GIAC Linux Incident Responder
Domain 1Objective 1
Linux OS Fundamentals GLIR Practice Questions (Page 11)
Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)
62questions here
13free pages
18concepts
Questions 51–55
- 51
An incident responder is investigating a server where an attacker is suspected of hiding malicious scripts. The responder needs to find files that were recently modified and are located in a directory that typically contains transient system runtime data, not persistent configuration or user files. Which directory should the responder prioritize for examination?
Select an answer first - 52
A user reports that a custom command-line tool works when run manually but fails when run from a cron job. The tool relies on an environment variable that is set in the user's .bashrc. What is the most likely cause?
Select an answer first - 53
Which file type is represented by the first character 'l' in an 'ls -l' listing?
Select an answer first - 54
Which command sends a SIGTERM signal to a process with PID 1234?
Select an answer first - 55
In systemd, what is the equivalent of a SysVinit runlevel?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.