200-201 Host-Based Analysis Practice Question
A Linux administrator checks authentication logs to investigate a possible brute-force attack. Which log file typically contains records of successful and failed SSH login attempts?
⚠ Common exam trap
200-201 often tests Linux log file locations across distributions — candidates pick /var/log/messages or /var/log/syslog assuming they contain auth events, forgetting that Debian/Ubuntu isolate authentication in /var/log/auth.log.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
/var/log/auth.log
On Debian/Ubuntu Linux systems, /var/log/auth.log records authentication-related events including successful and failed SSH logins, sudo usage, and PAM activity. It is the primary log file for investigating brute-force attacks against SSH. This matches the question's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
/var/log/kern.log
Why it's wrong here
kern.log records kernel messages such as hardware and driver events, so it holds no SSH authentication entries. It is tempting because kernel-level logging sounds security-relevant, and would be correct when diagnosing firewall drops, OOM kills or driver faults rather than login attempts.
- ✓
/var/log/auth.log
Why this is correct
/var/log/auth.log records PAM authentication events on Debian-based Linux systems, capturing both successful and failed SSH login attempts with source addresses and usernames. This directly satisfies the stem's requirement to investigate brute-force activity, since repeated failures from one origin become visible there.
- ✗
/var/log/messages
Why it's wrong here
On Debian and Ubuntu, SSH authentication records go to /var/log/auth.log, not /var/log/messages, which carries general non-auth system notices. It is tempting because messages is a central log on Red Hat systems, where it would be correct if sshd were configured to write there.
- ✗
/var/log/syslog
Why it's wrong here
On systemd distributions, SSH authentication events are written to /var/log/auth.log or the journal, not syslog, which captures general system messages. It is tempting because syslog aggregates many daemons, and would be correct on systems where sshd logs there via rsyslog configuration.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.