performance hard Apply log-pipeline 2 points

Question 27. CSCD240-E1-C

List unique usernames appearing on FAIL lines of auth.log (user=<name>).

Work the drill

Answer on paper or in a terminal before revealing the ideal answer.

Ideal answer

grep FAIL auth.log | grep -oE 'user=[a-zA-Z0-9]+' | cut -d= -f2 | sort -u

Acceptable alternatives: ["awk '/FAIL/{print $4}' auth.log | cut -d= -f2 | sort -u"]

Misconception bank

Each row below is a plausible wrong answer, the thinking that produces it, and the remedy that corrects the misconception. These are the foundation of the multiple-choice framing and the targeted feedback a student receives after answering.

grep FAIL auth.log | sort -u

Misconception. Dedupes whole lines, not usernames.

Remedy. Extract first.

Authority mappings

Hover any chip for the mapping justification; click to open the authority record.

DCWF roles: EN-211 Forensics Analyst CS-511 Cyber Defense Analyst

DCWF tasks: T0447

KU outcomes: CO-M9-O1

O*NET tasks: SOC 15-1212.00: task 6 SOC 15-1212.00: task 7

NCAE errors: WWW Content / failure: Failed to connect to hostWWW Content / timeout: TimeoutWWW Content / failure: Website cannot be reachedSSH Login / failure: Failed to connect to host: IPSSH Login / partial: The following users failed t.SSH Login / partial: The following users failed t.