
GIAC Linux Incident Responder
Domain 1Objective 1
Linux OS Fundamentals GLIR Practice Questions (Page 9)
Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)
62questions here
13free pages
18concepts
Questions 41–45
- 41
A developer reports that a custom script works when run manually from their shell but fails when executed via a cron job. The script relies on a custom environment variable that is set in the user's .bashrc. What is the most likely reason for the failure?
Select an answer first - 42
A security audit reveals that a shared directory has the setgid bit set, and new files created in it inherit the group ownership of the directory. The auditor wants to ensure that new files do NOT inherit the group, but the directory must remain writable by the group. Which command should be used?
Select an answer first - 43
A server is experiencing slow performance. The administrator runs 'free -h' and sees that the system is using a large amount of swap space. Which additional command would best help determine if memory pressure is the root cause?
Select an answer first - 44
Which component of the Linux boot process is responsible for initializing the hardware and loading the initial RAM disk?
Select an answer first - 45
A forensic analyst needs to preserve the exact state of a compromised system for evidence. The system uses systemd. The analyst wants to ensure that when the system is rebooted for imaging, it boots into a minimal environment that does not start the network or any user-facing services, but still allows local console login for the imaging process. Which single command should the analyst use to set the default boot state?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.