EX200 Essential Tools Practice Question
A system administrator needs to find all files in /var/log that have been modified in the last 2 hours. Which command should be used?
⚠ Common exam trap
Many exam-takers confuse `-mmin` (modification time) with `-cmin` (change time) or `-amin` (access time), as candidates often misremember which flag tracks content changes versus metadata or access events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
find /var/log -mmin -120
The `find` command with `-mmin -120` searches for files whose data was modified (changed content) within the last 120 minutes. This directly matches the requirement to find files modified in the last 2 hours in /var/log.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
find /var/log -mmin -120
Why this is correct
The `-mmin -120` predicate is the correct choice because it directly tests modification time in minutes. A leading minus sign means "less than," so `-120` matches any file whose data was last modified within the last 120 minutes (i.e., less than two hours ago). This precisely answers the requirement to find files in `/var/log` that have been modified in the last two hours.
- ✗
find /var/log -amin -120
Why it's wrong here
This command is incorrect because `-amin` measures access time (`atime`), not modification time. Access time is updated whenever a file is read, opened, or otherwise accessed, which can happen without any change to the file's content. On modern Linux systems with `relatime` (or `noatime`), accesses may not even update atime reliably, so files modified in the last 120 minutes could be excluded while files merely read are included.
- ✗
find /var/log -mtime -0.08
Why it's wrong here
The `-mtime` predicate works in 24-hour day increments, not minutes. Although GNU find technically accepts fractional values, `-0.08` is interpreted as a tiny fraction of a day (about 1.9 hours) and is rounded or handled in a way that does not reliably represent a 120-minute window. More importantly, this syntax is non-portable, ambiguous, and not the intended method for fine-grained sub-day searches—`-mmin` exists specifically for this purpose.
- ✗
find /var/log -cmin -120
Why it's wrong here
The `-cmin` predicate checks inode change time (`ctime`), which is updated whenever file metadata—such as permissions, ownership, link count, or name—changes, not necessarily when the file's content is modified. Even a simple `chmod` or `chown` updates ctime, so this command would return files that were never modified in the last two hours. It is therefore not equivalent to looking for content modification, unlike `-mmin`.
Go deeper
Related to this question
About these practice questions
One of 427 original EX200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.