Which of the following types can be specified within the Linux Audit system? (Choose THREE correct answers.)

Question

Options

• AControl rules
• BFile system rules
• CNetwork connection rules
• DConsole rules
• ESystem call rules

• A
  86% (49)
• C
  5% (3)
• D
  9% (5)

Explanation

The Linux Audit system (auditd) supports exactly three categories of rules: Control rules (A) configure the audit system's own behavior, such as setting buffer sizes and failure modes; File system rules (B) (also called watch rules) monitor read/write/execute access on specific files or directories; and System call rules (E) log when specific syscalls (e.g., open, execve, chmod) are invoked by user or process.

C (Network connection rules) is incorrect - auditd does not have a dedicated rule type for network connections. Network activity can be captured indirectly via syscall rules (e.g., trapping connect), but it is not its own category. D (Console rules) is not a real audit rule type at all.

Memory tip: Think "CFS" - Control, File-system, Syscall - the three pillars of auditd rules. You configure the system (Control), watch paths (File system), and trap kernel calls (System call). Anything else is a distractor.

No community discussion yet for this question.