In a Linux environment, which activity best exemplifies a proactive threat hunting action?

Reviewing system logs after a malware alert is triggered by antivirus software

Installing a host-based intrusion detection system on all Linux servers

Restoring a compromised server from a backup after ransomware is detected

Searching for unusual SSH authentication patterns across multiple hosts before any alert is raised

During a threat hunt, you notice a process named 'kworker' running from /tmp/.hidden with high CPU usage. The process has no open files and its parent is PID 1. Which step is most appropriate to determine if this is malicious?

Check the process's command-line arguments in /proc/PID/cmdline

Kill the process immediately to stop potential damage

Capture a memory dump of the process and scan it with YARA rules

Run 'strings' on the binary in /tmp/.hidden

A threat intelligence feed provides a YARA rule for a Linux rootkit. You need to scan a memory dump from a potentially infected host. Which command would you use?

yara -m rootkit.yar memory.dump

A security team wants to implement proactive threat hunting on their Linux fleet. They have auditd configured on all servers and collect network flow logs. Which activity best exemplifies proactive threat hunting?

Waiting for the next vulnerability scan to identify missing patches

Reviewing auditd logs only after a security alert is triggered

Searching for unusual process executions and outbound connections that do not match known baselines

Configuring more alerts for known malware signatures

GIAC Linux Incident Responder

Domain 4Objective 2

Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 1)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 1–5

1foundation · easy
In a Linux environment, which activity best exemplifies a proactive threat hunting action?
Select an answer first
2application · medium
During a threat hunt, you notice a process named 'kworker' running from /tmp/.hidden with high CPU usage. The process has no open files and its parent is PID 1. Which step is most appropriate to determine if this is malicious?
Select an answer first
3application · medium
A threat intelligence feed provides a YARA rule for a Linux rootkit. You need to scan a memory dump from a potentially infected host. Which command would you use?
Select an answer first
4foundation · easy
Which Linux kernel subsystem does auditd use to collect system call and security event information?
Select an answer first
5application · medium
A security team wants to implement proactive threat hunting on their Linux fleet. They have auditd configured on all servers and collect network flow logs. Which activity best exemplifies proactive threat hunting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.