1z0-106 Exam Dumps : Oracle Linux 8 Advanced System Administration

Option A (Correct):In rsyslog, afilteris used to determine which messages should be selected for further processing. Filters can be based on different criteria such as facility, severity, or specific message content.

Option B (Correct):Anactionin rsyslog defines what to do with messages that match a filter. Actions can include writing to a log file, sending to a remote server, running a script, etc.

Option C (Incorrect):A parser is not typically a component for creating a new rsyslog rule; it is involved in interpreting message formats.

Option D (Incorrect):A module in rsyslog is a loadable component that provides additional capabilities, such as support for different protocols or output formats. It is not a direct component of a logging rule.

Option E (Incorrect):Security policy is unrelated to the basic components used for defining rsyslog rules.

Oracle Linux Reference:Refer to:

Oracle® Linux 8: Configuring Rsyslog

Understanding the Automounter Configuration:

/etc/auto.master:

/net -hosts

/- auto.direct ro

The /- auto.direct ro line indicates:

Mount Point Prefix:/ (direct mounts)

Map File:auto.direct

Global Mount Options:ro (read-only)

/etc/auto.direct:

/nfs1 host01:/export/share1

/nfs2 -sync host01:/export/share2

/nfs3 host02:/export/share3

/nfs1 and /nfs3:

No specific mount options in auto.direct.

Inherit the ro option from /etc/auto.master.

/nfs2:

Specifies -sync option in auto.direct.

Inherits ro from /etc/auto.master.

Mount options are ro,sync.

Mount Options Resolution:

Global Options (ro) apply to all entries unless overridden.

Per-Entry Options in auto.direct override or supplement global options.

Effective Mount Options:

/nfs1:

ro (from /etc/auto.master)

Default NFS options (async unless sync is specified)

/nfs2:

ro (from /etc/auto.master)

sync (specified in auto.direct)

/nfs3:

ro (from /etc/auto.master)

Default NFS options (async)

Oracle Linux Reference:

Oracle® Linux 8: Configuring File Systems-Automounter Configuration:

"Options specified in the master map apply to all entries in the map unless overridden by entries in the map itself."

NFS Default Options:

"By default, NFS mounts are asynchronous (async) unless the sync option is specified."

Conclusion:

/nfs1 and /nfs3:Mounted with ro,async.

/nfs2:Mounted with ro,sync.

Correct Option:A

Option C (Correct):The-k passpart of theauditctlcommand defines a keyword (pass) for the audit rule. This keyword helps in filtering and searching logs in the audit trail.

Option D (Correct):The-w /etc/passwd -p wpart of the command sets up a watch on the/etc/passwdfile for write (w) operations. This audit rule will generate a log entry every time there is a write operation to/etc/passwd.

Option A (Incorrect):This command does not write directly to/etc/audit/rules.d/audit.rules; it defines a rule in memory that could be saved to this file later.

Option B (Incorrect):The rule only logs write (w) operations; it does not log read operations.

Option E (Incorrect):The command does not directly cause a write to/etc/audit/audit.rules.

Oracle Linux Reference:Refer to:

Oracle® Linux 8: Auditing and System Logs

man auditctlfor details on audit rules and options.