During a memory forensics investigation, you find a process that is using a deleted executable file. The process is running from memory, and the on-disk file is gone. You need to determine the full command line and the executable's content. Which approach would be most effective?

Check /proc/ /cmdline and /proc/ /exe on the live system

Run a YARA scan on the entire memory dump to find the executable's signature

Use 'lsof' to find the deleted file and recover it from the filesystem

Use Volatility to dump the process memory and then run 'strings' or YARA on the dump

A Linux server in a DMZ was compromised. During analysis, you find a new user account 'support' with UID 0, a modified /etc/ld.so.preload, and a cron job that fetches a script from a remote host every hour. Which combination of artifacts best supports the hypothesis of persistence and privilege escalation?

The cron job and the remote fetch alone

The modified /etc/ld.so.preload and the new user account

The new user account and the remote fetch script

The UID 0 account, the modified /etc/ld.so.preload, and the cron job

Which of the following is a common indicator of malicious network communication that a threat hunter might look for in packet captures?

Large amounts of HTTPS traffic to a popular website

Traffic to a known command-and-control server IP address

Regular NTP time synchronization packets

Frequent DNS queries to a legitimate public DNS server

A threat hunter is analyzing network captures from a Linux server. They see DNS queries to a domain that is on a threat intelligence blocklist, but the IP resolved is a legitimate cloud provider. The server also has an SSH connection to an internal host. What is the most likely explanation?

The DNS query is a false positive because the IP is legitimate

The server is using DNS over HTTPS to hide the query

The server is communicating with a command-and-control server that uses domain fronting

The server is performing a legitimate DNS lookup for a cloud service

Your threat hunting team wants to integrate a free threat intelligence feed of known malicious IP addresses into your Linux auditd monitoring. The goal is to generate an alert when any process on your Linux hosts initiates a connection to one of these IPs. Which approach would best achieve this?

Add a firewall rule to block all traffic to the malicious IPs

Create a cron job that runs 'ss' every minute and greps for the malicious IPs

Use Sysmon for Linux to log network connections and then manually check each connection against the feed

Use auditd to log all outbound connections and then correlate the logs with the threat intelligence feed using a SIEM

GIAC Linux Incident Responder

Domain 4Objective 2

Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 8)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 36–40

36expert · hard
During a memory forensics investigation, you find a process that is using a deleted executable file. The process is running from memory, and the on-disk file is gone. You need to determine the full command line and the executable's content. Which approach would be most effective?
Select an answer first
37application · medium
A Linux server in a DMZ was compromised. During analysis, you find a new user account 'support' with UID 0, a modified /etc/ld.so.preload, and a cron job that fetches a script from a remote host every hour. Which combination of artifacts best supports the hypothesis of persistence and privilege escalation?
Select an answer first
38foundation · easy
Which of the following is a common indicator of malicious network communication that a threat hunter might look for in packet captures?
Select an answer first
39expert · hard
A threat hunter is analyzing network captures from a Linux server. They see DNS queries to a domain that is on a threat intelligence blocklist, but the IP resolved is a legitimate cloud provider. The server also has an SSH connection to an internal host. What is the most likely explanation?
Select an answer first
40application · medium
Your threat hunting team wants to integrate a free threat intelligence feed of known malicious IP addresses into your Linux auditd monitoring. The goal is to generate an alert when any process on your Linux hosts initiates a connection to one of these IPs. Which approach would best achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.