An incident responder is analyzing a Linux system where the attacker gained root access and attempted to cover their tracks. The responder finds that /var/log/auth.log has been truncated, but the system has a remote syslog server configured. What is the most reliable way to obtain the authentication logs?

Retrieve the logs from the remote syslog server

Recover the deleted data from disk

An incident responder is analyzing a compromised Linux system. The attacker has cleared /var/log/auth.log and /var/log/wtmp. However, the system has auditd running with a comprehensive rule set. Which source would still provide evidence of user authentication attempts?

The auditd logs in /var/log/audit/audit.log

An incident responder is analyzing a compromised Linux server that runs both SSH and a web application. The responder needs to determine whether the attacker used stolen SSH credentials or exploited the web application. Which log analysis approach would best distinguish between these two attack vectors?

Check the system's current running processes

Examine only the web server error log

Correlate timestamps in auth.log with web server access logs

Review only the SSH daemon configuration file

GIAC Linux Incident Responder

Domain 2Objective 1

Linux OS Event Log Introduction GLIR Practice Questions (Page 5)

Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

1concept

Questions 21–25

21application · medium
An analyst notices that /var/log/auth.log is missing on a Debian system. Which service is responsible for writing to this file?
Select an answer first
22application · medium
A security team wants to centralize Linux event logs to a remote SIEM for analysis. Which protocol is commonly used to forward syslog messages securely?
Select an answer first
23expert · hard
An incident responder is analyzing a Linux system where the attacker gained root access and attempted to cover their tracks. The responder finds that /var/log/auth.log has been truncated, but the system has a remote syslog server configured. What is the most reliable way to obtain the authentication logs?
Select an answer first
24expert · hard
An incident responder is analyzing a compromised Linux system. The attacker has cleared /var/log/auth.log and /var/log/wtmp. However, the system has auditd running with a comprehensive rule set. Which source would still provide evidence of user authentication attempts?
Select an answer first
25expert · hard
An incident responder is analyzing a compromised Linux server that runs both SSH and a web application. The responder needs to determine whether the attacker used stolen SSH credentials or exploited the web application. Which log analysis approach would best distinguish between these two attack vectors?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux OS Event Log Introduction GLIR Practice Questions (Page 5)

Questions 21–25

An analyst notices that /var/log/auth.log is missing on a Debian system. Which service is responsible for writing to this file?

A security team wants to centralize Linux event logs to a remote SIEM for analysis. Which protocol is commonly used to forward syslog messages securely?

An incident responder is analyzing a compromised Linux system. The attacker has cleared /var/log/auth.log and /var/log/wtmp. However, the system has auditd running with a comprehensive rule set. Which source would still provide evidence of user authentication attempts?

Keep studying — Event Log Analysis and Timeline Analysis