Analyzing Linux Events GLIR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which log file commonly contains network connection events?

   • A/var/log/auth.log
   • B/var/log/kern.log
   • C/var/log/dpkg.log
   • D/var/log/syslog
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst needs to export journald logs from the last 24 hours to a file for analysis. Which command would accomplish this?

   • Ajournalctl --since "today" > /tmp/journal_export.txt
   • Bjournalctl --until "24 hours ago" > /tmp/journal_export.txt
   • Cjournalctl --since "24 hours ago" > /tmp/journal_export.txt
   • Djournalctl --since "yesterday" > /tmp/journal_export.txt
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During an incident, you notice that a user account was created at 03:00 UTC, and at 03:05 UTC a new SSH key was added to the root user's authorized_keys file. You need to determine if these events are related and if the account creation was the initial access vector. Which combination of log sources would you correlate to build the most complete timeline?

   • AOnly journald, since it aggregates all system logs in one place.
   • BOnly auditd logs, since they capture all system calls including useradd and file writes.
   • Cauth.log for account creation, auditd for the authorized_keys modification, and journald for any related process execution.
   • DOnly auth.log for both events, since account creation and SSH key changes are both authentication-related.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An incident responder is building a timeline from multiple log sources. Which of the following is the MOST effective way to identify anomalies in the timeline?

   • ASort events by hostname and then by timestamp
   • BLook for gaps in the timeline where no events were logged
   • CIgnore events that occur during business hours
   • DFocus only on events with root user ID
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A server's /var/log/messages file has been rotated and compressed. The incident responder needs to search for a specific error string across all rotated logs. Which command will search the compressed logs without decompressing them to disk?

   • Agrep 'error' /var/log/messages.*.gz
   • Bzgrep 'error' /var/log/messages.*.gz
   • Cjournalctl --file /var/log/messages.*.gz | grep 'error'
   • Dzcat /var/log/messages.*.gz | grep 'error'
   Reveal Solution Discussion Select an answer first