CompTIA
PT0-002 · Question #294
A penetration tester was able to compromise a web server and move laterally into a Linux web server. The tester now wants to determine the identity of the last user who signed in to the web server. Wh
Sign in or unlock PT0-002 to reveal the answer and full explanation for question #294. The question stem and answer options stay visible for context.
Post-exploitation and lateral movement
Question
A penetration tester was able to compromise a web server and move laterally into a Linux web server. The tester now wants to determine the identity of the last user who signed in to the web server. Which of the following log files will show this activity?
Options
- A/var/log/messages
- B/var/log/last_user
- C/var/log/user_log
- D/var/log/lastlog
Unlock PT0-002 to see the answer
You've previewed enough free PT0-002 questions. Unlock PT0-002 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Linux logging#Post-exploitation reconnaissance#User activity logs#File system analysis