GIAC (SANS)

GIAC Linux Incident Responder

GLIR

The GIAC Linux Incident Responder (GLIR) certification validates deep command-line and triage acumen in Linux environments, a differentiator for modern DFIR and threat hunting teams. It proves you can conduct system triage, collect evidence, and analyze intrusions to identify the initial entry point and lateral movement across Linux systems. Ideal for incident responders, threat hunters, and SOC analysts who need to defend Linux infrastructure.

Practice Free Questions

4Domains

13Objectives

106Practice pages

508Free questions

GLIR free practice questions

Choose any objective and open any question page — no sign-in required.

Linux OS Fundamentals

62 questions · 13 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–55 56–60 61–62

Linux OS File System Structure

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Linux File System Fundamentals and Analysis

38 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–38

Linux File System Artifacts

35 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35

Linux OS Event Log Introduction

32 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

Analyzing Linux Events

36 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–36

Analyzing Linux Application Events

34 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

Linux Timeline Analysis

45 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45

Incident Response Triage

48 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–48

Evidence Collection and Mounting

28 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–28

Analyzing Anti-Forensics Techniques

33 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–33

Linux Memory and Device Profiling Analysis

24 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–24

Linux Threat Hunting and Incident Response

50 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (13 objectives · 106 pages).

GIAC Linux Incident Responder

GLIR free practice questions

Domain 1 · Linux Fundamentals and File System Analysis35% of practice bank · 4 objectives · 178 questions35%

Domain 2 · Event Log Analysis and Timeline Analysis29% of practice bank · 4 objectives · 147 questions29%

Domain 3 · Incident Response and Evidence Handling21% of practice bank · 3 objectives · 109 questions21%

Domain 4 · Advanced Analysis and Threat Hunting15% of practice bank · 2 objectives · 74 questions15%