XK0-006 Security Practice Question
A security analyst needs to see a list of failed login attempts on a Linux system. Which command displays this information from the /var/log/btmp log?
⚠ Common exam trap
Test-takers frequently confuse the four similar-sounding commands: `lastb` (failed logins from btmp), `lastlog` (last successful login per user from lastlog), `last` (successful login history from wtmp), and `faillog` (failed login counts from faillog). Candidates often mix up `lastb` and `faillog` because both relate to failures, but only `lastb` reads btmp.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lastb
The `lastb` command reads the `/var/log/btmp` file, which specifically records failed login attempts. It displays a list of bad logins, including the username, terminal, source IP, and timestamp. This is the correct tool for auditing failed authentication events on Linux.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
lastb
Why this is correct
`lastb` reads the binary `/var/log/btmp` record file and prints each failed login attempt with its timestamp, source host and username. Since the stem explicitly requires displaying failed logins from that specific log, `lastb` is the matching tool; `last` reads `/var/log/wtmp` for successful sessions instead.
- ✗
lastlog
Why it's wrong here
lastlog reads /var/log/lastlog and reports each account's most recent successful login, so it cannot list failed attempts from btmp. It is tempting because it also audits login activity per user, and would be the right tool for confirming when accounts last authenticated successfully.
- ✗
last
Why it's wrong here
last reads /var/log/wtmp, which records successful logins, reboots and shutdowns, so it shows no failed attempts. It is tempting because it is the standard login-history command and displays similar formatted output, and would be correct for reviewing successful sessions rather than authentication failures.
- ✗
faillog
Why it's wrong here
faillog reads the binary /var/log/faillog database, which tracks failed-attempt counts and lockout limits per account, not the individual failed login records held in btmp. It is tempting because its name and purpose concern failed logins, and it would be correct for checking an account's failure tally or lockout threshold.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
Terminal
A terminal is a text-based interface that allows users to communicate with a computer's operating system by typing commands.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.