You are analyzing a compromised Linux host. You have collected the following data: journald logs, syslog files, and auditd records. You need to identify the first malicious action taken by the attacker. Which technique is most effective for this task?

Search each log source individually for keywords like 'malware' or 'attack'.

Focus only on auditd logs because they capture all system calls.

Look for the most recent event in the logs and work backwards.

Sort all events by timestamp across all sources and create a unified timeline.

A log entry in /var/log/syslog shows a timestamp of 'Feb 12 14:30:22' without a year. The system's timezone is UTC+2. You need to convert this to epoch time for correlation with other logs. What additional information do you need?

The current year, because syslog timestamps do not include the year.

The hostname, because different hosts may have different timezones.

The timezone offset, because you need to convert to UTC.

The exact second, because the timestamp only shows minutes.

An analyst is correlating events from multiple sources to reconstruct a timeline of a suspected intrusion. Which of the following is the MOST reliable approach to ensure accurate correlation?

Rely on the order of events as they appear in each log file

Use the local timezone of each source and sort by the original timestamp

Normalize all timestamps to UTC and sort by that value

Use only auditd records because they are the most accurate

You are building a timeline from multiple log sources. You notice that the system's clock was adjusted during the incident (e.g., via NTP or manual change). What is the most important consideration when correlating events?

You should only use auditd timestamps because they are in epoch.

You should ignore all timestamps and rely on the order of log entries.

You must account for the clock skew and adjust timestamps accordingly.

You should use the timestamps as-is because they are all from the same system.

GIAC Linux Incident Responder

Domain 2Objective 2

Analyzing Linux Events GLIR Practice Questions (Page 6)

Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 26–30

26foundation · easy
Which tool is used to search and query audit records generated by auditd?
Select an answer first
27application · medium
You are analyzing a compromised Linux host. You have collected the following data: journald logs, syslog files, and auditd records. You need to identify the first malicious action taken by the attacker. Which technique is most effective for this task?
Select an answer first
28application · medium
A log entry in /var/log/syslog shows a timestamp of 'Feb 12 14:30:22' without a year. The system's timezone is UTC+2. You need to convert this to epoch time for correlation with other logs. What additional information do you need?
Select an answer first
29application · medium
An analyst is correlating events from multiple sources to reconstruct a timeline of a suspected intrusion. Which of the following is the MOST reliable approach to ensure accurate correlation?
Select an answer first
30expert · hard
You are building a timeline from multiple log sources. You notice that the system's clock was adjusted during the incident (e.g., via NTP or manual change). What is the most important consideration when correlating events?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.