GIAC GLIR: GIAC Linux Incident Responder

Last checked October 22, 2026 against the official GIAC exam page.

1. Question 1Linux application events

   A web server access log shows repeated POST requests to /admin/upload from one external address at 03:00, each returning HTTP 200, after the address had earlier been seen only on GET requests to public pages. Which conclusion is best supported?

   1. AThe status codes prove the uploads failed, as the server rejected each file
   2. BThe address is a healthy crawler indexing the public web site on a regular basis
   3. CThe requests are normal caching behavior by the web server for cache hits
   4. DThe address may be exploiting or abusing the upload function and should be investigated
   Show answer and explanationHide answer

   Correct answer: D

   A change in behavior toward an administrative upload endpoint at an unusual hour is a strong indicator of abuse. HTTP 200 means the server accepted the request, so the uploads may have succeeded.

2. Question 2Linux events

   Which two sources record authentication attempts on a systemd-based host that an analyst should review? (Choose two.)

   1. Ajournalctl entries from the sshd unit that record login successes and failures
   2. BThe authentication log at /var/log/auth.log on Debian-based systems
   3. CThe hosts file at /etc/hosts
   4. DThe apt cache under /var/cache/apt
   Show answer and explanationHide answer

   Correct answer: A, B

   sshd writes authentication events to the journal, and Debian-based systems also write them to auth.log. The hosts file and apt cache contain no authentication records.

3. Question 3Memory and device profiling

   Which tool is commonly used to acquire a Linux physical memory image through a loadable kernel module?

   1. Ass
   2. BLiME
   3. Clogrotate
   4. DThe Sleuth Kit fls utility
   Show answer and explanationHide answer

   Correct answer: B

   LiME, the Linux Memory Extractor, loads as a kernel module and writes physical memory to a file. The Sleuth Kit analyzes disk file systems, and ss and logrotate do not capture memory.

4. Question 4File system artifacts

   A cron-based persistence mechanism is suspected on a Linux host. Which locations should be reviewed first for system-wide scheduled tasks?

   1. A/etc/crontab and /etc/cron.d
   2. B/proc/cpuinfo or /proc/stat
   3. C/var/log/lastlog and /var/log/wtmp
   4. D/usr/share/doc/cron/THANKS
   Show answer and explanationHide answer

   Correct answer: A

   System cron jobs are defined in /etc/crontab and drop-in files under /etc/cron.d, while per-user jobs live in spool directories. Documentation, login records, and CPU data do not define scheduled execution.

5. Question 5OS fundamentals

   An analyst needs to list only the lines in /var/log/auth.log that begin with the text Failed password. Which command does this?

   1. Afind /var/log -name auth.log -exec cat {} +
   2. Bgrep 'Failed password$' /var/log/auth.log -v
   3. Cgrep '^Failed password' /var/log/auth.log
   4. Dsed -n '/Failed/p' /etc/passwd
   Show answer and explanationHide answer

   Correct answer: C

   The caret anchors the pattern to the start of each line, so grep returns only lines beginning with Failed password. The second command inverts the match, the third searches file names rather than contents, and the fourth reads the wrong file.