A responder is preserving evidence from a Linux server. Which technique is most appropriate for creating a forensic image of the disk?

Use `rsync` to synchronize the disk to another server.

Use `tar` to archive the filesystem.

Use `cp -a` to copy all files to a backup location.

Use `dd` to copy the entire disk to an external drive.

A company has two incidents: one involves a low-impact malware infection on a single workstation, and the other involves a suspected ransomware attack on a file server containing critical business data. Which incident should be prioritized?

The workstation malware, because it is easier to contain.

The file server ransomware, because of its higher impact and criticality.

Both equally, because all incidents require the same response.

The workstation malware, because it was detected first.

During an incident response, you need to preserve evidence from a compromised Linux server. The server is still running, and you need to capture volatile data and create a forensic image of the disk. You have a write-blocker and an external forensic drive. What is the correct sequence of actions?

Power off the server immediately to preserve the disk, then image it

Capture memory first, then create a disk image using a write-blocker

Run a live analysis tool to collect evidence, then image the disk

Create a disk image first, then capture memory

What is the goal of performing an initial assessment of a security incident?

To immediately patch all vulnerable systems

To determine the scope, impact, and urgency of the incident

To identify the attacker's identity

To delete all malicious files from the system

During a Linux incident, you have taken several actions: captured memory, imaged the disk, and isolated the server from the network. You are now documenting the triage. What is the MOST important aspect of your documentation?

Describing the server's hardware specifications

Recording the exact timestamps of each action and the person who performed it

Listing the software installed on the server

Including the IP addresses of all network devices

GIAC Linux Incident Responder

Domain 3Objective 1

Incident Response Triage GLIR Practice Questions (Page 1)

Part of the Incident Response and Evidence Handling domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 1–5

1application · medium
A responder is preserving evidence from a Linux server. Which technique is most appropriate for creating a forensic image of the disk?
Select an answer first
2application · medium
A company has two incidents: one involves a low-impact malware infection on a single workstation, and the other involves a suspected ransomware attack on a file server containing critical business data. Which incident should be prioritized?
Select an answer first
3application · medium
During an incident response, you need to preserve evidence from a compromised Linux server. The server is still running, and you need to capture volatile data and create a forensic image of the disk. You have a write-blocker and an external forensic drive. What is the correct sequence of actions?
Select an answer first
4foundation · easy
What is the goal of performing an initial assessment of a security incident?
Select an answer first
5application · medium
During a Linux incident, you have taken several actions: captured memory, imaged the disk, and isolated the server from the network. You are now documenting the triage. What is the MOST important aspect of your documentation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.