During an incident, an analyst sees an application log entry showing a user 'alice' downloaded a sensitive file at 14:32:05. To confirm whether this was a legitimate action, the analyst needs to correlate this event with system activity. Which additional data source would provide the strongest evidence of the actual process and network connection associated with the download?

The application's configuration file

A web application's logs show a successful login from a user account at 10:00 UTC, followed by a series of requests to /admin/settings at 10:05 UTC. The system's auditd logs show that the web server process spawned a shell (e.g., /bin/sh) at 10:06 UTC. Which conclusion is most strongly supported by this correlation?

The web server is misconfigured and spawning shells for every request

The user is a legitimate administrator performing routine maintenance

The user's session was hijacked and the attacker is exploring the system

The web application has a vulnerability that allowed the user to execute system commands

You are investigating a breach that spans multiple applications: a web front-end, a database, and a file server. Each application writes logs in a different format (syslog, JSON, and custom text). You need to build a unified timeline of user actions across all three. Which approach is most efficient for this task?

Use a log aggregation tool (e.g., Elasticsearch, Loki) to ingest all logs, normalize timestamps, and search across them

Filter each log for the affected user's username and then compare timestamps manually

Manually review each log file in chronological order, starting with the web front-end

Convert all logs to JSON using a custom script, then merge them into a single file

A critical application crashed unexpectedly. The application log shows a segmentation fault, but the analyst needs to determine if the crash was caused by a malicious input or a software bug. Which log source would provide the most detailed information about the crash's cause?

The application's core dump file

GIAC Linux Incident Responder

Domain 2Objective 3

Analyzing Linux Application Events GLIR Practice Questions (Page 4)

Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

Questions 16–20

16foundation · easy
Which command-line tool is commonly used to parse and query JSON-formatted application logs?
Select an answer first
17application · medium
During an incident, an analyst sees an application log entry showing a user 'alice' downloaded a sensitive file at 14:32:05. To confirm whether this was a legitimate action, the analyst needs to correlate this event with system activity. Which additional data source would provide the strongest evidence of the actual process and network connection associated with the download?
Select an answer first
18expert · hard
A web application's logs show a successful login from a user account at 10:00 UTC, followed by a series of requests to /admin/settings at 10:05 UTC. The system's auditd logs show that the web server process spawned a shell (e.g., /bin/sh) at 10:06 UTC. Which conclusion is most strongly supported by this correlation?
Select an answer first
19application · medium
You are investigating a breach that spans multiple applications: a web front-end, a database, and a file server. Each application writes logs in a different format (syslog, JSON, and custom text). You need to build a unified timeline of user actions across all three. Which approach is most efficient for this task?
Select an answer first
20application · medium
A critical application crashed unexpectedly. The application log shows a segmentation fault, but the analyst needs to determine if the crash was caused by a malicious input or a software bug. Which log source would provide the most detailed information about the crash's cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Analyzing Linux Application Events GLIR Practice Questions (Page 4)

Questions 16–20

Which command-line tool is commonly used to parse and query JSON-formatted application logs?

A critical application crashed unexpectedly. The application log shows a segmentation fault, but the analyst needs to determine if the crash was caused by a malicious input or a software bug. Which log source would provide the most detailed information about the crash's cause?

Keep studying — Event Log Analysis and Timeline Analysis