In which of the following is the file audit events are written when auditing is enabled?

A.
File system ACL

B.
Biometric device

C.
Network Access Control List

D.
Security event log

Explanation:
The various enabled file auditing events are documented and written in the security event log

Answer A is incorrect. A filesystem ACL is deifned as a data structure (usually a table) that contains
entries specifying individual user or group rights to specific system objects like programs, processes,
or files. These entries are known as access control entries (ACEs) in the Microsoft Windows NT,
OpenVMS, Unix-like, and Mac OS X operating systems and each of the accessible object contains an
identifier to its ACL. The permissions are used to find the particular access rights, such as whether a
user is able to read from, write to, or execute an object.

Answer C is incorrect. Network Access Control List is defined as a set of rules applied to port
numbers or network daemon names that are available on a host or other layer 3, and attached with
a list of hosts and networks permitted to use the various defined service. The individual servers and
routers can have network ACLs. It is used to control both inbound and outbound traffic as firewall
does.

Answer B is incorrect. A biometric device is used for uniquely recognizing humans based upon one
or more intrinsic, physical, or behavioral traits. Biometrics is used as a form of identity access
management and access control. It is also used to identify individuals in groups that are under
surveillance. Biometric characteristics can be divided into two main classes:

1.Physiological: These devices are related to the shape of the body. These are not limited to the
fingerprint, face recognition, DNA, hand and palm geometry, and iris recognition, which has largely
replaced the retina and odor/scent.
2.Behavioral: These are related to the behavior of a person. They are not limited to the typing
rhythm, gait, and voice.