1Z0-822 · Question #81
You are the primary administrator for a set of Oracle Solaris 11 servers. You noticed some changes to configuration files. You are concerned that someone may have unauthorized access or that an…
The correct answer is B. Use audit-config to add the servers' host names to the audit_remote plug in. send Solaris audit logs to a remote server The audit_remote plugin module for Solaris audit, /usr/lib/security/audit_remote.so, sends binary audit records (audit.log) to audit servers as they are configured with auditconfig. The audit_remote plugin is loaded by auditd if the…
Question
You are the primary administrator for a set of Oracle Solaris 11 servers. You noticed some changes to configuration files. You are concerned that someone may have unauthorized access or that an authorized user may be abusing the access privilege. You decide to track a set of security events across multiple servers. How will you configure the systems for this?
Options
- AConfigure a centralized system-logging server and direct all servers to use it.
- BUse audit-config to add the servers' host names to the audit_remote plug in.
- CAdd centralized NFS file systems to the /etc/security/audit_control file on each server.
- DModify the /etc/security/audit_startup file and add audit_remote logging on each server.
How the community answered
(29 responses)- A3% (1)
- B79% (23)
- C14% (4)
- D3% (1)
Explanation
- send Solaris audit logs to a remote server The audit_remote plugin module for Solaris audit, /usr/lib/security/audit_remote.so, sends binary audit records (audit.log) to audit servers as they are configured with auditconfig. The audit_remote plugin is loaded by auditd if the plugin is configured as an active via auditconfig. Use the auditconfig -setplugin option to change all the plugin related configuration not D: Audit policy determines the characteristics of the audit records for the local host. When auditing is enabled, the contents of the /etc/security/audit_startup file determine the audit policy.
Topics
Community Discussion
No community discussion yet for this question.