A shared directory /srv/data is used by two teams: 'dev' and 'ops'. The directory is owned by root:dev with permissions 2770. The 'ops' group needs read-only access to the directory and its contents, but should not be able to modify or delete files. The administrator wants to grant this access without changing the ownership of existing files. Which approach satisfies the requirement?

Set the setgid bit on /srv/data and add ops to the dev group.

Create a new group 'devops' and add both teams to it, then set the directory group to devops.

Add the ops group to the directory's ACL with read and execute permissions, and set default ACLs for new files.

Change the group ownership of /srv/data to 'ops' and set permissions to 2750.

A system administrator is investigating a possible brute-force SSH attack. Which command sequence will show the most recent failed login attempts with timestamps and source IP addresses?

journalctl -u sshd --since today | grep 'Failed password'

last -f /var/log/wtmp | head -20

cat /var/log/auth.log | grep 'Accepted password'

GIAC Security Essentials

Domain 4Objective 3

Linux Fundamentals GSEC Practice Questions (Page 8)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 36–40

36expert · hard
A shared directory /srv/data is used by two teams: 'dev' and 'ops'. The directory is owned by root:dev with permissions 2770. The 'ops' group needs read-only access to the directory and its contents, but should not be able to modify or delete files. The administrator wants to grant this access without changing the ownership of existing files. Which approach satisfies the requirement?
Select an answer first
37foundation · easy
A system administrator needs to store temporary files that should be accessible to all users but are not expected to survive a reboot. Which directory is most appropriate?
Select an answer first
38application · medium
A Linux administrator needs to find out which process is listening on TCP port 8080. Which command displays the PID and name of the process?
Select an answer first
39application · medium
A system administrator is investigating a possible brute-force SSH attack. Which command sequence will show the most recent failed login attempts with timestamps and source IP addresses?
Select an answer first
40application · medium
A system is experiencing performance issues. The administrator suspects a process is consuming excessive memory. Which command will show a real-time, sorted view of processes by memory usage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Linux Fundamentals GSEC Practice Questions (Page 8)

Questions 36–40

A system administrator needs to store temporary files that should be accessible to all users but are not expected to survive a reboot. Which directory is most appropriate?

A Linux administrator needs to find out which process is listening on TCP port 8080. Which command displays the PID and name of the process?

A system administrator is investigating a possible brute-force SSH attack. Which command sequence will show the most recent failed login attempts with timestamps and source IP addresses?

A system is experiencing performance issues. The administrator suspects a process is consuming excessive memory. Which command will show a real-time, sorted view of processes by memory usage?

Keep studying — Endpoint and Platform Security