Consider the following rule file for use with the Basic Audit Reporting Tool (BART).
CHECK all
IGNORE dirmtime
/etc/security
/etc/notices
IGNORE contents
/export/home
IGNORE mtime size contents
/var
CHECK
You are using BART to detect inappropriate changes to the file system.
Identify the two correct statements describing the attributes recorded.
A.
/var/dhcp Attribute: size uid gid mode acl
B.
/etc/hosts Attributes: size uid gid mode acl intime dest
C.
/var/spool/mqueue Attribute: size uid gid mode acl dirmtime
D.
/etc/security/exec_attr Attribute: size uid mode acl mtime devnode
E.
/export/home/kate/.profile Attributes: uid gid mode acl dirmtime
F.
/export/home/rick/.profile Attributes: size uid gid mode acl mtime contents
Explanation:
D: According to line /etc/security
F: According to line /export/home
Not E: According to line IGNORE dirmtime
Note: In default mode, the bart compare command, as shown in the following example, checks all
the files installed on the system, with the exception of modified directory timestamps (dirmtime):
CHECK all
IGNORE dirmtime
Note2: The Basic Audit Reporting Tool (BART) feature of Oracle Solaris enables you to
comprehensively validate systems by performing file-level checks of a system over time. By
creating BART manifests, you can easily and reliably gather information about the components of
the software stack that is installed on deployed systems.
BART is a useful tool for integrity management on one system or on a network of systems.
Reference: Oracle Solaris Administration: Security Services, BART Manifests, Rules Files, and
Reports (Reference)
correct is D and E
F is not correct, because how could bart find out that contents was changed, when you are ignoring this parameter in /export/home
/export/home
IGNORE mtime size contents
IGNORE dirmtime – global
C,E – is not correct
/etc/hosts – not monitored
B – is not correct
/export/home
IGNORE mtime size contents
F – is not correct
Correct answer – A,D
A is not correct because size is ignored in /var
/var has a CHECK (below) so it applies the global rules.
A,D are the correct answers
D,E is correct
A and D
http://docs.oracle.com/cd/E23824_01/html/821-1456/bart-4.html#scrolltoc
A, D
A and D is the correct answer.
AD
A and D. Also, B can be correct if intime will be lnmtime.
B is incorrect because there is no such attribute keyword- intime
The attribute keywords are as follows:
acl
all
contents
dest
devnode
dirmtime
gid
lnmtime
mode
mtime
size
type
uid
The all keyword refers to all file attributes.
Correct A, D