AP Cybersecurity: Applying Commands in Real Scenarios
This quiz focuses on when and why to use a Linux command — not just what it’s called. Think like a cybersecurity analyst working at the command line.
Questions are related to the commands in the cyber.org Linux Commands Cheat Sheet.
Click an option, then press the check button (or “c”) to see if you’re right. Press “q” to reset a question.
You just SSH’d into an unfamiliar Linux server during an incident response. You want to see EVERY file in the current directory, including hidden dotfiles and their permissions. What do you run?
Hidden config files and dotfiles are a common place attackers stash persistence mechanism.
You’ve been navigating through several nested directories investigating a compromised web app and have lost track of where you are. What command re-orients you?
In incident response, always know (and document) your exact file path before you touch anything.
You’re setting up a case folder to organize evidence for a forensics investigation. What command creates a new folder called case_2024_017?
Keeping organized, well-named case directories is a core forensic best practice.
A junior analyst is about to run rm -rf /var/log to “clean up disk space.” Why should you stop them?
This command has no undo. Security teams often set aliases or extra confirmation prompts to guard against accidental use.
Before editing a critical configuration file like /etc/ssh/sshd_config, what’s the safest first step?
“Copy before you touch it” is a habit that saves you during both routine admin work and live incident response.
After investigating a suspicious script, you want to rename payload.txt to payload_ANALYZED.txt to mark it as reviewed. What command does this?
Renaming reviewed evidence files is a simple but useful way to track your progress during an investigation.
Your team runs the same vulnerability scan script from /opt/tools/scan.sh constantly, but typing the full path each time is tedious. What’s a good solution?
Symbolic links are common for making tools and shared scripts easily accessible without duplicating files.
You constantly type ls -alh --color to review directories in detail. How can you save time going forward?
Aliases are especially handy for long or frequently-used security commands, like custom grep searches you run often.
A log file auth.log is actively growing as a brute-force attack unfolds. You want to watch new login attempts appear in real time. Which approach fits best?
This is a go-to command for live-monitoring logs during a security incident.
You’ve received a massive 500,000-line log file and just want to quickly confirm the file starts with the expected header format before diving in. What command helps?
For huge files, this command is much faster and safer than cat for a quick peek.
You suspect an attacker’s IP address, 203.0.113.45, appears somewhere in a massive access.log file. How do you find every line mentioning it?
This is one of the most-used tools in a security analyst’s toolkit for hunting through logs for indicators of compromise.
You want to find every currently running process, then filter that list down to only show processes related to “python” (which might be running a malicious script). What’s the best approach?
The pipe (|) is what makes the Linux command line so powerful — chaining simple tools together to answer complex questions.
You want to keep a permanent copy of everything the ps aux command shows right now, saved to a file called process_snapshot.txt, for later comparison. What do you run?
Taking timestamped snapshots (like a process list or network connections) with > is a common forensic technique to compare “before vs. after.”
You found a suspicious shell script, cleanup.sh, that won’t execute even though you have read access to it. What’s most likely needed?
Before executing any unfamiliar script, cybersecurity analysts should read through its contents first (with cat or a text editor) to check for malicious commands.
Your team is hardening a shared server. A sensitive configuration file is currently world-writable (anyone can edit it) — a major security risk. Which command tightens this so only the owner can read/write, and everyone else can only read?
chmod 777 is a huge red flag during a security audit — it means no access control at all.
The server feels sluggish, and you suspect one process is eating up most of the CPU. What’s the fastest way to check which process is the culprit right now?
This tool is an essential first-response command when investigating performance issues or possible cryptomining malware.
After identifying a malicious process (PID 4821) that won’t respond to a normal shutdown request, what should you run to force it to stop immediately?
This command is a last resort — it doesn’t let the process clean up after itself, so use it when a process is unresponsive or clearly malicious.
You copied an evidence file from a suspect’s account to your own investigation folder, but it’s still owned by the original user, blocking you from modifying it as needed. What fixes this?
Maintaining a clear, documented chain of custody — including who owns evidence files — matters both technically and legally in real investigations.
You need to install a security patch, but the update command requires root-level access, and you’re logged in as a standard user. What do you prepend to the command?
Because this command grants powerful access, cybersecurity teams closely monitor and log its use — misuse of sudo is a common attack vector.
During a post-incident review, you want to see exactly which commands the attacker (or the compromised account) typed most recently on this system. What do you check?
Attackers sometimes try to clear their history to cover their tracks — its absence (or gaps) can itself be a clue during an investigation!
You’ve now practiced applying real Linux commands to real cybersecurity scenarios:
Knowing when to reach for a command matters just as much as knowing its syntax — keep practicing at the terminal!