Question 1
Gideon, a forensic officer, was examining a victim's Linux system suspected to be involved in online criminal activities. Gideon navigated to a directory containing a log file that recorded information related to user login/logout. This information helped Gideon to determine the current login state of cyber criminals in the victim system, identify the Linux log file accessed by Gideon in this scenario.
- AOption A:
/va r/l og /mysq Id. log
- BOption B:
/va r/l og /wt m p
- COption C:
/ar/log/boot.iog
- DOption D:
/var/log/httpd/
Show answer and explanation
Correct answer: B
/var/log/wtmp is the Linux log file accessed by Gideon in this scenario. /var/log/wtmp is a log file that records information related to user login/logout, such as username, terminal, IP address, and login time. /var/log/wtmp can be used to determine the current login state of users in a Linux system. /var/log/wtmp can be viewed using commands such as last, lastb, or utmpdump1.
References: Linux Log Files