Linux OS Event Log Introduction GLIR Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During a forensic examination, an analyst notices that the /var/log/auth.log file is empty even though the system has been running for months. The analyst suspects log tampering. Which additional OS event log source could provide corroborating evidence of user logins and system reboots?

   • AThe systemd journal (journalctl)
   • BThe kernel ring buffer (dmesg)
   • CThe cron log (cron.log)
   • DThe package manager log (dpkg.log)
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During an incident, you need to find all log entries related to a specific user 'alice' across multiple log files. Which command would be most efficient for this search?

   • Agrep -r 'alice' /var/log/
   • Bjournalctl | grep alice
   • Ccat /var/log/auth.log | grep alice
   • Dfind /var/log -name '*alice*'
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An incident responder is examining a compromised server and wants to see a chronological list of all user logins, including reboots and shutdowns. Which command provides this information?

   • Ajournalctl -u ssh
   • Blast
   • Cgrep 'session opened' /var/log/auth.log
   • Dausearch -m USER_LOGIN
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A Linux system uses both rsyslog and systemd-journald. The security team wants to ensure that authentication logs are preserved for at least one year for compliance, but the system has limited disk space. Which configuration approach would best meet the retention requirement while minimizing disk usage?

   • AIncrease journald's SystemMaxUse to 50% of the disk
   • BCompress auth.log with gzip and store it in /tmp
   • CDisable log rotation for auth.log
   • DForward auth.log entries to a remote log server and keep only a short local retention
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security analyst is investigating a Linux server that was compromised. The analyst finds that the attacker created a new user account and added it to the sudo group. Which set of OS event logs would provide the most complete evidence of these actions?

   • Aauth.log for useradd and usermod events, plus sudo logs for group membership changes
   • Bdpkg.log for user creation and mail.log for sudo group changes
   • Cwtmp for user creation and btmp for sudo group changes
   • Dkern.log for user creation and cron.log for sudo group changes
   Reveal Solution Discussion Select an answer first