On Linux systems, where would you typically find authentication logs that help reconstruct user activity after a breach?

• A. /var/log/auth.log or /var/log/secure
• B. /etc/shadow
• C. /proc/cid
• D. /boot/grub/grub.cfg

Answer: (A)

Authentication activity is typically recorded in dedicated log files that capture login attempts, sudo actions, and PAM events. On Linux, you’ll usually find these in /var/log/auth.log or /var/log/secure, depending on distribution. These logs let you reconstruct user activity after a breach by showing who attempted to log in, from where (IP), when, and whether the attempt succeeded, along with elevated actions like sudo. The other paths don’t hold authentication events: /etc/shadow stores password hashes and aging data; /proc/cid isn’t a standard log location; /boot/grub/grub.cfg is the bootloader configuration and contains no user authentication data. Note that some systems use the systemd journal, accessible via journalctl, but the typical location referenced is the auth log or secure log.