During incident response, you need to determine whether a service named 'authsvc' was running at the time of a reported compromise and what its recent activity has been. The system uses systemd. Which command sequence provides the most relevant information?

systemctl list-units --type=service and tail /var/log/syslog

ps aux | grep authsvc and cat /var/log/auth.log

systemctl status authsvc and journalctl -u authsvc --since '2024-01-01 00:00:00'

service authsvc status and grep authsvc /var/log/messages

GIAC Linux Incident Responder

Domain 1Objective 1

Linux OS Fundamentals GLIR Practice Questions (Page 8)

Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

18concepts

18 Concepts in This Objective

Linux Boot Process
Runlevels and Targets
Systemd Essentials
File System Hierarchy Standard (FHS)
File Types and Permissions
Special Permissions and Attributes
Hard Links and Symbolic Links
Mounting and Unmounting File Systems
Disk Usage and Inodes
Process Management
Environment Variables and Shell Configuration
Package Management
Logging and Journaling
System Monitoring and Performance
User and Group Management
Networking Fundamentals
Service and Socket Activation
System Initialization and Configuration Files

Questions 36–40

36foundation · easy
Which command is used to install a package using the apt package manager on Debian-based systems?
Select an answer first
37foundation · easy
Which special permission, when set on a file, allows a user to execute the file with the permissions of the file's owner?
Select an answer first
38application · medium
During incident response, you need to determine whether a service named 'authsvc' was running at the time of a reported compromise and what its recent activity has been. The system uses systemd. Which command sequence provides the most relevant information?
Select an answer first
39expert · hard
A server is reporting 'No space left on device' errors, but 'df -h' shows that the filesystem has plenty of free space. The administrator suspects inode exhaustion. Which command should be used to confirm this?
Select an answer first
40foundation · easy
Which command displays the routing table?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux OS Fundamentals GLIR Practice Questions (Page 8)

Questions 36–40

Which command is used to install a package using the apt package manager on Debian-based systems?

Which special permission, when set on a file, allows a user to execute the file with the permissions of the file's owner?

During incident response, you need to determine whether a service named 'authsvc' was running at the time of a reported compromise and what its recent activity has been. The system uses systemd. Which command sequence provides the most relevant information?

A server is reporting 'No space left on device' errors, but 'df -h' shows that the filesystem has plenty of free space. The administrator suspects inode exhaustion. Which command should be used to confirm this?

Which command displays the routing table?

Keep studying — Linux Fundamentals and File System Analysis