The /var/log/auth.log file contains information about authentication and authorization events on a Linux system, such as successful and failed logins, sudo commands, and SSH sessions. The output in the exhibit shows a failed login attempt from a user named "root" using SSH. References: https://www.cisco.com/c/en/us
/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01101.
html

To search for additional downloads of a malicious file by other hosts, the file hash value is needed. The hash value provides a unique identifier for each specific file version, enabling cybersecurity professionals to track down identical files across networks. References := Cisco Certified CyberOps Associate Overview

The data shown in the exhibit is typical of what can be captured and displayed using tcpdump, a command-line packet analyzer that allows users to display TCP/IP and other packets being transmitted or received over a network.