Exam PT0-002 topic 1 question 238 discussion

Actual exam question from CompTIA's PT0-002

Question #: 238
Topic #: 1

A penetration tester was able to compromise a web server and move laterally into a Linux web server. The tester now wants to determine the identity of the last user who signed in to the web server. Which of the following log files will show this activity?

A. /var/log/messages
B. /var/log/last_user
C. /var/log/user_log
D. /var/log/lastlog

Show Suggested Answer

Suggested Answer: D 🗳️

by Frog_Man at Feb. 22, 2023, 12:12 p.m.

Comments

Submit Cancel

nickwen007

11 months, 1 week ago

/var/log/lastlog is a file that contains information about the last time each user logged in to the system. It is usually used by the system administrator to track when and how users log in.

upvoted 3 times

...

cy_analyst

11 months, 1 week ago

Selected Answer: D

The lastlog file contains information about the last login sessions of users on the system. It records the time and date of the last login, as well as the terminal or source IP address from which the user logged in. The lastlog file is usually only accessible to the root user, but a penetration tester who has gained root access to the system should be able to read it.

upvoted 3 times

...

Frog_Man

11 months, 4 weeks ago

D is correct from web search.

upvoted 3 times

...