You work as a Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. You are working as a root user on the Linux operating system. While performing some security…

The `dig` command is a DNS query utility used to look up DNS records such as A, MX, and NS entries, not to display user login history.

The `netstat` command displays current active network connections, routing tables, and interface statistics, but it does not show historical login sessions or their source addresses.

The `nslookup` command performs forward and reverse DNS lookups, resolving hostnames to IPs and vice versa, and does not report user login history.

The `last` command parses the binary /var/log/wtmp log file and outputs each login session with the username, terminal, source hostname or IP address, login time, and session duration. Because it records remote login origin information, it is the correct tool for a security investigation focused on identifying where users logged in from. It requires no special privileges beyond reading the wtmp file, but running as root ensures access to all entries.