
GIAC Enterprise Incident Responder
Domain 4Objective 1
Linux Essentials GEIR Practice Questions (Page 1)
Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)
29questions here
6free pages
10concepts
Questions 1–5
- 1
A security analyst needs to verify that the installed version of the OpenSSL package on a CentOS 8 system is up-to-date with the latest security patches. Which command should the analyst use?
Select an answer first - 2
A system administrator needs to write a shell script that parses a log file and extracts the number of occurrences of the word 'ERROR' per day. The log lines are formatted like `2023-10-01 12:00:00 ERROR Something went wrong`. The script should output the date and the count, sorted by date. Which script snippet would accomplish this?
Select an answer first - 3
A Linux administrator is troubleshooting a service that fails to start. The service logs to the systemd journal. Which command would show the most recent log entries for the service named `myapp.service`?
Select an answer first - 4
A security analyst is investigating a suspicious process on a Linux server. The process is named `kworker` and is using high CPU. The analyst needs to determine if this process is legitimate or a masquerading process. Which command would provide the most useful information to make this determination?
Select an answer first - 5
While monitoring a system, an analyst runs the 'top' command. What is the primary purpose of this command?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.