What is the primary purpose of an incident response playbook?

To automatically patch vulnerabilities in Linux systems

To replace the need for security analysts during an incident

To provide a standardized set of steps to follow when responding to a security incident

To encrypt all sensitive data on a compromised host

An incident responder is investigating a compromised Linux host. They find a systemd service that runs a script from /var/tmp/.cache every time the system boots. The script downloads and executes additional payloads. Which action should be taken FIRST to contain the threat while preserving evidence?

Capture the service file and the script, then disable the service

Reboot the system to clear the running service

Disable the systemd service and stop it

Delete the script from /var/tmp/.cache

Your organization receives a threat intelligence feed with a YARA rule that has a high false-positive rate on your Linux servers. You need to integrate the feed without overwhelming your analysts. Which approach is most effective?

Run the YARA rule on all files and manually review every match

Apply the YARA rule only to files in suspicious directories like /tmp and /var/tmp

Ignore the YARA rule and rely on hashes from the feed

Disable the YARA rule and only use the feed for network indicators

You are investigating a Linux host that was compromised. The attacker modified a system binary, added a new user, and created a systemd service. Which artifact would provide the most reliable evidence of the binary modification?

The file's SHA-256 hash compared to the package manager's database

The file's modification time from 'stat'

The file's owner and permissions

A threat intelligence feed provides a list of malicious file hashes and YARA rules. You want to integrate this into your Linux threat hunting process. Which approach is most effective?

Only use the hashes to block execution via file permissions

Manually check each file hash on critical servers

Use the YARA rules to scan files and memory across hosts, and use the hashes to verify matches

Add the hashes to a local DNS sinkhole

GIAC Linux Incident Responder

Domain 4Objective 2

Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 6)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 26–30

26foundation · easy
What is the primary purpose of an incident response playbook?
Select an answer first
27application · medium
An incident responder is investigating a compromised Linux host. They find a systemd service that runs a script from /var/tmp/.cache every time the system boots. The script downloads and executes additional payloads. Which action should be taken FIRST to contain the threat while preserving evidence?
Select an answer first
28expert · hard
Your organization receives a threat intelligence feed with a YARA rule that has a high false-positive rate on your Linux servers. You need to integrate the feed without overwhelming your analysts. Which approach is most effective?
Select an answer first
29application · medium
You are investigating a Linux host that was compromised. The attacker modified a system binary, added a new user, and created a systemd service. Which artifact would provide the most reliable evidence of the binary modification?
Select an answer first
30application · medium
A threat intelligence feed provides a list of malicious file hashes and YARA rules. You want to integrate this into your Linux threat hunting process. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.