You need to extract all SSH authentication failures from the last 24 hours from journald on a system that uses UTC. The system's local timezone is Asia/Tokyo. Which command will correctly filter the logs?

journalctl --since '2024-01-01 00:00:00' -u sshd | grep 'Failed password'

journalctl --since '24 hours ago' -u sshd | grep 'Failed password'

grep 'Failed password' /var/log/auth.log

ausearch -m USER_AUTH | grep 'Failed password'

What is the purpose of log rotation in Linux?

To encrypt log files for security

To change the format of log entries

To prevent log files from growing indefinitely by archiving and compressing old logs

To forward logs to a remote server

You are responding to an incident on a Linux server. The server uses both rsyslog (forwarding to a central log server) and auditd. The central log server receives syslog messages with timestamps in UTC, but the local server's auditd logs are in local time (UTC+5). You notice that the syslog and auditd timestamps for the same event differ by 5 hours. You need to reconstruct the exact timeline of the attack. What is the most appropriate action?

Use the auditd timestamps as the authoritative source because they are local.

Convert all timestamps to a single timezone (e.g., UTC) before building the timeline.

Adjust the syslog timestamps by subtracting 5 hours to match auditd.

Use the syslog timestamps as the authoritative source and ignore auditd timestamps.

What is the primary purpose of the Linux audit framework (auditd)?

To forward logs to a remote syslog server

To rotate and compress system log files

To provide detailed logging of security-relevant events such as system calls and file accesses

To manage user authentication and passwords

GIAC Linux Incident Responder

Domain 2Objective 2

Analyzing Linux Events GLIR Practice Questions (Page 5)

Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 21–25

21application · medium
You need to extract all SSH authentication failures from the last 24 hours from journald on a system that uses UTC. The system's local timezone is Asia/Tokyo. Which command will correctly filter the logs?
Select an answer first
22foundation · easy
What is the purpose of log rotation in Linux?
Select an answer first
23expert · hard
You are responding to an incident on a Linux server. The server uses both rsyslog (forwarding to a central log server) and auditd. The central log server receives syslog messages with timestamps in UTC, but the local server's auditd logs are in local time (UTC+5). You notice that the syslog and auditd timestamps for the same event differ by 5 hours. You need to reconstruct the exact timeline of the attack. What is the most appropriate action?
Select an answer first
24foundation · easy
What is the primary purpose of the Linux audit framework (auditd)?
Select an answer first
25foundation · easy
Which command-line tool is commonly used to search for patterns in text-based log files?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Analyzing Linux Events GLIR Practice Questions (Page 5)

Questions 21–25

You need to extract all SSH authentication failures from the last 24 hours from journald on a system that uses UTC. The system's local timezone is Asia/Tokyo. Which command will correctly filter the logs?

What is the purpose of log rotation in Linux?

What is the primary purpose of the Linux audit framework (auditd)?

Which command-line tool is commonly used to search for patterns in text-based log files?

Keep studying — Event Log Analysis and Timeline Analysis