SSCP Systems and Application Security Practice Question
A security analyst is reviewing security events on a Linux server and needs to ensure that all authentication attempts, including both successful and failed logins, are logged. Which configuration should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable and configure auditd with rules to capture login events
The auditd service is used for auditing in Linux, including authentication events. Configuring auditd rules for logins captures all attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use PAM to log authentication events to /var/log/secure
Why it's wrong here
PAM can be configured to log, but typically uses syslog; auditd is the standard for comprehensive auditing.
- ✓
Enable and configure auditd with rules to capture login events
Why this is correct
auditd is the Linux audit daemon; rules can be added to log all login attempts.
- ✗
Set up SELinux to audit login attempts
Why it's wrong here
SELinux provides mandatory access control and can audit denials, but is not primarily for login logging.
- ✗
Configure syslog to monitor /var/log/auth.log
Why it's wrong here
syslog can forward logs, but does not enable auditing itself; auth.log may already exist but needs auditd to populate it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.