nerdexam
GIAC

GCFA · Question #62

Mark is the Administrator of a Linux computer. He wants to check the status of failed Telnet-based login attempts on the Linux computer. Which of the following shell commands will he use to…

The correct answer is A. GREP. The GREP command is the correct Linux tool for searching log files for specific patterns such as failed Telnet login attempts. The other commands serve entirely different system functions unrelated to log analysis.

Advanced Mac & Linux Forensics

Question

Mark is the Administrator of a Linux computer. He wants to check the status of failed Telnet-based login attempts on the Linux computer. Which of the following shell commands will he use to accomplish the task?

Options

  • AGREP
  • BCP
  • CFSCK
  • DCAT

How the community answered

(56 responses)
  • A
    79% (44)
  • B
    11% (6)
  • C
    4% (2)
  • D
    7% (4)

Why each option

The GREP command is the correct Linux tool for searching log files for specific patterns such as failed Telnet login attempts. The other commands serve entirely different system functions unrelated to log analysis.

AGREPCorrect

GREP searches through Linux log files such as /var/log/auth.log or /var/log/secure for text patterns like 'Failed' or 'telnet', allowing an administrator to isolate and review failed authentication events. It is the standard Unix utility for pattern-based log filtering and is widely used in security auditing and incident investigation workflows.

BCP

CP is the file copy command used to duplicate files or directories and has no capability to search or filter log file content.

CFSCK

FSCK (File System Consistency Check) is a utility for checking and repairing Linux file system integrity and does not read or parse log files for authentication events.

DCAT

CAT outputs the entire contents of a file to the terminal sequentially but cannot filter or search for specific patterns such as failed login entries.

Concept tested: Linux log file analysis using GREP for failed logins

Source: https://man7.org/linux/man-pages/man1/grep.1.html

Topics

#GREP command#Linux logs#login monitoring#Telnet security

Community Discussion

No community discussion yet for this question.

Full GCFA Practice