LPIC-2 System Security Practice Question
Exhibit
# aide.conf excerpt /etc/passwd p+i+u+g+s+m+c+sha512 /etc/shadow p+i+u+g+s+m+c+sha512 /etc/group p+i+u+g+s+m+c+sha512 /etc/sudoers p+i+u+g+s+m+c+sha512 /var/log p+sha512
Refer to the exhibit. An administrator runs aide --check and receives a warning that /var/log/syslog has changed. Why is this expected?
⚠ Common exam trap
It's easy for candidates to assume monitoring a directory automatically includes its contents, but AIDE requires explicit recursive flags (like 'R' or 'p+sha512') to track files within subdirectories.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The /var/log entry monitors the directory itself, not its contents; changes inside the directory are not tracked.
The AIDE configuration for /var/log typically monitors the directory entry itself (its metadata like permissions and ownership) rather than recursively tracking changes to files within it. When /var/log/syslog changes, AIDE does not detect it because the directory's inode metadata remains unchanged; only the file's content and metadata are altered. This is a common default behavior unless the configuration explicitly uses the 'R' or 'p+sha512' flags to recurse into subdirectories and hash file contents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SHA512 hash for /var/log is incorrect.
Why it's wrong here
The hash is computed and compared; a change in syslog would not affect the hash of /var/log directory.
- ✓
The /var/log entry monitors the directory itself, not its contents; changes inside the directory are not tracked.
Why this is correct
Only the directory's attributes and hash are checked, not files within.
- ✗
The /var/log entry includes permissions but not content hashes, so changes in file content are not monitored.
Why it's wrong here
It includes sha512 but only for the directory itself, not its contents.
- ✗
The +c flag checks for changes in the file's ctime, so syslog changes are detected.
Why it's wrong here
The +c flag checks ctime for files, but the /var/log entry does not include +c for files; it's for the directory.
Go deeper
Related to this question
About these practice questions
One of 507 original LPIC-2 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.