During an incident, you suspect an attacker used SSH to move laterally from host A to host B. You have access to both hosts' logs. Which set of artifacts would provide the strongest evidence of this lateral movement?

Bash history on host A showing SSH commands to host B, and syslog on host B showing general system messages

Auth.log entries on host B showing successful SSH logins from host A's IP, and bash history on host B showing commands run after login

Network connection logs on host A showing outbound SSH connections to host B, and cron logs on host B

Auditd logs on host A recording execve of ssh, and lastlog on host B showing recent logins

Which phase of an incident response playbook typically involves identifying the scope of the compromise and collecting evidence?

Containment, Eradication, and Recovery

A security analyst is reviewing authentication logs on a Linux jump host. They see successful SSH logins from an internal IP 10.0.0.5 at 02:00, 02:15, and 02:30, each followed by a connection to a different internal server. The analyst also notices that the user's shell history is empty. What is the most likely explanation?

The user is performing routine administrative tasks across servers

A misconfigured cron job is causing the logins

An attacker is using the jump host to pivot to other servers

The log entries are false positives from a monitoring agent

GIAC Linux Incident Responder

Domain 4Objective 2

Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 4)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 16–20

16foundation · easy
Which type of threat intelligence indicator is most directly useful for scanning Linux files for known malware?
Select an answer first
17application · medium
During an incident, you suspect an attacker used SSH to move laterally from host A to host B. You have access to both hosts' logs. Which set of artifacts would provide the strongest evidence of this lateral movement?
Select an answer first
18foundation · easy
Which phase of an incident response playbook typically involves identifying the scope of the compromise and collecting evidence?
Select an answer first
19foundation · easy
Which YARA rule component is used to specify the conditions under which a rule matches a file?
Select an answer first
20application · medium
A security analyst is reviewing authentication logs on a Linux jump host. They see successful SSH logins from an internal IP 10.0.0.5 at 02:00, 02:15, and 02:30, each followed by a connection to a different internal server. The analyst also notices that the user's shell history is empty. What is the most likely explanation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 4)

Questions 16–20

Which type of threat intelligence indicator is most directly useful for scanning Linux files for known malware?

During an incident, you suspect an attacker used SSH to move laterally from host A to host B. You have access to both hosts' logs. Which set of artifacts would provide the strongest evidence of this lateral movement?

Which phase of an incident response playbook typically involves identifying the scope of the compromise and collecting evidence?

Which YARA rule component is used to specify the conditions under which a rule matches a file?

Keep studying — Advanced Analysis and Threat Hunting