LPIC-2 System Security Practice Question
A company runs a critical database server on a Linux system. The server is subject to a strict compliance policy that requires all commands executed by the database administrator (user 'dbadmin') to be logged. Additionally, any attempt to change the system time must be logged regardless of the user. The administrator has configured auditd and added the following rules: -w /usr/bin -p x -k binary_exec, -a always,exit -F arch=b64 -S adjtimex -F key=time_change. However, during a compliance audit, it is discovered that not all commands executed by dbadmin are being logged. Which of the following is the most likely cause?
⚠ Common exam trap
Many exam-takers assume `-w /usr/bin -p x` logs all command executions, but it only monitors file access events on that specific directory, missing commands from other paths or shell internals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The rule -w /usr/bin -p x only monitors executables in /usr/bin, not commands in other directories or built-in shell commands.
The rule `-w /usr/bin -p x` only monitors execution of binaries located in `/usr/bin`. Commands executed from other directories (e.g., `/usr/local/bin`, `/opt`, or built-in shell commands like `cd` or `alias`) are not captured. Additionally, the rule does not log commands run via absolute paths outside `/usr/bin` or scripts executed by interpreters, leaving gaps in the audit trail for dbadmin's activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The auditd logs are being overwritten because the audit log file size is too small.
Why it's wrong here
While log rotation could cause loss, it does not explain why commands are not being logged initially.
- ✗
The auditd service is not running because the kernel was not compiled with audit support.
Why it's wrong here
Most distribution kernels include audit support; the service is running if rules are applied.
- ✗
The adjtimex syscall rule is incorrect and prevents other rules from being processed.
Why it's wrong here
The rule syntax is valid and does not interfere with other rules.
- ✓
The rule -w /usr/bin -p x only monitors executables in /usr/bin, not commands in other directories or built-in shell commands.
Why this is correct
The rule only watches /usr/bin; dbadmin may run commands from elsewhere.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.