What is the goal of correlating events across artifacts in timeline analysis?

To verify the integrity of system binaries

To determine the total number of files on the system

To identify which user account has the most login attempts

To reconstruct the sequence of attacker activity by linking related events

A Linux server's timeline shows that a user account `svc_backup` logged in via SSH at 23:47, 00:12, and 01:05 over three consecutive nights. The account is a service account that normally runs automated backups at 02:00. There are no corresponding backup job executions in the process accounting logs during those times. What is the most likely conclusion?

The service account is being used for unauthorized interactive access.

The logins are normal because service accounts can log in at any time.

The backups are running but not logged due to a logging misconfiguration.

The timeline is incorrect because SSH logins for service accounts are not recorded.

What is the role of 'fls' in timeline analysis?

To search for strings in binary files

To parse system logs into a unified format

To capture network traffic for later analysis

To list files and directories in an image and output metadata to a body file

What is the primary purpose of timeline analysis in Linux incident response?

To identify the root cause of a system crash by analyzing kernel panic logs

To create a backup of critical system files before performing forensic imaging

To automate the removal of malicious files from a compromised system

To correlate events from multiple system artifacts into a chronological sequence for reconstructing attacker activity

You are analyzing a timeline and find that a file `/bin/ls` was modified at 02:00, and at 02:01 a process named `ls` executed. The system administrator says that no updates were scheduled. What is the most likely conclusion?

The timeline is incorrect because `ls` cannot modify itself.

The `ls` process is legitimate and the file modification was part of a routine system update.

The file modification and process execution are unrelated.

An attacker replaced `/bin/ls` with a malicious version to hide their activities.

GIAC Linux Incident Responder

Domain 2Objective 4

Linux Timeline Analysis GLIR Practice Questions (Page 7)

Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 31–35

31foundation · easy
What is the goal of correlating events across artifacts in timeline analysis?
Select an answer first
32application · medium
A Linux server's timeline shows that a user account `svc_backup` logged in via SSH at 23:47, 00:12, and 01:05 over three consecutive nights. The account is a service account that normally runs automated backups at 02:00. There are no corresponding backup job executions in the process accounting logs during those times. What is the most likely conclusion?
Select an answer first
33foundation · easy
What is the role of 'fls' in timeline analysis?
Select an answer first
34foundation · easy
What is the primary purpose of timeline analysis in Linux incident response?
Select an answer first
35expert · hard
You are analyzing a timeline and find that a file `/bin/ls` was modified at 02:00, and at 02:01 a process named `ls` executed. The system administrator says that no updates were scheduled. What is the most likely conclusion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.