Analyzing Linux Application Events GLIR Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   You are using a timeline analysis tool (e.g., plaso/sleuthkit) to correlate events from a web application, a database, and a file server. The tool shows a user logged into the web app at 10:00, accessed a database record at 10:05, and downloaded a file at 10:10. However, the timestamps are in different timezones (UTC, local, and server-specific). What is the most critical step to ensure accurate correlation?

   • ASort the events by the original timestamp format
   • BUse the tool's default timezone settings
   • CConvert all timestamps to a single timezone (e.g., UTC) before analysis
   • DManually adjust each event's timestamp based on the server's location
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An incident responder needs to quickly identify all application events that occurred around the time of a suspected breach. The events are spread across syslog, journald, and application-specific logs. Which tool or technique would be most efficient for aggregating and visualizing these events on a single timeline?

   • AImporting the logs into a SIEM or timeline analysis tool
   • BUsing `journalctl --merge` to combine all logs
   • CUsing `grep` to search each log file separately
   • DManually comparing timestamps in a spreadsheet
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst is investigating a potential data breach. The application log shows a user 'eve' exported a large amount of data at 10:00 AM. The analyst also sees a spike in outbound network traffic at 10:05 AM. Which additional evidence would most strongly link the application event to the network traffic?

   • AThe user 'eve' has a history of exporting data
   • BThe application server has high CPU usage at 10:05 AM
   • CThe destination IP address in the network traffic matches an IP in the application log
   • DThe systemd journal shows a service restart at 10:05 AM
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A web application's log shows a series of requests with a `cmd` parameter containing shell commands like `whoami` and `ls`. The application is not designed to execute shell commands. This is a strong indicator of what type of attack?

   • ACross-site scripting (XSS)
   • BSQL injection
   • CDenial of service (DoS)
   • DCommand injection
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary method for reconstructing a user's activity timeline from multiple application logs?

   • ASorting events by log file name
   • BSorting events by process name
   • CSorting events by timestamp
   • DSorting events by user ID
   Reveal Solution Discussion Select an answer first