PrepAway - Latest Free Exam Questions & Answers

What happened?

Refer to the Exhibit. You notice that the following line has been added to /etc/passwd: admin:x:0:0:Administrator:/:/bin/sh

To figure out when this file was changed, you look at the file creation date, but based on that information, the file hasn’t been touched since the system was installed. You look at the audit logs for this system and find the three records that are shown in the Exhibit. What happened?

PrepAway - Latest Free Exam Questions & Answers

A.
User root changed /etc/passwd and set the date of that file to 05/05/05.

B.
User root changed /etc/passwd after setting the system date to 05/05/05.

C.
User foo used su to become root, changed /etc/passwd, and set the date of that file to 05/05/05.

D.
User foo used su to become root and changed /etc/passwd after setting the system date to 05/05/05.


Leave a Reply