In a super timeline, you notice a series of file modifications in `/tmp` and `/dev/shm` around 03:00 local time, but the server's normal maintenance window is 02:00–02:30. You also see a process named `kworker` running at 03:05, but the system's kernel worker threads are normally named `kworker/0:1` or similar. What should you do next to investigate?

Filter the timeline to show only events between 03:00 and 03:10 and focus on the `kworker` process and file paths.

Rebuild the timeline using only the filesystem source to confirm the file modifications.

Search the timeline for all processes named `kworker` to see if any are legitimate.

Ignore the events because `/tmp` and `/dev/shm` are often used for temporary files.

A timeline shows that at 10:15:22 a file `/etc/cron.d/backup` was modified. At 10:15:25, the cron daemon reloaded. At 10:16:00, a process named `backup.sh` executed. What is the most likely interpretation?

An attacker modified the cron file to execute a malicious script.

The script execution caused the cron file modification.

The cron file modification was legitimate and the script ran as scheduled.

The attacker modified the cron file, which caused the cron daemon to reload and execute the script.

In a timeline, you see that a user 'alice' logged in via SSH at 09:00, then at 09:05 a file /home/alice/.bashrc was modified, and at 09:10 a connection was made to an external IP on port 4444. What is the most likely interpretation?

The timeline is showing unrelated events that happen to be close in time.

Alice is setting up a legitimate remote development environment.

An attacker gained access to Alice's account and established persistence and a reverse shell.

The system is performing routine maintenance.

You have built a super timeline that includes millions of events. You need to focus on a suspected intrusion window between 2023-03-15 22:00 and 23:30 UTC, and you also want to exclude events from the 'cron' user and the 'systemd' process. Which approach is most efficient?

Use grep to search the raw timeline for '2023-03-15' and then manually remove cron/systemd entries.

Use mactime to generate a new timeline that only includes the specified time range and excludes cron/systemd.

Apply a time-range filter and then filter out events where the user is 'cron' or the process is 'systemd' using the timeline tool's filtering capabilities.

Rebuild the timeline from scratch, only including logs from that time window and ignoring all other artifacts.

GIAC Linux Incident Responder

Domain 2Objective 4

Linux Timeline Analysis GLIR Practice Questions (Page 2)

Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 6–10

6foundation · easy
Which tool is commonly used to generate a timeline from filesystem metadata in Linux?
Select an answer first
7application · medium
In a super timeline, you notice a series of file modifications in `/tmp` and `/dev/shm` around 03:00 local time, but the server's normal maintenance window is 02:00–02:30. You also see a process named `kworker` running at 03:05, but the system's kernel worker threads are normally named `kworker/0:1` or similar. What should you do next to investigate?
Select an answer first
8application · medium
A timeline shows that at 10:15:22 a file `/etc/cron.d/backup` was modified. At 10:15:25, the cron daemon reloaded. At 10:16:00, a process named `backup.sh` executed. What is the most likely interpretation?
Select an answer first
9application · medium
In a timeline, you see that a user 'alice' logged in via SSH at 09:00, then at 09:05 a file /home/alice/.bashrc was modified, and at 09:10 a connection was made to an external IP on port 4444. What is the most likely interpretation?
Select an answer first
10application · medium
You have built a super timeline that includes millions of events. You need to focus on a suspected intrusion window between 2023-03-15 22:00 and 23:30 UTC, and you also want to exclude events from the 'cron' user and the 'systemd' process. Which approach is most efficient?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux Timeline Analysis GLIR Practice Questions (Page 2)

Questions 6–10

Which tool is commonly used to generate a timeline from filesystem metadata in Linux?

A timeline shows that at 10:15:22 a file `/etc/cron.d/backup` was modified. At 10:15:25, the cron daemon reloaded. At 10:16:00, a process named `backup.sh` executed. What is the most likely interpretation?

In a timeline, you see that a user 'alice' logged in via SSH at 09:00, then at 09:05 a file /home/alice/.bashrc was modified, and at 09:10 a connection was made to an external IP on port 4444. What is the most likely interpretation?

You have built a super timeline that includes millions of events. You need to focus on a suspected intrusion window between 2023-03-15 22:00 and 23:30 UTC, and you also want to exclude events from the 'cron' user and the 'systemd' process. Which approach is most efficient?

Keep studying — Event Log Analysis and Timeline Analysis