized IPs and the timestamps for those files that were modified around the time…

Enterprise Security Operations

Question

Options

ACheck log files for logins from unauthorized IPs.
BCheck /proc/kmem for fragmented memory segments.
CCheck for unencrypted passwords in /etc/shadow.
DCheck timestamps for files modified around time of compromise.
EUse lsof to determine files with future timestamps.
FUse gpg to encrypt compromised data files.
GVerify the MD5 checksum of system binaries.
HUse vmstat to look for excessive disk I/O.

How the community answered

(49 responses)

A
71% (35)
C
16% (8)
E
8% (4)
F
2% (1)
H
2% (1)

Explanation

The MD5 checksum of the system binaries will allow you to carry out a forensic analysis of the compromised Linux system. Together with the log files of logins into the compromised system from unauthorized IPs and the timestamps for those files that were modified around the time that the compromise occurred will serve as useful forensic tools.

Topics

#Linux forensics#log analysis#MD5 integrity verification#file timestamps

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice