LFCS User and Group Management Practice Question
An administrator needs to view a list of users who have logged in recently. Which command provides this information?
⚠ Common exam trap
Test-takers frequently confuse `who` or `users` (which show current sessions) with `last` (which shows historical login records), leading them to pick a command that only displays active users rather than recent login history.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
last
The `last` command reads the `/var/log/wtmp` file to display a list of all users who have logged in and out, including recent login sessions. This makes it the correct choice for viewing a history of recent logins, as it provides timestamps, duration, and originating host information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
users
Why it's wrong here
users prints only the usernames of accounts with active sessions, omitting login times and any history of recent logins. It is tempting because it quickly names logged-in users, but the stem needs recent-login information, which requires reading wtmp via last rather than the current utmp session list.
- ✗
who
Why it's wrong here
who reports currently logged-in users with their terminal, login time and remote host, so it lists active sessions rather than the recent-login history the stem requests. It is tempting because it does display login times, but that data covers only sessions still open, not past logins recorded in wtmp.
- ✗
finger
Why it's wrong here
finger reads the GECOS field in /etc/passwd plus the last login from wtmp, so it shows account details rather than a live session list. It is tempting because it does report login information, but for the current logged-in users the wtmp-based lastlog data is not what the stem asks for.
- ✓
last
Why this is correct
last reads /var/log/wtmp, which records every login and logout session, so it lists users who logged in recently with timestamps. who and w show only currently active sessions, and lastlog reports each account's most recent login only.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LFCS question from scratch — 406 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.