An administrator is reviewing suspicious activity on a server and needs to determine which users logged into the system within the past 24 hours. Which of the following commands should the administrator run to determine this?
A. last
B. who
C. id
D. usermod
How do these get such bad answers marked as correct? Clearly A
who = users currently logged in
last = used to display the list of all the users logged in and out since the file /var/log/wtmp was created
Reference: https://www.geeksforgeeks.org/last-command-in-linux-with-examples/
A – last