Which of the following commands defines an audit rule that monitors read and write operations to the file/ etc/firewall/rules and associates the rule with the name firewall?

Question

Options

• Aauditctl -N firewall -r r: /etc/firewall/rules -r w: etc/firewall/rules
• Bauditctl -A -f /etc/firewall/rules -o r -o w -l firewall
• Cauditctl -w /etc/firewall/rules -p rw -k firewall
• Dauditctl --read /etc/firewall/rules --write /etc/firewall/rules --label firewall
• Eecho "n: firewall r:/etc/firewall/rules: w:/etc/firewall/rules:" | auditctl ~

• A
  7% (4)
• B
  2% (1)
• C
  89% (50)
• D
  2% (1)

Explanation

Option C uses the correct auditctl syntax: -w specifies the watched file path, -p rw sets the permission filter to monitor both read and write operations, and -k firewall assigns a key (label) named "firewall" for filtering audit logs later with ausearch -k firewall.

• A is wrong because -N, -r r:, and -r w: are not valid auditctl flags - this syntax is entirely fabricated.
• B is wrong because -A appends syscall rules (not file watches), -f sets the failure mode, and -o/-l are not valid flags for this purpose.
• D is wrong because auditctl does not support GNU-style long options like --read, --write, or --label.
• E is wrong because piping a custom string format into auditctl is not how the tool works - this syntax is invented.

Memory tip: Use the mnemonic "Watch Permissions, Key name" → -w (watch file), -p (permissions: r, w, x, a), -k (key/label). These three flags together are the standard pattern for any auditctl file-watch rule.

No community discussion yet for this question.