An Administrator Thinks the UNIX Systems May Be Compromised, but a Review

question 187

Multiple Choice

An administrator thinks the UNIX systems may be compromised, but a review of system log files provides no useful information. After discussing the situation with the security team, the administrator suspects that the attacker may be altering the log files and removing evidence of intrusion activity. Which of the following actions will help detect attacker attempts to further alter log files?

• A) Enable verbose system logging
• B) Change the permissions on the user's home directory
• C) Implement remote syslog
• D) Set the bash_history log file to "read only"

---

Definitions:

Arbitration Act

Legislation that provides a legal framework for arbitration, a form of alternative dispute resolution outside of courts.

Mini-trial

A voluntary, private, informal dispute resolution process where each party to a dispute presents a summarized version of its case to a panel, often as a prelude to other negotiations.

Binding Mediation

A form of ADR in which a mediator attempts to facilitate agreement between the parties but then issues a legally binding decision if no agreement is reached.

Early Neutral

An alternative dispute resolution process where neutral evaluation is provided by an expert early in the case to help parties reach a settlement.