
GIAC Linux Incident Responder
Domain 1Objective 2
Linux OS File System Structure GLIR Practice Questions (Page 2)
Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)
43questions here
9free pages
8concepts
Questions 6–10
- 6
A web server needs to read files in /var/www/html, but the files are owned by root:root with permissions 750. The web server runs as user 'www-data'. Which command would allow the web server to read the files without changing ownership?
Select an answer first - 7
How does an inode link to the data blocks of a file?
Select an answer first - 8
Which command would you use to find all files with the '.log' extension under the /var/log directory?
Select an answer first - 9
During an investigation, you notice that a file's modification time (mtime) is older than its change time (ctime). What does this indicate?
Select an answer first - 10
A service account needs to write to a log file owned by root:adm with permissions 644. The service runs as user 'svc_log'. Which command would allow the service to append to the log without changing the owner?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.