350-201 Question 276
Select 2You are investigating a potential security incident on a Linux-based server. You need to locate a file named 'access.log' within the '/var/log' directory and its subdirectories. After finding the file, you want to display its contents to examine suspicious activity. Which Bash command(s) should you use to achieve this?
- A
find /var/log -name access.log
- B
cat /var/log/access.log
- C
find /var/log -name access.log -exec cat {} ;
- D
ls -R /var/log | grep access.log
- E
grep 'access.log' /var/log/*
Show answer and explanation
Correct answers: A, C
Explanation
To locate and examine the contents of the 'access.log' file, you must first use a command capable of recursively finding the file within the '/var/log' directory. The 'find' command is ideal for this purpose. Combining 'find' with '-exec cat' allows you to not only locate the file but also display its contents. This eliminates the need for assumptions about the file's exact location and ensures the task is completed efficiently.
- A. Correct.
Correct. The 'find' command searches for the specified file ('access.log') recursively starting from the '/var/log' directory.
- B. Incorrect.
Incorrect. While 'cat' displays the contents of a file, this command assumes the file is located directly in '/var/log' without confirming its existence or searching for it.
- C. Correct.
Correct. This command uses 'find' to locate the file and '-exec' to immediately display its contents using 'cat' once the file is found.
- D. Incorrect.
Incorrect. While 'ls -R' lists files recursively, it does not specifically locate or display the contents of 'access.log' efficiently. Additionally, using 'grep' in this way is error-prone.
- E. Incorrect.
Incorrect. The 'grep' command is designed to search for patterns within files, not to find files themselves. This command will fail if 'access.log' is not directly in '/var/log'.