During a memory forensics investigation of a Linux host, you find a suspicious process that is not visible in the process list but is present in the memory dump. Which tool and technique would best help you analyze this hidden process?

Use 'lsof' on the live system to list open files for the suspicious PID

Use 'grep' to search the memory dump for the process name

Use 'ps aux' on the live system to compare with the memory dump

Use Volatility with the linux_pslist plugin to list processes from the memory dump

What is the primary purpose of a YARA rule?

To schedule automated system maintenance tasks

To configure firewall rules for network traffic filtering

To define patterns that identify malware or other indicators of compromise in files or memory

To manage user authentication and password policies

Your organization wants to integrate threat intelligence feeds into your Linux threat hunting process. You have a commercial feed with high-fidelity indicators and a free feed with lower fidelity but broader coverage. You need to minimize false positives while maximizing detection. Which approach would be best?

Use both feeds for automated alerts and manually review all alerts

Use only the free feed to maximize coverage

Use the commercial feed for automated alerts and the free feed for manual hunting

Use only the commercial feed to avoid false positives

Your organization wants to implement a proactive threat hunting program on Linux servers. You have a limited budget and need to start with the highest-impact data sources. Which combination of data sources would provide the best foundation for threat hunting?

Threat intelligence feeds and vulnerability scan results

Auditd logs, Sysmon for Linux logs, and bash history

Systemd journal and cron logs only

Firewall logs and DNS logs only

You are configuring Sysmon for Linux on a critical server. You want to detect file creation in /tmp that is followed by execution. Which Sysmon configuration approach is most effective?

Enable only ProcessAccess events

Enable only NetworkConnect events

Enable FileCreate and ProcessCreate events and correlate them

GIAC Linux Incident Responder

Domain 4Objective 2

Linux Threat Hunting and Incident Response GLIR Practice Questions (Page 9)

Part of the Advanced Analysis and Threat Hunting domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 41–45

41application · medium
During a memory forensics investigation of a Linux host, you find a suspicious process that is not visible in the process list but is present in the memory dump. Which tool and technique would best help you analyze this hidden process?
Select an answer first
42foundation · easy
What is the primary purpose of a YARA rule?
Select an answer first
43expert · hard
Your organization wants to integrate threat intelligence feeds into your Linux threat hunting process. You have a commercial feed with high-fidelity indicators and a free feed with lower fidelity but broader coverage. You need to minimize false positives while maximizing detection. Which approach would be best?
Select an answer first
44application · medium
Your organization wants to implement a proactive threat hunting program on Linux servers. You have a limited budget and need to start with the highest-impact data sources. Which combination of data sources would provide the best foundation for threat hunting?
Select an answer first
45application · medium
You are configuring Sysmon for Linux on a critical server. You want to detect file creation in /tmp that is followed by execution. Which Sysmon configuration approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.