Exam 312-50v11 topic 1 question 153 discussion

.bash_history is correct answer. Bash history stores command that you write cleartext .bash_history File created by Bash, a Unix-based shell program commonly used on Mac OS X and Linux operating systems; stores a history of user commands entered at the command prompt; used for viewing old commands that are executed. BASH_HISTORY files are hidden files with no filename prefix. They always use the filename .bash_history. NOTE: Bash is that the shell program employed by Apple Terminal. Our goal is to assist you understand what a file with a *.bash_history suffix is and the way to open it. The Bash History file type, file format description, and Mac and Linux programs listed on this page are individually researched and verified by the FileInfo team. we attempt for 100% accuracy and only publish information about file formats that we’ve tested and validated.

The SMB command uses the password to perform the login, this is stored in the bash_history. However, a log (xsession-log) never saves the credentials in its records.

.bash_history

Covering BASH Shell Tracks The BASH is an sh-compatible shell that stores command history in a file called bash_history. This feature of Bash is a problem for hackers, as investigators could use the bash_history file to track the origin of an attack and the exact commands used by an intruder to compromise a system. (P.830/814)

correct

.bash_history seems to be the best answer, there is also absolutely no mention of xsession in the CEH V11 book so I will go with D.

https://www.maths.cam.ac.uk/computing/linux/X/xsession

My vote goes to bash_history. xsession-log should be related to Xorg session - the graphical environment. I cannot imagine how this log can relate to SMB login.

in my opinion is d).bash_history If you would like to seek out more information a few problem during a session or want to repair it, consult the system log, which stores log data for your user session and applications. The ~/.xsession-errors X session log file has been deprecated and is not any longer used. On systemd-based systems, you’ll find the session log data within the systemd journal, which stores the info during a binary format. to look at the logs, use the journalctl command. To view your user session logs: 1. Determine your user ID (uid) by running the subsequent command: 2. $ id –user 1000 3. View the journal logs for the user ID determined above: $ journalctl _UID=1000 For more information on the systemd journal, see the journalctl(1) man page.

(A) is the correct answer

I go for session log option

what is the correct answer?

Correct answer is A. .xsession-log

the answer is A. .X session-log. If you would like to seek out more information a few problem during a session or want to repair it, consult the system log, which stores log data for your user session and applications. The ~/.xsession-errors X session log file has been deprecated and is not any longer used. On systemd-based systems, you’ll find the session log data within the systemd journal, which stores the info during a binary format. to look at the logs, use the journalctl command. To view your user session logs:1. Determine your user ID (uid) by running the subsequent command:2. $ id Cuser10003. View the journal logs for the user ID determined above:$ journalctl _UID=1000For more information on the systemd journal, see the journalctl(1) man page.

correct

History does not show the content of ~/.bash_history. Instead, it shows the current content of Bash's history list in memory for this session. Whenever you open a Bash shell, it will read in the content of your .bash_history file and append that to its session history list. As you type in commands, Bash appends them to its session history list. When you close your shell again, Bash will save its history list to the disk by appending the contained entries to your .bash_history file. The history file doesn’t get updated until the current shell session ends, so everything you did in your current terminal window is not written to the disk yet. It resides only in your history list in memory.

correct