Skip to content
?
Cyber Interview Questions
?
Questions
Quiz
Interview
Guides
Search
Home
Quiz
Malware Analyst / Reverse Engineer
Quiz for
Malware Analyst / Reverse Engineer
1 / 12
30s · 0 pts
A suspicious Linux process is running from a binary that was deleted from disk — is the evidence gone?
1
Yes — once the file is unlinked the binary is gone for good, so only the process's network traffic can be analyzed.
2
Yes — deletion removes the executable image from memory too, so kill the process and move on to log review.
3
No — while the process runs, /proc/<pid>/exe can still be opened, so copy the executable out before killing it.
4
No — but it can only be recovered after a reboot, when the filesystem journal replays the deleted file.
Tip: press 1–4 to answer, Enter for next.