GIAC Linux Incident Responder
Domain 1Objective 3
Linux File System Fundamentals and Analysis GLIR Practice Questions (Page 5)
Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)
38questions here
8free pages
6concepts
Questions 21–25
- 21
While examining a file listing, you see the first character of a file's mode is 'l'. What type of file does this indicate?
Select an answer first - 22
You are investigating a Linux system and need to find runtime variable data such as system logs and spool files. Which directory is designed to hold this type of data?
Select an answer first - 23
You are investigating a system where an attacker may have hidden data by mounting a file system over an existing directory. You notice that the directory /var/log has an unusually large amount of free space. You suspect a hidden mount. Which command would confirm this?
Select an answer first - 24
During a forensic examination, you need to determine whether a file was modified after the system was compromised. The file's modification time (mtime) appears to have been changed to an earlier date. Which metadata attribute would provide the most reliable evidence of when the inode itself was last changed?
Select an answer first - 25
Which of the following statements about symbolic links is true?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.