Blue Team Ops (2004) Quiz

Exam-prep questions for the Blue Team Ops (2004) track of the Terminal Academy. Defensive operations on real log data: hunt failed logins in auth.log, cut fields with awk, read firewall rules, work an incident.

This category currently has 60 questions in the SERVBG quiz bank. Below are a few sample questions: the full interactive quiz shuffles through the whole set with instant scoring.

Sample questions

On a Debian/Ubuntu Linux host, which log file is the first place a defender checks for SSH login attempts and sudo activity?

/var/log/auth.log
/var/log/kern.log
/var/log/syslog
/var/log/dmesg
/var/log/secure

In sshd's authentication log output, which exact phrase indicates a rejected SSH login attempt?

Accepted password
Failed password
Failed login
Connection reset
Invalid password

Which command displays only the 10 most recent lines of a log file?

head -n 10 /var/log/auth.log
cat -n 10 /var/log/auth.log
grep -n 10 /var/log/auth.log
tail -n 10 /var/log/auth.log
less -n 10 /var/log/auth.log

What is the purpose of running `grep sudo /var/log/auth.log`?

To install the sudo package
To disable sudo logging on the host
To grant the current user sudo privileges
To find every privilege-escalation (sudo) event recorded in the authentication log
To search the filesystem for the sudo binary

Which command turns the ufw host firewall on and makes it persist across reboots?