NCAE Mapping Hub
Overview Scoreboard Data Roles Exercised Checklists Lessons Skill Drills Practice Terminal Progress
performance hard Apply log-pipeline 2 points

Question 50. CSCD240-E1-A

auth.log line format "2026-04-14 08:31 FAIL user=alex src=10.x". Print top-3 FAIL source IPs, count first, most-frequent first.

Work the drill

Answer on paper or in a terminal before revealing the ideal answer.

Ideal answer
grep FAIL auth.log | awk '{print $5}' | sort | uniq -c | sort -rn | head -3
Acceptable alternatives: ["grep FAIL auth.log | cut -d ' ' -f 5 | sort | uniq -c | sort -rn | head -3", "awk '/FAIL/{print $5}' auth.log | sort | uniq -c | sort -rn | head -3"]

Misconception bank

Each row below is a plausible wrong answer, the thinking that produces it, and the remedy that corrects the misconception. These are the foundation of the multiple-choice framing and the targeted feedback a student receives after answering.

awk '{print $5}' auth.log | sort | uniq -c | sort -rn | head -3
Misconception. Missing FAIL filter; counts both LOGIN and FAIL sources together.
Remedy. Teach pipeline stage-by-stage; narrow BEFORE aggregate.
grep FAIL auth.log | sort | uniq -c | sort -rn | head -3
Misconception. Missing field extraction; counts entire lines (each unique) so uniq -c returns 1s.
Remedy. Extract the field of interest before dedup.
grep FAIL auth.log | awk '{print $5}' | sort | uniq -c | head -3
Misconception. Missing final sort -rn; returns alphabetical top 3, not most-frequent.
Remedy. Teach the 4-stage idiom: filter → extract → sort|uniq-c → sort -rn | head.

Authority mappings

Hover any chip for the mapping justification; click to open the authority record.

DCWF roles: EN-211 Forensics Analyst CS-511 Cyber Defense Analyst
DCWF tasks: T0259 T0447
KU outcomes: CD-BSP-O6CO-M9-O1
KU topics: CD-OSC-T5
O*NET tasks: SOC 15-1212.00: task 6SOC 15-1212.00: task 7
NCAE errors: WWW Content / failure: Failed to connect to hostWWW Content / timeout: TimeoutWWW Content / failure: Website cannot be reachedSSH Login / failure: Failed to connect to host: IPSSH Login / partial: The following users failed t.SSH Login / partial: The following users failed t.

Course-artifact links

Lectures

  • CSCD240-S26-L08. Pipes, filters, grep, sort, uniq, wc, tar

Lab questions

  • CSCD240-S26-LAB4: Build pipeline: sort words.txt | uniq -c | sort -rn | head. Top-N frequency.
  • CSCD240-S26-LAB5: Use wc -l, head -n 5, tail -n 5, cut -d, -f 2 on a CSV.