EX200 Essential Tools Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  find /var/log -ctime -1

  Why it's wrong here

  The -ctime -1 predicate filters on the inode change time (ctime), not the modification time. ctime is updated not only when file content changes, but also whenever metadata such as permissions, ownership, or link count is altered, so this command would return files that had a chmod or chown in the last 24 hours even if their content was not modified. That makes it unsuitable for finding files whose data was edited.

• ✗

  find /var/log -atime -1

  Why it's wrong here

  Using -atime -1 selects files based on access time (atime), which is updated whenever a file is read, examined, or executed. Log files are frequently read by system utilities, admins, or monitoring agents, so this predicate would include many false positives that were merely opened but never modified. Access time does not reflect content changes, so it is the wrong basis for locating recently modified log files.

• ✗

  find /var/log -mmin 1440

  Why it's wrong here

  The -mmin predicate expects a number of minutes, and 1440 minutes equals exactly 24 hours; however, without a leading minus sign, -mmin 1440 matches files modified exactly 1440 minutes ago, not within the last 24 hours. To find files modified in the past 24 hours with minute granularity, the correct expression is -mmin -1440, meaning 'less than 1440 minutes ago.' Since the proposed command omits the negative sign, it will typically return no files unless a log was modified at that precise instant.

• ✓

  find /var/log -mtime -1

  Why this is correct

  This is the correct command because -mtime -1 specifically filters on the modification time (mtime) and the leading minus sign means 'less than one day old,' i.e., files whose content was last changed within the past 24 hours. Unlike ctime or atime, mtime only updates when the file's data is written to, which is exactly what is needed to identify recently modified log files. In find's age arithmetic, -mtime -1 corresponds to 'less than one 24-hour period,' so it reliably catches all files modified since the same time yesterday.

Go deeper

Related to this question