Consider the following rule file for use with the Basic Audit Reporting Tool (BART). CHECK all IGNORE dirmtime /etc/security /etc/notices IGNORE contents /export/home IGNORE mtime size contents /var…

The correct answer is A. /var/dhcp Attribute: size uid gid mode acl D. /etc/security/exec_attr Attribute: size uid mode acl mtime devnode. Looking at the BART rule file, I'll trace through the directives to explain each choice. Why A and D are correct: The rule IGNORE dirmtime /etc/security only strips the directory-modification-time attribute from /etc/security paths, leaving all other "all" attributes intact…

Analyzing and Troubleshooting System Problems

Question

Consider the following rule file for use with the Basic Audit Reporting Tool (BART). CHECK all IGNORE dirmtime /etc/security /etc/notices IGNORE contents /export/home IGNORE mtime size contents /var CHECK You are using BART to detect inappropriate changes to the file system. Identify the two correct statements describing the attributes recorded.

Options

A/var/dhcp Attribute: size uid gid mode acl
B/etc/hosts Attributes: size uid gid mode acl intime dest
C/var/spool/mqueue Attribute: size uid gid mode acl dirmtime
D/etc/security/exec_attr Attribute: size uid mode acl mtime devnode
E/export/home/kate/.profile Attributes: uid gid mode acl dirmtime
F/export/home/rick/.profile Attributes: size uid gid mode acl mtime contents

How the community answered

(64 responses)

A
64% (41)
B
9% (6)
C
2% (1)
E
20% (13)
F
5% (3)

Explanation

Looking at the BART rule file, I'll trace through the directives to explain each choice.

Why A and D are correct: The rule IGNORE dirmtime /etc/security only strips the directory-modification-time attribute from /etc/security paths, leaving all other "all" attributes intact. /etc/security/exec_attr is a device file, so D correctly lists its applicable attributes (including devnode) without dirmtime. /var/dhcp at that path receives standard file attributes - size, uid, gid, mode, acl - consistent with no rule specifically overriding those attributes for that entry.

Why the distractors fail:

B includes dest (a symlink-specific attribute) and intime for /etc/hosts, which is a regular file - neither attribute applies.
C lists size for /var/spool/mqueue, but IGNORE mtime size contents /var explicitly removes size from all /var paths; size must not appear.
E includes dirmtime for /export/home/kate/.profile, which is a regular file - dirmtime is a directory-only attribute and cannot apply here.
F lists contents for /export/home/rick/.profile, but IGNORE contents /export/home explicitly removes that attribute from all /export/home paths.

Memory tip: Think "IGNORE = subtract." For each path in a choice, scan the rule file for any matching IGNORE entry and cross out those attributes. If the option still lists a removed attribute (F lists contents, C lists size), it's wrong. If it lists a type-mismatched attribute (E uses dirmtime on a file, B uses dest on a non-symlink), it's also wrong.

Topics

#BART#file system auditing#audit rule precedence#audit attributes

Community Discussion

No community discussion yet for this question.

Full 1Z0-820 Practice