GIAC GLIR Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Linux Incident Responder (GLIR) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GLIR certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GLIR Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Linux Incident Responder (GLIR) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Linux Incident Responder exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GLIR Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GLIR Sample Questions:
01. On a systemd-based container host at a SaaS start-up, a responder found an out-of-tree kernel module file, nfqmon.ko, and is now listing every on-disk setting that would bring it back after a reboot.
Which locations, if a file there names the module, cause systemd-modules-load to load it at every boot?
(Choose two.)
a) A .conf file in /etc/modules-load.d/ that lists nfqmon on a line of its own
b) An options line for nfqmon in a .conf file under /etc/modprobe.d/
c) An entry for nfqmon in /proc/modules
d) The nfqmon.ko module file itself, installed under the /lib/modules/ tree
e) A .conf file in /usr/lib/modules-load.d/ naming nfqmon
02. After an intrusion at a software company, eight Linux build servers have been imaged. Each image is loop-mounted read-only and noexec under /mnt/evid/ on an analysis workstation, one directory per server. The team wants the same UAC artifact collection from each image (logs, account files, persistence locations, shell histories and a bodyfile) that it ran during live triage.
How should the team run UAC against each image?
a) Run UAC with the ir_triage profile and the image's directory under /mnt/evid as its destination
b) Run log2timeline over each mounted image and filter its output by artifact
c) Chroot into the image's directory under /mnt/evid and launch UAC from inside it
d) Set UAC's mount-point option (-m) to the image's directory under /mnt/evid and give a case directory as the destination
03. During triage of a database server at a hospital, a responder's script ran this line in bash:
find / -perm -4000 -type f 2>&1 > /mnt/usb/suid.txt
The file lists the set-user-ID programs, but the Permission denied and No such file or directory messages appeared on the console instead of in suid.txt. Why did that happen?
a) Bash applied 2>&1 before > moved standard output, so standard error kept the terminal
b) find sends its error messages to the system journal, so no output stream carries them into the file
c) The > operator truncated suid.txt after find wrote the error lines
d) The -type f test removed error messages from the results
04. On a RHEL-family database server at a hospital, the responder reads /var/log/secure and finds this entry from the night of the alert.
Sep 14 02:18:40 db01 sudo[5521]: tmorgan : command not allowed ; TTY=pts/1 ; PWD=/home/tmorgan ; USER=root ; COMMAND=/usr/bin/tee -a /etc/sudoers.d/90-ops
What does this entry establish about tmorgan's request?
a) tmorgan mistyped the sudo password three times, so authentication failed and the command itself was never run
b) tmorgan is listed in sudoers for this host, but that command is not permitted to run
c) tmorgan is not listed in the sudoers policy at all, so no rule there granted the request
d) tmorgan is listed in sudoers but not for this host, so the policy refused it
05. At a media company, a hunt has confirmed the same systemd-service persistence on five Ubuntu servers, and the actor shows no destructive or data-transfer activity in progress. The team proposes cleaning one server a day, starting with the one found first.
Which course should the incident lead choose?
a) Finish scoping, then contain and eradicate on the five servers together in one coordinated window
b) Clean each server as soon as it is confirmed, starting with the first
c) Clean the most critical server first, then watch the other four and clean them after a week
d) Rebuild the first server and reset passwords on the other four
06. Before a Debian cloud VM at a media company was shut down and its disk imaged, the responder took an AVML memory capture. Live triage had listed a script at /dev/shm/.cache/run.sh, and the script is not present anywhere in the disk image.
How can the responder recover the script's contents?
a) Run icat on the disk image to extract the inode that stored /dev/shm/.cache/run.sh on disk
b) Run the shell-history plugin against the memory image to recover the script's text
c) Carve the disk image's unallocated space for blocks that begin with a script interpreter line
d) Extract the cached file from the memory image with Volatility 3's page-cache plugins
07. While a scanning burst hit a Debian web server at an online retailer, the nginx error output in the journal stops for a while around 02:20. Reviewing the journal, the responder finds this line:
Sep 14 02:20:41 web03 systemd-journald[388]: Suppressed 18342 messages from nginx.service
What does this line tell the responder about the missing nginx output?
a) They were compressed into an archived journal file that journalctl expands when it reads the archive
b) They were removed afterwards by a journalctl --vacuum-time run
c) journald dropped them under its per-service rate limit, so they were never stored
d) They were forwarded to rsyslog, so the journal kept no copy of them
08. From an ext4 partition image of a mail relay at a law firm, a responder wants one export of every deleted file The Sleuth Kit can still rebuild, leaving the allocated files out. Which command produces that export?
a) tsk_recover -a part.img /cases/out
b) tsk_recover part.img /cases/out
c) tsk_recover -e part.img /cases/out
d) blkls part.img
09. An engineering consultancy's RHEL-family file server has the Samba full_audit module enabled on its finance share, with unlinkat listed in full_audit:success. Looking for a missing spreadsheet, the responder searches /var/log/messages and finds:
Sep 14 01:58:13 fs01 smbd_audit: jdoe|192.168.20.31|unlinkat|ok|finance/Q3-forecast.xlsx
What does this entry record?
a) User jdoe, connected from client 192.168.20.31, successfully deleted the file from the share
b) User jdoe opened and read the spreadsheet from the workstation at 192.168.20.31
c) A local account at the server console, recorded at 192.168.20.31, removed it
d) The attempt by jdoe from 192.168.20.31 to delete the file was refused
10. Triage packages from 30 RHEL-family database servers at a hospital list SHA-256 hashes for about 9,000 executables per server, far more than the responder can review by hand.
Which first step narrows the review set most reliably?
a) Review only the executables outside /usr/bin and /usr/sbin, where packaged system software is installed
b) Set aside executables whose hashes match a validated known-software set such as the NSRL or the hospital's golden images
c) Review the largest and highest-entropy executables first, since packed or encrypted tools stand out
d) Review only the executables owned by root or carrying the setuid bit, since those are the files able to act with full privileges
Answers:
|
Question: 01 Answer: a, e |
Question: 02 Answer: d |
Question: 03 Answer: a |
Question: 04 Answer: b |
Question: 05 Answer: a |
|
Question: 06 Answer: d |
Question: 07 Answer: c |
Question: 08 Answer: b |
Question: 09 Answer: a |
Question: 10 Answer: b |
Note: For any error in GIAC Linux Incident Responder (GLIR) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
