CompTIA Linux+ (XK0-004) — Question 38

An administrator is reviewing suspicious activity on a server and needs to determine which users logged into the system within the past 24 hours. Which of the following commands should the administrator run to determine this?

Answer options

• A. last
• B. who
• C. id
• D. usermod

Correct answer: A

Explanation

The 'last' command displays a list of the last logged-in users, which includes login times and durations, making it the correct choice for this task. The 'who' command shows currently logged-in users but does not provide historical login data. The 'id' command retrieves user ID information, and 'usermod' is used for modifying user account properties, neither of which is relevant for checking recent logins.