Analyzing Linux Application Events GLIR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an indicator of malicious application behavior?

   • AAn application sending an email notification
   • BAn application writing to its own log file
   • CAn application reading its configuration file at startup
   • DAn application making outbound connections to a known command-and-control server
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is the primary source for application event data on a modern Linux system using systemd?

   • AThe journald service
   • BThe /var/log/messages file
   • CThe /proc/kmsg file
   • DThe /etc/syslog.conf file
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A database server's application log shows a series of unexpected crashes at 02:00, 02:05, and 02:10. The system's journald shows that the database process was killed by SIGKILL at those exact times. The application log also shows a "memory allocation failure" just before each crash. Which additional data source would most directly help you determine if this was a malicious attack or a resource issue?

   • AThe process accounting logs (e.g., auditd) showing which user or process initiated the SIGKILL
   • BThe database's query logs showing any unusual queries before the crashes
   • CThe system's memory usage logs (e.g., from monitoring tools) showing available RAM at those times
   • DThe application's error log showing the exact error message before the crash
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst notices that a web application's log contains an entry with a `user-agent` string that is a long base64-encoded blob, and the request is a `POST` to `/upload` with a large payload. The analyst suspects data exfiltration. Which additional log source would provide the most direct evidence of the data being transferred out of the network?

   • AThe systemd journal
   • BThe firewall/proxy log
   • CThe authentication log
   • DThe application's error log
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following application behaviors is most likely to indicate a security incident rather than a routine error?

   • AAn application repeatedly attempting to read a file outside its expected directory
   • BAn application logging a warning about low disk space
   • CAn application crashing due to a null pointer exception
   • DA web server returning a 404 error for a missing page
   Reveal Solution Discussion Select an answer first