312-39 · Question #142
Chloe, a SOC analyst with Jake Tech, is checking Linux systems logs. She is investigating files at /var/log/ wtmp. What Chloe is looking at?
The correct answer is D. Login records. binary file that can be read with tools like last, which can display the login history of all users or a specific user, as well as the times of system reboots and shutdowns. SOC analysts, like Chloe, would inspect this file to track user activities and investigate potential…
Question
Chloe, a SOC analyst with Jake Tech, is checking Linux systems logs. She is investigating files at /var/log/ wtmp. What Chloe is looking at?
Options
- AError log
- BSystem boot log
- CGeneral message and system-related stuff
- DLogin records
How the community answered
(37 responses)- A3% (1)
- B3% (1)
- C5% (2)
- D89% (33)
Explanation
binary file that can be read with tools like last, which can display the login history of all users or a specific user, as well as the times of system reboots and shutdowns. SOC analysts, like Chloe, would inspect this file to track user activities and investigate potential unauthorized access or other security knowledge on SOC operations, including log management and correlation. The CSA certification emphasizes the importance of understanding various log files and their purposes within a Linux system as part of the SOC analyst’s role12. For more detailed information, the EC-Council’s official CSA study guides and resources should be consulted.
Topics
Community Discussion
No community discussion yet for this question.