Analyzing Linux Events GLIR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key technique in timeline analysis for identifying anomalies?

   • ADeleting duplicate log entries
   • BSorting events chronologically and looking for unusual patterns or gaps
   • CChanging log file permissions
   • DEncrypting all log files
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of correlating events from multiple sources?

   • ACounting the number of lines in a single log file
   • BDeleting old log files to free disk space
   • CMatching a user login event in auth.log with a subsequent process execution in audit.log
   • DCompressing a log file with gzip
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary goal of event correlation in incident response?

   • ATo reduce the size of log files
   • BTo forward logs to a central server
   • CTo reconstruct a timeline of activities by linking related events from multiple sources
   • DTo encrypt log data at rest
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a common output format for a timeline in forensic analysis?

   • AEncrypted archive
   • BCSV with columns for timestamp, source, and event description
   • CA single-line text string
   • DBinary executable file
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You need to analyze a large volume of logs to find all file deletions that occurred on a Linux server during a specific time window. The server has auditd configured with a rule to watch /home. Which command will most efficiently extract the relevant audit records?

   • Aaureport -m | grep 'unlink'
   • Bgrep 'unlink' /var/log/audit/audit.log
   • Cjournalctl -u auditd | grep 'unlink'
   • Dausearch -k watch_home -ts 2024-01-01 00:00:00 -te 2024-01-02 00:00:00 | grep 'unlink'
   Reveal Solution Discussion Select an answer first