A user is suspected of violating policy by logging in to a Linux VM during non-business hours. Which of the following system files is the best way to track the user's activities?

The correct answer is A. /var/log/secure. The /var/log/secure file in Linux logs security-related messages, including authentication attempts such as user logins (both successful and failed) via SSH or other authentication mechanisms. This file is the best source for tracking a user's login activities to identify…

Submitted by noor.lb· Mar 6, 2026Security operations

Question

Options

A/var/log/secure
B/etc/motd
C/var/log/messages
D/etc/passwd

How the community answered

(44 responses)

A
91% (40)
B
2% (1)
C
5% (2)
D
2% (1)

Explanation

The /var/log/secure file in Linux logs security-related messages, including authentication attempts such as user logins (both successful and failed) via SSH or other authentication mechanisms. This file is the best source for tracking a user's login activities to identify whether they accessed the system during non-business hours.

Topics

#Linux logging#Log analysis#User activity monitoring#/var/log/secure

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice