Discuss EC-Council 212-82 Exam Topic 3 Question 22

Gideon, a forensic officer, was examining a victim's Linux system suspected to be involved in online criminal activities. Gideon navigated to a directory containing a log file that recorded information related to user login/logout. This information helped Gideon to determine the current login state of cyber criminals in the victim system, identify the Linux log file accessed by Gideon in this scenario.

A/va r/l og /mysq Id. log

B/va r/l og /wt m p

C/ar/log/boot.iog

D/var/log/httpd/

Suggested Answer: B

/var/log/wtmp is the Linux log file accessed by Gideon in this scenario. /var/log/wtmp is a log file that records information related to user login/logout, such as username, terminal, IP address, and login time. /var/log/wtmp can be used to determine the current login state of users in a Linux system. /var/log/wtmp can be viewed using commands such as last, lastb, or utmpdump1.

Get Premium 212-82 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

19 comments · newest first

Marleen 11 months ago

Nope, definitely not /var/log/httpd, that's for web server logs!

Matthew 11 months ago

Surprised it's not /var/log/syslog, that seems more common.

Sonia 11 months ago

I thought it was /var/log/auth.log?

Sanda 12 months ago

Yeah, I agree with that!

Flo 12 months ago

Pretty sure it's /var/log/wtmp for login/logout info.

Cordell 1 year ago

I thought /var/log/httpd was more for web server logs, so I'm leaning towards /var/log/wtmp or /var/log/auth.log for user activity.

Fidelia 1 year ago

I feel like /var/log/wtmp could be the right answer since it tracks login sessions, but I can't recall if it's the only one used for this purpose.

Minna 1 year ago

I remember practicing a similar question, and I think the correct log file might be related to authentication, possibly /var/log/auth.log?

Jannette 1 year ago

I think the log file for user login/logout information is usually found in the /var/log directory, but I'm not sure which specific file it is.

Celestina 1 year ago

Hmm, this is a tough one. I'm not entirely sure which log file is the correct answer, but I'll make my best guess and hope for the best.

Hoa 1 year ago

Alright, let's see. The question mentions a Linux system and login/logout information, so I'm going to go with /var/log/wtmp. That seems like the most logical choice based on the details provided.

Sherell 1 year ago

I'm a bit confused here. The question talks about a victim's system, but the log file options don't seem to match that context. I'll need to re-read this carefully.

Yoko 1 year ago

Okay, I think I've got this. The question mentions a Linux system and login/logout information, so I'm guessing the correct answer is /var/log/wtmp.

Luis 1 year ago

Hmm, this seems like a tricky one. I'll need to carefully review the information provided and think through the different log file options.

Xenia 1 year ago

This question seems straightforward, but I want to double-check the criteria for determining control of a non-U.S. corporation. Let me think through the options carefully.

Darrel 1 year ago

This seems like a pretty straightforward question. I'd go with option C - setting the project's purpose, mission, and vision. That's a critical first step to get everyone aligned before diving into the details.

Carlee 2 years ago

I would choose /var/log/httpd/ as well, it makes the most sense in this scenario

Marla 2 years ago

I agree with Dominque, because HTTPD logs typically contain user login/logout information

Dominque 3 years ago

I think the Linux log file accessed by Gideon is /var/log/httpd/

EC-Council 212-82 Exam - Topic 3 Question 22 Discussion