Which of the following expressions are valid AIDE rules? (Choose TWO correct answers.)

Question

Options

• A!/var/run/.*
• Bappend: /var/log/*
• C/usr=all
• D#/bin/
• E/etc p+i+u+g

• A
  72% (28)
• B
  15% (6)
• C
  8% (3)
• D
  5% (2)

Explanation

A is correct because AIDE uses the ! prefix to create exclusion rules - !/var/run/.* tells AIDE to ignore all files in /var/run/, which is standard and valid syntax. E is correct because /etc p+i+u+g follows the canonical AIDE rule format: a path followed by a space and a +-delimited list of attributes (p=permissions, i=inode, u=uid, g=gid).

B (append: /var/log/*) is invalid - AIDE has no append: keyword; this looks like fabricated syntax. C (/usr=all) is invalid - the = operator in AIDE is a prefix to the path (e.g., =/usr all), not placed between the path and the attribute group. D (#/bin/) is simply a comment in AIDE config files; the # character suppresses the entire line, making it a no-op, not a rule.

Memory tip: Valid AIDE rules either start with ! (exclude), = (non-recursive watch), or just a bare path - followed by a space and the attribute group. If you see #, it's a comment; if you see a colon or = between path and attributes, it's wrong syntax.

No community discussion yet for this question.