A forensic analyst needs to extract the IP addresses from a large log file that contains lines like `src=192.168.1.100 dst=10.0.0.1`. The analyst wants to list only the unique source IP addresses, sorted. Which command pipeline would accomplish this?

`sed 's/src=//' logfile | sort -u`

`awk '{print $1}' logfile | sort -u`

`grep -o 'src=[0-9.]*' logfile | cut -d= -f2 | sort -u`

`cut -d= -f2 logfile | sort -u`

GIAC Enterprise Incident Responder

Domain 4Objective 1

Linux Essentials GEIR Practice Questions (Page 5)

Part of the Linux Forensics domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

Questions 21–25

21foundation · easy
On a Red Hat-based distribution using DNF, an administrator wants to remove a package named 'httpd' and its configuration files. Which command accomplishes this?
Select an answer first
22application · medium
A forensic analyst needs to extract the IP addresses from a large log file that contains lines like `src=192.168.1.100 dst=10.0.0.1`. The analyst wants to list only the unique source IP addresses, sorted. Which command pipeline would accomplish this?
Select an answer first
23foundation · easy
An administrator wants to add an existing user 'alice' to the supplementary group 'forensics'. Which command accomplishes this?
Select an answer first
24foundation · easy
An analyst wants to list all files in the current directory, including hidden files, with detailed metadata such as permissions, ownership, size, and modification time. Which command and option combination accomplishes this?
Select an answer first
25application · medium
A security analyst is investigating a Ubuntu server that may have been compromised. The analyst needs to determine whether any installed packages have been modified since installation. Which command would best accomplish this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Linux Essentials GEIR Practice Questions (Page 5)

Questions 21–25

On a Red Hat-based distribution using DNF, an administrator wants to remove a package named 'httpd' and its configuration files. Which command accomplishes this?

A forensic analyst needs to extract the IP addresses from a large log file that contains lines like `src=192.168.1.100 dst=10.0.0.1`. The analyst wants to list only the unique source IP addresses, sorted. Which command pipeline would accomplish this?

An administrator wants to add an existing user 'alice' to the supplementary group 'forensics'. Which command accomplishes this?

An analyst wants to list all files in the current directory, including hidden files, with detailed metadata such as permissions, ownership, size, and modification time. Which command and option combination accomplishes this?

A security analyst is investigating a Ubuntu server that may have been compromised. The analyst needs to determine whether any installed packages have been modified since installation. Which command would best accomplish this?

Keep studying — Linux Forensics