You are preserving evidence from a compromised Linux server. You have limited time because the server is about to be decommissioned. You need to capture the most critical evidence. Which of the following is the BEST approach?

Capture memory and create a disk image, prioritizing volatile data first

Create a disk image first, then capture memory if time permits

Run a live analysis tool to collect evidence, then create a disk image

Copy the most relevant log files to an external drive

You are preserving evidence from a compromised Linux server. You have created a forensic image of the disk and captured memory. What is the next step to maintain the chain of custody?

Record the hash values of the images and document who handled the evidence

Store the images on the same server to save space

Delete the original logs to prevent further compromise

Reboot the server to ensure the images are stable

Your team has received multiple alerts from a Linux-based infrastructure. You have limited staff and need to allocate resources effectively. Which approach best aligns with the goals of incident response triage?

Prioritize alerts based on the criticality of the affected system and the potential impact

Investigate alerts in the order they were received

Wait for more alerts to arrive before deciding which to investigate

Assign all available staff to the first alert and handle others later

During initial assessment, a responder finds that a compromised server is part of a cluster that also includes two other servers. What should the responder do to determine the full scope?

Wait for additional alerts before investigating other servers.

Focus only on the compromised server to avoid spreading resources.

Immediately rebuild all servers in the cluster.

Check the other servers in the cluster for similar indicators.

An incident responder is documenting triage actions for a suspected malware infection on a Linux server. Which documentation practice is most important for reproducibility?

Use informal notes that are understandable only to the original responder.

Record the exact commands run, timestamps, and the rationale for each action.

Summarize the incident in a high-level email to management.

Save only the final report, omitting intermediate findings.

GIAC Linux Incident Responder

Domain 3Objective 1

Incident Response Triage GLIR Practice Questions (Page 5)

Part of the Incident Response and Evidence Handling domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 21–25

21expert · hard
You are preserving evidence from a compromised Linux server. You have limited time because the server is about to be decommissioned. You need to capture the most critical evidence. Which of the following is the BEST approach?
Select an answer first
22application · medium
You are preserving evidence from a compromised Linux server. You have created a forensic image of the disk and captured memory. What is the next step to maintain the chain of custody?
Select an answer first
23application · medium
Your team has received multiple alerts from a Linux-based infrastructure. You have limited staff and need to allocate resources effectively. Which approach best aligns with the goals of incident response triage?
Select an answer first
24application · medium
During initial assessment, a responder finds that a compromised server is part of a cluster that also includes two other servers. What should the responder do to determine the full scope?
Select an answer first
25application · medium
An incident responder is documenting triage actions for a suspected malware infection on a Linux server. Which documentation practice is most important for reproducibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.