alice is a user account used by Alice on a Solaris 11 system. sadmin is a role account on the same system. Your task is to add the command /usr/sbin/cryptoadm to the Network management profile, so…

Question

Options

• ATo the file /etc/security/prof_attr, add the line:
• BTo the file /etc/security/auth_attr, add the line:
• CTo the file /etc/security/exec_attr.d/local-entriies, add the line:
• DRun the roles alice to ensure that alice may assume the role sadmin.
• ERun the command profiles sadmin to ensure that the role sadmin includes the network Management
• FRun the command profiles alice to ensure that the Alice has permissions to access the Network
• GRun the command profiles "Network management" to ensure that the Network management profile

• B
  3% (1)
• C
  79% (27)
• F
  6% (2)
• G
  12% (4)

Explanation

To add a command to a profile in Solaris 11 RBAC, C is required because /etc/security/exec_attr.d/local-entries is precisely where you define which commands belong to which profiles and with what execution attributes - this is the actual mechanism that places /usr/sbin/cryptoadm into the Network Management profile. D is necessary because Alice must be assigned the sadmin role to assume it; running roles alice confirms this assignment exists. E is needed to verify the chain is complete - profiles sadmin confirms that sadmin actually includes the Network Management profile, which must be true for the command to be reachable.

Why the distractors are wrong:

• A (prof_attr) defines profile names and descriptions, not which commands belong to them - the Network Management profile already exists, so no entry is needed here.
• B (auth_attr) defines authorizations (rights to perform actions), not command execution - irrelevant when adding an executable command.
• F (profiles alice) shows Alice's directly assigned profiles, but Alice accesses the command through the role, not through her own profile - the right check is on sadmin.
• G (profiles "Network management") is not valid syntax - profiles takes a user or role name as its argument, not a profile name.

Memory tip: Think of RBAC as a chain - exec_attr links command → profile, then verify role → profile (E), then verify user → role (D). You only edit exec_attr; the other two steps are verification of the existing chain.

No community discussion yet for this question.