Analyzing Linux Application Events GLIR Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A custom application writes logs in a mixed format: some lines are syslog-style, some are JSON, and some are plain text. The analyst needs to extract all error events from the last hour. Which approach is most robust?

   • AUse a log parsing tool like `lnav` or `grok` to handle multiple formats
   • BUse `grep -i 'error'` on the log file
   • CManually read the log file and note error lines
   • DUse `journalctl` to view the logs
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which log file on a typical Linux system records authentication events such as login attempts?

   • A/var/log/auth.log
   • B/var/log/kern.log
   • C/var/log/dmesg
   • D/var/log/syslog
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In a syslog message, which field identifies the facility that generated the log entry?

   • AThe hostname
   • BThe timestamp
   • CThe message text
   • DThe priority value
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A custom application writes logs in the following format: "2023-10-05 14:23:45, user=jdoe, action=file_upload, file=/tmp/upload.zip, size=1048576". You need to extract all file uploads by user jdoe that are larger than 1 MB. Which command-line approach is most efficient?

   • Agrep 'user=jdoe' /var/log/app.log | grep 'action=file_upload' | awk -F'size=' '$2 > 1048576'
   • Bawk '/user=jdoe/ && /action=file_upload/' /var/log/app.log
   • Cgrep 'size=1048576' /var/log/app.log | grep 'user=jdoe'
   • Dgrep 'action=file_upload' /var/log/app.log | grep 'user=jdoe'
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A web application's log shows a successful login from a user account at 10:00 UTC, followed by a series of requests to /admin/settings at 10:05 UTC. The system's auditd logs show that the web server process spawned a shell (e.g., /bin/sh) at 10:06 UTC. Which conclusion is most strongly supported by this correlation?

   • AThe web server is misconfigured and spawning shells for every request
   • BThe user's session was hijacked and the attacker is exploring the system
   • CThe user is a legitimate administrator performing routine maintenance
   • DThe web application has a vulnerability that allowed the user to execute system commands
   Reveal Solution Discussion Select an answer first