A Linux server runs a custom application that authenticates users via PAM. You are investigating a potential brute-force attack. The application writes its own auth logs to /var/log/customapp/auth.log, while the system also uses journald. You notice that the application's log shows repeated "Login failed" entries, but the system's auth.log shows no corresponding PAM failures. What is the most likely explanation for this discrepancy?

The application is bypassing PAM and implementing its own authentication logic

The application is writing to journald but not to syslog

The PAM configuration is set to log only successful authentications

The system's auth.log is rotated and the entries were overwritten

Which of the following is an example of an authorization event that should be analyzed for suspicious activity?

A user entering an incorrect password

A user opening a file in a text editor

A user successfully logging in via SSH

A user being added to the sudo group

A security analyst is investigating a suspicious file upload to a web application. The application writes logs in a custom format: `timestamp|user_id|action|filename|size`. The analyst needs to find all upload events for a specific user that occurred within a 10-minute window. Which command would most efficiently extract and filter these events?

sed -n '/2024-01-15 10:00:00/,/2024-01-15 10:10:00/p' /var/log/app/custom.log | grep 'upload' | grep '1001'

grep '1001' /var/log/app/custom.log | grep 'upload' | grep '2024-01-15 10:'

grep 'upload' /var/log/app/custom.log | awk -F'|' '$2=="1001"' | awk '$1 >= "2024-01-15 10:00:00" && $1 <= "2024-01-15 10:10:00"'

awk -F'|' '$3=="upload" && $2=="1001" && $1 >= "2024-01-15 10:00:00" && $1 <= "2024-01-15 10:10:00"' /var/log/app/custom.log

GIAC Linux Incident Responder

Domain 2Objective 3

Analyzing Linux Application Events GLIR Practice Questions (Page 5)

Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

Questions 21–25

21foundation · easy
Which tool is specifically designed for timeline analysis of forensic artifacts?
Select an answer first
22application · medium
A Linux server runs a custom application that authenticates users via PAM. You are investigating a potential brute-force attack. The application writes its own auth logs to /var/log/customapp/auth.log, while the system also uses journald. You notice that the application's log shows repeated "Login failed" entries, but the system's auth.log shows no corresponding PAM failures. What is the most likely explanation for this discrepancy?
Select an answer first
23foundation · easy
Which of the following is an example of an authorization event that should be analyzed for suspicious activity?
Select an answer first
24application · medium
A security analyst is investigating a suspicious file upload to a web application. The application writes logs in a custom format: `timestamp|user_id|action|filename|size`. The analyst needs to find all upload events for a specific user that occurred within a 10-minute window. Which command would most efficiently extract and filter these events?
Select an answer first
25foundation · easy
Which system-level log is most useful for correlating application events with file access activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Analyzing Linux Application Events GLIR Practice Questions (Page 5)

Questions 21–25

Which tool is specifically designed for timeline analysis of forensic artifacts?

Which of the following is an example of an authorization event that should be analyzed for suspicious activity?

Which system-level log is most useful for correlating application events with file access activity?

Keep studying — Event Log Analysis and Timeline Analysis