SUN
310-200 · Question #266
You are informed that an unprivileged user has executed commands as the superuser. You decide to look at the log file for the su(1) command. The contents in the log file are: SU 12/07 11:50 + pts/6…
The correct answer is B. User gv1123 is suspected of having executed the commands. C. The commands might have been executed on pts/3. See the full explanation below for the reasoning.
Question
You are informed that an unprivileged user has executed commands as the superuser. You decide to look at the log file for the su(1) command. The contents in the log file are:
SU 12/07 11:50 + pts/6 gv1123-root SU 12/07 11:54 - pts/5 fb12-root SU 12/07 11:54 + pts/3 gv1123-root Sun 310-200 Exam SU 12/07 12:03 + pts/1 jjj-gv1123 You know the file has NOT been tampered with. Which two statements are true? (Choose two.)
Options
- AUser fb12 is suspected of having executed the commands.
- BUser gv1123 is suspected of having executed the commands.
- CThe commands might have been executed on pts/3.
- DThe commands might have been executed on pts/1.
- EUser jjj is not a suspect.
How the community answered
(42 responses)- A7% (3)
- B79% (33)
- D12% (5)
- E2% (1)
Community Discussion
No community discussion yet for this question.