A change in your company's security policy now requires an audit trial of all administrators assuming the sysadm role, capturing: Executed commands, including options Logins and logouts There are…

Question

Options

• Aauditconfig set policy=argv
• Bauditconfig -setpolicy +argv
• Cauditconfig -setflags lo, ex sysadm
• Dauditconfig set flags=lo, ex sysadm

• A
  9% (3)
• B
  71% (24)
• C
  15% (5)
• D
  6% (2)

Explanation

auditconfig -setpolicy +argv is correct because Solaris BSM auditing requires this exact syntax to enable the argv policy, which records the full command line including all options and arguments. Since rolemod handles assigning the lo (login/logout) and ex (execution) audit flags to the sysadm role, the auditconfig command's job here is specifically to ensure those execution records also capture what arguments were passed - satisfying the "including options" requirement.

Why the distractors fail:

• A (auditconfig set policy=argv) uses an invalid syntax - auditconfig requires a hyphen-prefixed flag like -setpolicy, not a set key=value style.
• C (auditconfig -setflags lo,ex sysadm) confuses responsibilities: -setflags sets system-wide preselection masks, not role-specific ones, and auditconfig doesn't accept a role name argument - that's rolemod's job.
• D (auditconfig set flags=lo,ex sysadm) combines both errors - wrong verb syntax and wrong command for role-specific flag assignment.

Memory tip: The + in +argv is your signal that you're adding a policy to what's already audited - think "+ all run goes visible." When a question mentions capturing command options/arguments, argv (argument vector) should immediately come to mind.

No community discussion yet for this question.