An organization is experiencing security incidents in which a systems administrator is creating unauthorized user accounts A security analyst has created a script to snapshot the system configuration each day. Following iss one of the scripts:

cat /etc/passwd > daily_$(date +"%m_%d_%Y") This script has been running successfully every day. Which of the following commands would provide the analyst with additional useful information relevant to the above script?

Question

An organization is experiencing security incidents in which a systems administrator is creating unauthorized user accounts A security analyst has created a script to snapshot the system configuration each day. Following iss one of the scripts:

cat /etc/passwd > daily_$(date +"%m_%d_%Y") This script has been running successfully every day. Which of the following commands would provide the analyst with additional useful information relevant to the above script?

Accepted Answer

A. diff daily_11_03_2019 daily_11_04_2019 The `diff` command compares two files line by line and highlights their differences, which is ideal for identifying new or removed user accounts between two daily snapshots of the `/etc/passwd` file.

Answer

B. ps -ef | grep admin > daily_process_$(date +%m_%d_%Y") The `ps -ef | grep admin` command monitors running processes at a given moment, not historical changes to user accounts within `/etc/passwd`.

Answer

C. more /etc/passwd > daily_$(date +%m_%d_%Y_%H:%M:%S") The `more /etc/passwd` command displays the current password file, and redirecting it to a new file only creates another snapshot, it does not perform a comparison.

Answer

D. la -lai /usr/sbin > daily_applications The `ls -lai /usr/sbin` command lists directory contents and attributes, which is unrelated to tracking user account changes in `/etc/passwd`.

An organization is experiencing security incidents in which a systems administrator is creating unauthorized user accounts A security analyst has created a script to snapshot the system configuration

Question

Options

How the community answered

Why each option

Topics

Community Discussion