312-49V11 · Question #66
Hazel, a forensic investigator, is analyzing the SSH logs on a Linux server using journalctl. She needs to extract the fingerprint of the SSH key from the logs to trace any potential unauthorized…
The correct answer is D. journalctl -u ssh. According to the CHFI v11 Operating System Forensics objectives, Linux system logs are a critical source of evidence for identifying unauthorized access, brute-force attempts, and SSH key 璪ased authentication activities. On modern Linux systems that use systemd, SSH-related…
Question
Hazel, a forensic investigator, is analyzing the SSH logs on a Linux server using journalctl. She needs to extract the fingerprint of the SSH key from the logs to trace any potential unauthorized access. Which of the following commands should Hazel execute to view the SSH key fingerprint in the SSH unit logs?
Options
- Ajournalctl -u ssh --since yesterday
- Bjournalctl -fu ssh
- Cjournalctl -u ssh --since -1h
- Djournalctl -u ssh
How the community answered
(30 responses)- A10% (3)
- B3% (1)
- C13% (4)
- D73% (22)
Explanation
According to the CHFI v11 Operating System Forensics objectives, Linux system logs are a critical source of evidence for identifying unauthorized access, brute-force attempts, and SSH key 璪ased authentication activities. On modern Linux systems that use systemd, SSH-related events are logged and managed by the system journal, which can be queried using the journalctl utility. The command journalctl -u ssh retrieves all log entries associated with the SSH service unit, making it the most appropriate command when an investigator needs a complete and unfiltered view of SSH activity. SSH key fingerprints are typically logged during public key authentication events, including successful and failed login attempts, and may appear alongside details such as usernames, source IP addresses, and authentication methods.
Topics
Community Discussion
No community discussion yet for this question.