You are investigating a system where the /home partition is encrypted with LUKS. The system was rebooted after the incident, and the partition is now mounted. You need to determine if any user files were accessed during the incident. Which factor most limits your ability to analyze file access?

The atime may not be updated due to the relatime mount option

The LUKS header may not contain timestamps

The system reboot may have changed the encryption key, making the partition unreadable

The encryption prevents you from reading the filesystem metadata

You are investigating a system where the /var partition is almost full. You suspect that an attacker may have filled the disk to cause a denial of service. Which command would you use to identify the largest files in /var?

du -ah /var | sort -rh | head -20

GIAC Linux Incident Responder

Domain 1Objective 4

Linux File System Artifacts GLIR Practice Questions (Page 1)

Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

6concepts

Questions 1–5

1expert · hard
You are investigating a system where the /home partition is encrypted with LUKS. The system was rebooted after the incident, and the partition is now mounted. You need to determine if any user files were accessed during the incident. Which factor most limits your ability to analyze file access?
Select an answer first
2application · easy
You are investigating a system where the /var partition is almost full. You suspect that an attacker may have filled the disk to cause a denial of service. Which command would you use to identify the largest files in /var?
Select an answer first
3foundation · easy
Which file in a user's home directory typically contains the command history for the Bash shell?
Select an answer first
4application · easy
A Linux server was compromised, and the attacker used the local account 'webadmin' to perform actions. You need to quickly identify which commands the attacker executed during their session. Which file should you examine first?
Select an answer first
5application · medium
An attacker deleted a file that was open by a running process. You need to recover the content of that file. Which command would you use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux File System Artifacts GLIR Practice Questions (Page 1)

Questions 1–5

You are investigating a system where the /home partition is encrypted with LUKS. The system was rebooted after the incident, and the partition is now mounted. You need to determine if any user files were accessed during the incident. Which factor most limits your ability to analyze file access?

You are investigating a system where the /var partition is almost full. You suspect that an attacker may have filled the disk to cause a denial of service. Which command would you use to identify the largest files in /var?

Which file in a user's home directory typically contains the command history for the Bash shell?

A Linux server was compromised, and the attacker used the local account 'webadmin' to perform actions. You need to quickly identify which commands the attacker executed during their session. Which file should you examine first?

An attacker deleted a file that was open by a running process. You need to recover the content of that file. Which command would you use?

Keep studying — Linux Fundamentals and File System Analysis