CompTIA Linux+ XK0-006 (V8) Practice Question

The pipeline that works is the one that first sorts the data case-insensitively, then lets uniq collapse adjacent duplicates while counting and ignoring case, and finally re-sorts the result numerically in reverse order so the largest counts appear first:

sort -f /var/log/auth_users.log | uniq -ci | sort -nr

• sort -f folds upper- and lower-case so duplicate names become adjacent.
• uniq -c adds the count, and -i ignores case while comparing lines; because the data are now adjacent, every instance is tallied correctly.
• sort -nr orders the output on the numeric count field from highest to lowest.

Other options fail for at least one reason:

• A pipeline that uses uniq -d or uniq without -c does not show the required counts (and uniq -d omits singletons).
• A pipeline that relies on sort -u or wc only reports totals or unique values, not the full list with counts.
• Running uniq -ci without a preceding sort will miss separated duplicates because uniq only evaluates adjacent lines.

Thus the correct solution is the pipeline that incorporates sort -f, uniq -ci, and sort -nr in that order.