SY0-701 Security Operations Practice Question
A Linux server starts showing many failed SSH logins from one source IP address. Which log source should the analyst review first?
⚠ Common exam trap
The trap here is that candidates might confuse system authentication logs with generic system logs (e.g., /var/log/messages) or assume that SSH failures would be recorded in a network-level log, but the exam specifically tests knowledge of Linux authentication logging mechanisms.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The system authentication log
The system authentication log (e.g., /var/log/auth.log or /var/log/secure) records all SSH login attempts, including failed ones, along with source IP addresses. This is the primary log source for investigating authentication failures on Linux systems, as it captures PAM (Pluggable Authentication Module) events and SSH daemon messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The system authentication log
Why this is correct
This is the best choice because authentication logs record login attempts, failures, and success events. For SSH activity, the auth log or equivalent security log is the most direct place to confirm whether the attempts are real, what accounts were targeted, and whether any successful logon followed the failures. It provides the most useful first evidence for triage.
- ✗
The printer spooler log
Why it's wrong here
The printer spooler log records print jobs, spooler service events, and printer errors. It does not capture network-level authentication data, because SSH login attempts are processed by the sshd daemon and written to the system's authentication log (auth.log or /var/log/secure). Reviewing the printer spooler log for signs of a brute-force SSH attack would yield no relevant evidence, as this log stream is entirely unrelated to remote login events.
- ✗
The browser history log
Why it's wrong here
Browser history tracks websites visited by a local user in a graphical web browser, typically stored under a user's home directory. A Linux server often runs headless without a browser, and even if present, browser history records HTTP/HTTPS navigation, not SSH protocol events. Since failed SSH logins are generated by the SSH server before any user session or desktop environment is involved, browser history log will not contain any trace of these authentication failures.
- ✗
The backup completion log
Why it's wrong here
Backup completion logs contain information about scheduled backup jobs, such as start/end times, file counts, and exit statuses. These logs exist to verify data protection, not to record authentication events; they would not list SSH login attempts or failed password handshakes. Even though a successful breach might later trigger changes, the backup log cannot serve as evidence of the initial login attempts, so it is the wrong place to look during triage.
Go deeper
Related to this question
Learn chapter
System and OS Hardening
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.