You are informed that an unprivileged user has executed commands as the superuser. You decide
to look at the log file for the su(1) command. The contents in the log file are:
SU 12/07 11:50 + pts/6 gv1123-root
SU 12/07 11:54 – pts/5 fb12-root
SU 12/07 11:54 + pts/3 gv1123-root
SU 12/07 12:03 + pts/1 jjj-gv1123
You know the file has NOT been tampered with.
Which two statements are true? (Choose two.)
A.
User fb12 is suspected of having executed the commands.
B.
User gv1123 is suspected of having executed the commands.
C.
The commands might have been executed on pts/3.
D.
The commands might have been executed on pts/1.
E.
User jjj is not a suspect.
Explanation: