An investigator needs to determine which accounts signed in to a specific Linux server last week, from which source addresses, and whether any attempts failed. Which data source should the investigator examine FIRST?
Select an answer to reveal the explanation.
Short Explanation
Want to know who logged in and when? You go to the guest book - that's the authentication log. Firewall logs show someone knocked on port 22, but not which account walked in or whether the password was wrong. That's the trap.
Full Explanation
Authentication logs record sign-in activity on a system: successful and failed logon attempts, the account names involved, source addresses for remote sessions, the authentication method, and timestamps. On a Linux server, these events are written by the authentication subsystem and remote access services, so they directly answer which accounts signed in, from where, and whether attempts failed. That makes them the first and most precise source for this question. Firewall logs show that a connection was allowed or denied between addresses and ports, which can confirm that a remote session was attempted, but they do not reveal which account was used or whether authentication succeeded. Application logs capture events generated by a specific application, such as a web application's errors and transactions; they do not record operating system logons. NetFlow records summarize traffic volumes and conversations between hosts, which helps establish communication patterns but provides no account or authentication outcome. Exam caveat: investigators commonly correlate authentication logs with firewall and flow data to confirm source addresses and timelines, but authentication logs anchor the account-level answer. Operational check: confirm the server forwards its authentication events to the central log platform, verify clock synchronization, and query for the relevant date range.