GIAC Linux Incident Responder
Domain 2Objective 2
Analyzing Linux Events GLIR Practice Questions (Page 7)
Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)
36questions here
8free pages
9concepts
Questions 31–35
- 31
Which command is used to query logs stored by journald?
Select an answer first - 32
A Linux server is experiencing unusual network connections. You need to determine which process initiated a connection to an external IP address. Which log source would provide the most direct evidence of the process-to-connection mapping?
Select an answer first - 33
How does syslog typically store log messages?
Select an answer first - 34
Which directory is the standard location for most Linux system log files?
Select an answer first - 35
Which of the following is a primary source of event data in a modern Linux system that captures structured, indexed logs with metadata such as priority and source?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.