GSEC Linux Security and Hardening Practice Question
A security engineer is implementing file integrity monitoring on a Linux server. The engineer wants to use AIDE to detect unauthorized changes to critical system files. After initializing the AIDE database, which command should be used to perform a manual check and compare the current file system state against the baseline?
⚠ Common exam trap
It's easy for candidates to confuse --update with --check; --update modifies the baseline, while --check only reports differences without changing the database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aide --check
AIDE (Advanced Intrusion Detection Environment) is a file integrity checker. After initializing the baseline database with aide --init, the administrator uses aide --check to compare the current file system against that baseline. The check reports any discrepancies, which can indicate unauthorized changes. The --update option is used to accept changes and update the database, while --init creates a new baseline. There is no --compare option. Therefore, aide --check is the correct command for a manual integrity verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aide --update
Why it's wrong here
The aide --update command updates the existing AIDE database with the current file system state, effectively accepting changes as the new baseline. It does not report differences; instead, it modifies the database to reflect the current state. This is useful after legitimate changes have been verified, but it is not used for detecting unauthorized changes. Using --update without verification could mask security incidents.
- ✗
aide --compare
Why it's wrong here
There is no aide --compare command. AIDE uses --check for comparison and --update for updating the database. The --compare option is not valid and would result in an error. It is important to use the correct syntax. The --check option is the standard way to compare the file system against the baseline and generate a report of differences.
- ✗
aide --init
Why it's wrong here
The aide --init command initializes a new AIDE database by scanning the file system and creating a baseline. It does not perform a comparison against an existing baseline; it creates a new one. This command is used only once to establish the initial database. Running it again would overwrite the baseline, losing the reference point. Therefore, it is not the correct command for a manual check.
- ✓
aide --check
Why this is correct
The aide --check command compares the current file system state against the previously initialized AIDE database. It reports any changes, such as file additions, deletions, or modifications, based on the rules defined in the AIDE configuration. This is the correct command to perform a manual integrity check. It is typically run after the initial database is created and can be scheduled via cron for regular monitoring.
About these practice questions
This GSEC question is part of Courseiva's 351-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.