Linux OS Event Log Introduction GLIR Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company runs a critical application on a Linux server. The security team wants to monitor for unauthorized file access attempts. They have auditd available. Which configuration would provide the most comprehensive monitoring with minimal performance impact?

   • AUse inotify to monitor the directory
   • BEnable auditd with default rules only
   • CSet up a cron job to hash the directory periodically
   • DUse auditctl to add a watch on the critical directory with -p rwxa
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A Linux administrator is configuring a new server and wants to ensure that all authentication events are logged to a remote SIEM in real time. Which configuration would achieve this?

   • AUse auditd to send events to the SIEM
   • BSet journald to forward to the SIEM via syslog
   • CCopy /var/log/auth.log to the SIEM using cron
   • DConfigure rsyslog to forward auth messages to the SIEM over TLS
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic analyst is investigating a Linux system where the attacker modified system time to evade detection. The analyst needs to establish the correct sequence of events. Which log source would be most resistant to time-manipulation and help reconstruct the true timeline?

   • AThe kernel ring buffer
   • BRemote syslog server logs with their own timestamps
   • CThe local auth.log file
   • DThe local systemd journal
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   An incident responder is examining a compromised Linux server and needs to identify all successful and failed SSH login attempts, including the source IP addresses. Which OS event log file would be the primary source for this information?

   • A/var/log/kern.log
   • B/var/log/auth.log
   • C/var/log/mail.log
   • D/var/log/dpkg.log
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is investigating a Linux server that was compromised. The attacker used a valid SSH key to log in. The analyst wants to determine if any other systems were accessed using the same key. Which log would provide the most useful information?

   • AThe systemd journal on the compromised system
   • BThe local auth.log only
   • CThe SSH daemon logs on all systems
   • DThe key's public key file metadata
   Reveal Solution Discussion Select an answer first