During an incident response engagement, you discover that an attacker modified a critical configuration file in /etc. The system uses ext4 with default mount options. You need to determine the earliest possible time the file was tampered with. Which timestamp should you examine first?

The modification time (mtime) of the file

The access time (atime) of the file

The change time (ctime) of the file

The deletion time from the ext4 journal

You are analyzing a system where the /var directory is mounted on a separate partition. You need to determine if the attacker could have hidden data in the /var partition. Which characteristic of /var makes it a common hiding place?

It is a separate partition with potentially large amounts of free space

It is often world-writable, allowing any user to create files

It contains log files that are frequently written to, which can mask malicious activity

It is mounted with the noexec option, preventing execution of malicious binaries

You are investigating a system that uses systemd. You need to find the logs from the time of the incident, which occurred two days ago. Which command would you use to access the relevant logs?

journalctl --since '2 days ago'

grep '2 days ago' /var/log/syslog

GIAC Linux Incident Responder

Domain 1Objective 4

Linux File System Artifacts GLIR Practice Questions (Page 3)

Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

6concepts

Questions 11–15

11application · easy
An attacker gained access to a system and ran several commands. You need to determine if the attacker used sudo to gain root privileges. Which log file would provide this information?
Select an answer first
12application · medium
During an incident response engagement, you discover that an attacker modified a critical configuration file in /etc. The system uses ext4 with default mount options. You need to determine the earliest possible time the file was tampered with. Which timestamp should you examine first?
Select an answer first
13expert · hard
You are analyzing a system where the /var directory is mounted on a separate partition. You need to determine if the attacker could have hidden data in the /var partition. Which characteristic of /var makes it a common hiding place?
Select an answer first
14application · easy
You are investigating a system that uses systemd. You need to find the logs from the time of the incident, which occurred two days ago. Which command would you use to access the relevant logs?
Select an answer first
15foundation · easy
Which command would you use to display a list of currently mounted file systems and their mount points?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux File System Artifacts GLIR Practice Questions (Page 3)

Questions 11–15

An attacker gained access to a system and ran several commands. You need to determine if the attacker used sudo to gain root privileges. Which log file would provide this information?

During an incident response engagement, you discover that an attacker modified a critical configuration file in /etc. The system uses ext4 with default mount options. You need to determine the earliest possible time the file was tampered with. Which timestamp should you examine first?

You are analyzing a system where the /var directory is mounted on a separate partition. You need to determine if the attacker could have hidden data in the /var partition. Which characteristic of /var makes it a common hiding place?

You are investigating a system that uses systemd. You need to find the logs from the time of the incident, which occurred two days ago. Which command would you use to access the relevant logs?

Which command would you use to display a list of currently mounted file systems and their mount points?

Keep studying — Linux Fundamentals and File System Analysis