Which sources can an administrator inspect to identify an unfamiliar local user account?
Only the current output of ps.
ps
Only /etc/hosts.
/etc/hosts
The output of getent passwd or the entries in /etc/passwd.
getent passwd
/etc/passwd
Only /etc/fstab.
/etc/fstab