During an incident response, an analyst needs to determine whether any user accounts were created or modified on a compromised Linux system. Which OS event log would contain this information?

auth.log (or secure.log on RHEL)

A security analyst is investigating a suspected insider threat on a Linux workstation. The analyst needs to determine whether the user ran commands with sudo and whether any cron jobs were modified. Which combination of OS event logs would provide this evidence?

dpkg.log for package changes and faillog for authentication failures

wtmp for session history and btmp for failed logins

auth.log for sudo entries and syslog for cron activity

dmesg for kernel messages and lastlog for user logins

A security team is comparing two Linux servers: one uses systemd-journald with volatile storage, and the other uses persistent journald storage. Both servers experience a sudden power loss. Which server is more likely to have retained OS event logs for forensic analysis?

The server with volatile journald storage

Both servers retain logs equally

Neither server retains logs after power loss

The server with persistent journald storage

A Linux system administrator is reviewing the contents of /var/log/auth.log to understand what events are captured. Which type of event would an analyst expect to find in this specific log file?

User authentication attempts, including successful and failed logins

Kernel boot messages and hardware driver errors

Systemd service start and stop notifications

Web server access requests and HTTP status codes

A Linux administrator needs to ensure that OS event logs are available for incident response even if an attacker gains root access and deletes log files. Which approach would best preserve the logs for later analysis?

Increase the log rotation frequency to daily

Configure remote log forwarding to a centralized log server

Store logs in a world-writable directory

GIAC Linux Incident Responder

Domain 2Objective 1

Linux OS Event Log Introduction GLIR Practice Questions (Page 4)

Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

1concept

Questions 16–20

16application · medium
During an incident response, an analyst needs to determine whether any user accounts were created or modified on a compromised Linux system. Which OS event log would contain this information?
Select an answer first
17application · medium
A security analyst is investigating a suspected insider threat on a Linux workstation. The analyst needs to determine whether the user ran commands with sudo and whether any cron jobs were modified. Which combination of OS event logs would provide this evidence?
Select an answer first
18expert · medium
A security team is comparing two Linux servers: one uses systemd-journald with volatile storage, and the other uses persistent journald storage. Both servers experience a sudden power loss. Which server is more likely to have retained OS event logs for forensic analysis?
Select an answer first
19foundation · easy
A Linux system administrator is reviewing the contents of /var/log/auth.log to understand what events are captured. Which type of event would an analyst expect to find in this specific log file?
Select an answer first
20application · medium
A Linux administrator needs to ensure that OS event logs are available for incident response even if an attacker gains root access and deletes log files. Which approach would best preserve the logs for later analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.