Analyzing Linux Application Events GLIR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an application-specific log file commonly used by the Apache HTTP Server?

   • A/var/log/apache2/access.log
   • B/var/log/syslog
   • C/var/log/auth.log
   • D/var/log/nginx/access.log
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A database server's application log shows repeated 'out of memory' errors followed by an unexpected shutdown. The incident responder suspects a denial-of-service attack. Which additional log source would best help confirm whether the memory exhaustion was caused by a flood of external requests or by a local process malfunction?

   • AThe systemd journal
   • BThe audit log
   • CThe network traffic capture (pcap)
   • DThe web server access log
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are investigating a potential privilege escalation on a Linux server. The application logs show that a non-root user successfully ran a command with sudo at 14:00 UTC. However, the system's /var/log/auth.log does not show a corresponding sudo entry. Which log source should you check next to confirm the sudo execution?

   • AThe system's process accounting logs (e.g., acct)
   • BThe bash history of the user account
   • CThe application's own log file, which may record the command and user
   • DThe journald logs, which may contain sudo entries that were not written to auth.log
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which command-line tool can be used to filter and display journald logs in a timeline-friendly format?

   • Asyslog-ng
   • Bjournalctl
   • Cdmesg
   • Dlogrotate
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is reconstructing a user's actions across multiple applications during a suspected data breach. The user 'bob' logged into a web portal, then accessed a file share, and later sent an email. The logs from these applications use different formats and timestamps. What is the most effective approach to correlate these events into a single timeline?

   • AUse the application's built-in reporting feature
   • BManually review each log file and note the timestamps
   • CSearch for the user's IP address in all logs
   • DNormalize all logs to a common format and sort by timestamp
   Reveal Solution Discussion Select an answer first