GCIH · Question #749
Which of the following files would grow to a large size as a result of a brute force attack?
The correct answer is A. btmp. The btmp file records failed login attempts on Linux systems, so it grows rapidly during a brute force attack that generates massive numbers of failed authentications.
Question
Which of the following files would grow to a large size as a result of a brute force attack?
Options
- Abtmp
- Bwtmp
- Cutmp
How the community answered
(65 responses)- A91% (59)
- B3% (2)
- C6% (4)
Why each option
The btmp file records failed login attempts on Linux systems, so it grows rapidly during a brute force attack that generates massive numbers of failed authentications.
The /var/log/btmp file on Linux logs every failed login attempt and is appended to continuously. During a brute force attack, thousands or millions of failed authentication attempts are recorded sequentially, causing the file to grow very large. It can be read using the 'lastb' command.
The wtmp file records successful logins and logouts - a brute force attack produces very few if any successful logins, so wtmp would not grow significantly.
The utmp file tracks currently logged-in users in real time and is overwritten rather than appended to, so it remains small regardless of attack volume.
Concept tested: Linux authentication log files - failed login tracking
Source: https://man7.org/linux/man-pages/man5/wtmp.5.html
Topics
Community Discussion
No community discussion yet for this question.