Identify the two correct statements describing the attributes recorded.

Consider the following rule file for use with the Basic Audit Reporting Tool (BART).
CHECK all
IGNORE dirmtime
/etc/security
/etc/notices
IGNORE contents
/export/home
IGNORE mtime size contents
/var
CHECK
You are using BART to detect inappropriate changes to the file system.
Identify the two correct statements describing the attributes recorded.

Consider the following rule file for use with the Basic Audit Reporting Tool (BART).
CHECK all
IGNORE dirmtime
/etc/security
/etc/notices
IGNORE contents
/export/home
IGNORE mtime size contents
/var
CHECK
You are using BART to detect inappropriate changes to the file system.
Identify the two correct statements describing the attributes recorded.

A.
/var/dhcp Attribute: size uid gid mode acl

B.
/etc/hosts Attributes: size uid gid mode acl intime dest

C.
/var/spool/mqueue Attribute: size uid gid mode acl dirmtime

D.
/etc/security/exec_attr Attribute: size uid mode acl mtime devnode

E.
/export/home/kate/.profile Attributes: uid gid mode acl dirmtime

F.
/export/home/rick/.profile Attributes: size uid gid mode acl mtime contents

Explanation:
D: According to line /etc/security
F: According to line /export/home
Not E: According to line IGNORE dirmtime
Note: In default mode, the bart compare command, as shown in the following example, checks all
the files installed on the system, with the exception of modified directory timestamps (dirmtime):
CHECK all
IGNORE dirmtime
Note2: The Basic Audit Reporting Tool (BART) feature of Oracle Solaris enables you to
comprehensively validate systems by performing file-level checks of a system over time. By
creating BART manifests, you can easily and reliably gather information about the components of
the software stack that is installed on deployed systems.
BART is a useful tool for integrity management on one system or on a network of systems.
Reference: Oracle Solaris Administration: Security Services, BART Manifests, Rules Files, and
Reports (Reference)



Leave a Reply 12

Your email address will not be published. Required fields are marked *


johny

johny

correct is D and E

F is not correct, because how could bart find out that contents was changed, when you are ignoring this parameter in /export/home

/export/home
IGNORE mtime size contents

bugogo

bugogo

IGNORE dirmtime – global
C,E – is not correct

/etc/hosts – not monitored
B – is not correct

/export/home
IGNORE mtime size contents
F – is not correct

Correct answer – A,D

buckss

buckss

A is not correct because size is ignored in /var

ragnor

ragnor

/var has a CHECK (below) so it applies the global rules.
A,D are the correct answers

xxx

xxx

D,E is correct

Saeed

Saeed

A and D is the correct answer.

Marjan

Marjan

A and D. Also, B can be correct if intime will be lnmtime.

gray

gray

B is incorrect because there is no such attribute keyword- intime

The attribute keywords are as follows:
acl
all
contents
dest
devnode
dirmtime
gid
lnmtime
mode
mtime
size
type
uid
The all keyword refers to all file attributes.