XK0-006 Security Practice Question
A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)
⚠ Common exam trap
Watch out — candidates often confuse general system logs like /var/log/syslog or /var/log/messages with dedicated authentication logs, but these files lack the structured login/out records that commands like last, lastlog, and lastb specifically parse.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
last
The `last` command reads the /var/log/wtmp file to display a list of all user logins and logouts since that file was created, showing timestamps and source IPs. This makes it a primary tool for investigating login history during a breach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
last
Why this is correct
Shows user login history.
- ✓
lastlog
Why this is correct
Shows the last login time for each user.
- ✓
lastb
Why this is correct
Shows failed login attempts.
- ✗
/var/log/syslog
Why it's wrong here
Contains general system messages, not specifically login history.
- ✗
/var/log/messages
Why it's wrong here
Similar to syslog, not dedicated to logins.
Go deeper
Related to this question
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.