Analyzing Linux Events GLIR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   You are investigating a potential data exfiltration. You have auditd logs showing a process reading /etc/shadow, and syslog showing a successful SSH login from an external IP at the same time. What does this correlation suggest?

   • AThe process reading /etc/shadow is a normal system process.
   • BThe events are unrelated because they come from different log sources.
   • CThe SSH login may be the initial access, and the process reading /etc/shadow could be an attempt to harvest credentials.
   • DThe SSH login is a false positive because the IP is external.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common Linux event type related to user authentication?

   • AFailed password for user root
   • BFile system full
   • CNetwork interface up
   • DKernel panic
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   You are reviewing logs from a Linux host and see the following journald entry: 'sshd[1234]: Failed password for invalid user admin from 192.168.1.100 port 54321 ssh2'. What type of event does this represent?

   • AA process execution event.
   • BA file access event.
   • CA network connection event.
   • DAn authentication failure event.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Linux server was compromised, and the incident responder needs to find evidence of an attacker's initial access. The system uses rsyslog for forwarding logs to a central collector, but the local /var/log/auth.log file is empty. Which of the following is the most likely reason the local auth.log is empty, and where should the responder look for the authentication events?

   • Ajournald is the only logging service running; check the journal with journalctl -u auth
   • BThe audit daemon captured the events instead; check /var/log/audit/audit.log
   • Crsyslog is configured to forward auth messages to a remote collector and not write them locally; check the central collector's logs
   • DThe log file was rotated and compressed; check /var/log/auth.log.1.gz
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   You are investigating a breach where an attacker used a legitimate user's credentials to log in and then ran a series of commands. You have auditd logs, but the default auditd configuration was in place. You need to determine which commands were executed. What is the most likely limitation you will face?

   • AThe auditd logs do not include user information.
   • BThe auditd logs are overwritten every hour.
   • CThe default auditd rules may not log execve syscalls, so you may not have a record of the commands.
   • DThe auditd logs are stored in binary format and cannot be read.
   Reveal Solution Discussion Select an answer first