Free OffSec Incident Responder (OSIR) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the OffSec Incident Responder (OSIR) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An investigator wants the earliest event per source in a Splunk historical search, retaining one event for each source. Which search command meets this requirement?

   1. A.dedup source sortby +_timeCorrect answer: A
   2. B.dedup 2 source sortby -_time
   3. C.dedup 3 source sortby +_time
   4. D.dedup consecutive=true source

   Explanation: Splunk gives the example: "Remove duplicate search results with the same source value and sort the results by the _time field in ascending order." Ascending order selects the earliest duplicate; the other commands retain multiple results or limit removal to consecutive duplicates.

   Reference: dedup — Examples / 2. Remove duplicate results and sort results in ascending order

2. 2An investigator receives a complete disk image and needs the layout and unallocated gaps before locating its file systems. Which Sleuth Kit tool should be used?

   1. A.mmlsCorrect answer: A
   2. B.icat
   3. C.fls
   4. D.ffind

   Explanation: The tool documentation states: "mmls: Displays the layout of a disk, including the unallocated spaces." The other tools extract file contents, list directory names or find names for metadata, rather than displaying the disk layout.

   Reference: TSK Tool Overview — Media Management Tools

3. 3An analyst deduplicates incident events by host but must preserve events that lack the host field. Which dedup option provides that behavior?

   1. A.consecutive=true
   2. B.keepempty=trueCorrect answer: B
   3. C.keepevents=false
   4. D.sortby +_time

   Explanation: The reference states: "If set to true, keeps every event where one or more of the specified fields is not present (null)." The other choices control consecutive matching, event retention behavior, or sorting rather than retention of null host values.

   Reference: dedup — Optional arguments / keepempty

4. 4A directory listing identifies the metadata address of a suspicious executable in a disk image. Which Sleuth Kit tool can extract that file's data using the address?

   1. A.mmls
   2. B.fls
   3. C.icatCorrect answer: C
   4. D.mactime

   Explanation: The tool documentation states: "icat: Extracts the data units of a file, which is specified by its meta data address (instead of the file name)." The other commands show the disk layout, list file names, or produce a file-activity timeline.

   Reference: TSK Tool Overview — Meta Data Layer Tools

5. 5A Splunk event contains an unknown number of attacker addresses, potentially more than three, in one field. A valid rex pattern matches each occurrence. Which max_match value ensures all occurrences are extracted into a multivalue field?

   1. A.max_match=1
   2. B.max_match=2
   3. C.max_match=0Correct answer: C
   4. D.max_match=3

   Explanation: The reference says: "Use 0 to specify unlimited matches." Values 1, 2, and 3 cap the number of regex matches, so they cannot guarantee extraction of every occurrence.

   Reference: rex — Optional arguments / max_match

6. 6Which Sleuth Kit command can extract a file system's unallocated space for a forensic search?

   1. A.blklsCorrect answer: A
   2. B.blkstat
   3. C.ffind
   4. D.mmstat

   Explanation: The tool documentation states: "blkls: Lists the details about data units and can extract the unallocated space of the file system." blkstat reports a unit's statistics; ffind locates names and mmstat describes the volume system.

   Reference: TSK Tool Overview — Data Unit Layer Tools

7. 7An analyst wants to retain all events after deduplication by user but clear the user field from later duplicates. Which Splunk dedup option should be used?

   1. A.keepempty=true
   2. B.consecutive=true
   3. C.keepevents=false
   4. D.keepevents=trueCorrect answer: D

   Explanation: Splunk states: "If true, keep all events, but will remove the selected fields from events after the first event containing a particular combination of values." The other settings do not preserve every event while clearing the repeated field.

   Reference: dedup — Optional arguments / keepevents

8. 8An examiner runs fls -d on a disk image. Which entries does this option display?

   1. A.Deleted entries onlyCorrect answer: A
   2. B.Directory entries only
   3. C.Undeleted entries only
   4. D.Non-directory entries only

   Explanation: The fls manual states: "Display deleted entries only" for -d. The other descriptions correspond to -D, -u and -F.

   Reference: FLS manual page — Description / -d

9. 9A Splunk search for encoded DNS subdomains uses a heuristic that matches an alphanumeric subdomain whose length is divisible by four. How should an investigator interpret a match?

   1. A.It confirms data was exfiltrated over DNS.
   2. B.It may be a false positive and needs visual inspection.Correct answer: B
   3. C.It confirms the matched subdomain is Base64-encoded data.
   4. D.It proves the queried host is running malware.

   Explanation: Splunk cautions: "The query can result in false positive matches if the subdomain contains a number of characters divisible by 4, and contains only alphanumeric characters." The heuristic requires visual inspection and alone proves neither encoding, exfiltration, nor malware.

   Reference: Using Enterprise Security to find data exfiltration — DNS search for encoded data

10. 10A file system begins at sector 2048 of a disk image. When running fls on the whole image, what does its -o option specify?

    1. A.The file system's starting sector offsetCorrect answer: A
    2. B.The inode of the target executable
    3. C.The number of bytes in a file's slack
    4. D.The count of deleted directory entries

    Explanation: The tool documentation states: "The sector offset where the file system starts in the image." For this image the offset is 2048 sectors. The option does not select an inode, slack length or entry count.

    Reference: FLS manual page — Description / -o imgoffset