GIAC Linux Incident Responder
Domain 2Objective 3
Analyzing Linux Application Events GLIR Practice Questions (Page 7)
Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)
34questions here
7free pages
8concepts
Questions 31–34
- 31
When tracing a user's actions across multiple applications, which field is most commonly used to correlate events?
Select an answer first - 32
An analyst is reconstructing the actions of a compromised user account across multiple applications. The user 'mallory' logged into a VPN, then accessed a file server, and then modified a database record. The logs are in different formats and use different user identifiers (e.g., VPN username, LDAP UID, database username). What is the most effective way to correlate these events?
Select an answer first - 33
When correlating application events with system activity, which system-level data source provides information about network connections?
Select an answer first - 34
A Linux server running a custom web application has been compromised. The incident responder needs to determine whether an attacker used a valid account to log in via SSH and then escalated privileges. Which combination of log sources should the responder examine first to build the most complete picture of the authentication and privilege escalation activity?
Select an answer first
Finished these 4 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to GLIR
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.