000-221 · Question #77
An administrator would like to enable operators to list the submission times of all crontab files, but not to edit them. How can this be accomplished?
The correct answer is B. Enable them to use the cronadm command with SUDO. The cronadm command on AIX provides administrative control over cron jobs, and pairing it with SUDO allows operators to list crontab submission times without granting edit privileges.
Question
An administrator would like to enable operators to list the submission times of all crontab files, but not to edit them. How can this be accomplished?
Options
- AEnable them to use the crontab command with Role Based Access Control (RBAC)
- BEnable them to use the cronadm command with SUDO.
- CEnable them to view the /var/spool/cron/log file with unix file permissions.
- DEnable them to use the Iscrontab command by adding them to the system group.
How the community answered
(62 responses)- A6% (4)
- B82% (51)
- C8% (5)
- D3% (2)
Why each option
The cronadm command on AIX provides administrative control over cron jobs, and pairing it with SUDO allows operators to list crontab submission times without granting edit privileges.
Granting access to the crontab command via RBAC would allow users to edit crontab files, not just list submission times.
The AIX cronadm command supports listing crontab files and their submission details without modifying them. Pairing it with SUDO allows the administrator to grant precisely scoped access - only the specific cronadm listing subcommand - so operators cannot edit crontab files.
The /var/spool/cron/log file contains execution logs, not submission times, and does not fulfill the requirement.
Adding users to the system group grants broad system-level privileges beyond the limited listing access required.
Concept tested: AIX cron administration with controlled SUDO access
Source: https://www.ibm.com/docs/en/aix/7.3?topic=c-cronadm-command
Topics
Community Discussion
No community discussion yet for this question.