nerdexam
Cisco

200-201 · Question #38

Refer to the exhibit. In which Linux log file is this output found?

The correct answer is D. /var/log/auth.log. The exhibit, displaying authentication-related messages, is found in the /var/log/auth.log file on Debian-based Linux systems.

Submitted by eva_at· Mar 6, 2026Host-Based Analysis

Question

Refer to the exhibit. In which Linux log file is this output found?

Exhibit

200-201 question #38 exhibit

Options

  • A/var/log/authorization.log
  • B/var/log/dmesg
  • Cvar/log/var.log
  • D/var/log/auth.log

How the community answered

(20 responses)
  • A
    5% (1)
  • B
    15% (3)
  • C
    5% (1)
  • D
    75% (15)

Why each option

The exhibit, displaying authentication-related messages, is found in the `/var/log/auth.log` file on Debian-based Linux systems.

A/var/log/authorization.log

`authorization.log` is not a standard or commonly used log file name for authentication on most Linux distributions; `auth.log` is the correct standard.

B/var/log/dmesg

`/var/log/dmesg` contains kernel ring buffer messages, primarily related to hardware detection, device drivers, and system boot processes, not user authentication.

Cvar/log/var.log

`/var/log/var.log` is an incorrect path and file name; `var` is a directory, not a log file itself.

D/var/log/auth.logCorrect

The `/var/log/auth.log` file on Debian-based Linux distributions records system authorization messages, including user logins, authentication attempts, and sudo commands, making it the primary location for security-related authentication events.

Concept tested: Linux System Logging (Authentication)

Source: https://learn.microsoft.com/en-us/azure/sentinel/connect-linux-syslog

Topics

#Linux logs#authentication logs#host-based analysis

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice