System Security →hardMultiple ChoiceObjective-mapped

LPIC-2 System Security Practice Question

Exhibit

Refer to the exhibit.

```
# auditctl -l
-a always,exit -F arch=b64 -S openat -F success=0 -F key=access_denied
-a always,exit -F arch=b64 -S connect -F key=outbound_connect
-w /etc/shadow -p wa -k shadow_changes
-w /etc/ssh/sshd_config -p wa -k sshd_config_change
```

An administrator is reviewing the audit rules on a Linux server. The current rules are shown in the exhibit. The administrator needs to ensure that any failed attempts to open files are logged, while also monitoring for successful outbound connections. Which of the following describes the effect of the current rules?

⚠ Common exam trap

It's easy for candidates to assume `-S connect` without an exit filter only logs failed connections, but it actually logs all connect syscalls, and they may also overlook that `-F exit=-EACCES` explicitly targets failures, not successes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The first rule logs only failed openat calls, and the second rule logs all connect calls.

The first rule uses the `-F exit=-EACCES` filter, which matches only failed `openat` calls (those returning the EACCES error). The second rule uses `-S connect` without an exit filter, so it logs all `connect` syscalls regardless of success or failure. Therefore, option A correctly describes the effect: failed openat calls and all connect calls are logged.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The first rule logs only failed openat calls, and the second rule logs all connect calls.
Why this is correct
The first rule logs failed openat (success=0), the second logs all connect (no success filter).
✗
The first rule logs only successful openat calls, and the second rule logs only failed connect calls.
Why it's wrong here
The first rule uses success=0, which means failed calls; the second rule does not filter by success, so it logs both.
✗
The first rule logs all openat calls, and the second rule logs all connect calls.
Why it's wrong here
The first rule logs only failed openat calls because of success=0.
✗
The first rule logs only failed openat calls, and the second rule logs only failed connect calls.
Why it's wrong here
The second rule does not filter by success, so it logs all connect calls.

Go deeper

LPIC-2 System Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question