Security Blue Team Level 1 Practice Test

Tracking who accessed the system and how they authenticated is done by looking at the authentication log. This log records login attempts, sudo usage, and other authentication events, giving you visibility into who logged in and when. On many Linux distributions, those authentication messages are written to a dedicated file: /var/log/auth.log. It collects entries from the authentication stack—sshd, login, su, sudo, PAM and related components—covering both successful logins and failures, as well as session start and end times. That makes it the primary source for system authentication information including user logins. Other options don’t fit as well: /var/log/cron is for cron job activity, /var/log/dpkg.log records package management actions, and /var/log/secure serves a similar authentication purpose on Red Hat-based systems but is not the file listed in this context.