Refer to the Exhibit. A system administrator needs to minimize a freshly installed Solaris system. After verifying that the correct metacluster is installed, the administrator tries to further minimize the number of installed set-uid binaries. After inspection, the administrator finds a number of printing related binaries, reviewing the relevant contents of the /var/sadm/install/contents file. What is the correct command to remove these set-uid binaries in a supported way?

Refer to the Exhibit. One step in the hardening process is to examine the user accounts and determine what steps need to be taken to tighten access to the system. As part of this process, an administrator executes the command passwd -sa. Which three statements are true about the configured accounts? (Choose three.)

A company has activated auditing on all of their systems. The default destination directory for the audit trail is /var/audit on each system. In the past few weeks, they had problems with one of the systems acting as a print server. A user sent a large print job, which caused /var on the print server to become full. As a result, auditing was no longer working. They changed the /etc/security/audit_control file to include a second destination directory (using the dir: keyword). When will the audit subsystem switch from the first directory to the second configured directory?

Your organization wants to deploy a third party network monitoring tool. A requirement for deploying this tool is that it runs with as few privileges as possible. The tool needs access to /dev/ip which is listed as: crw-rw-rw- 1 root sys 3, 0 Jun 5 09:11 /dev/ip When the tool is run as the unprivileged user monitor, it fails to open /dev/ip. How do you find out what privileges are needed?

Refer to the Exhibit. You notice that the following line has been added to /etc/passwd: admin:x:0:0:Administrator:/:/bin/sh To figure out when this file was changed, you look at the file creation date, but based on that information, the file hasn’t been touched since the system was installed. You look at the audit logs for this system and find the three records that are shown in the Exhibit. What happened?

You have a legacy non-privilege aware program which runs as root to be able to open a privileged port. Now that you have upgraded the system to Solaris 10 you want to take advantage of privileges. You can either run the program as root with fewer privileges, or you can run the program as daemon with additional privileges. Why is it preferred to run the program as daemon with added privileges?