Prev Question
Next Question

Refer to the Exhibit.

59d5dddaa0b3a - What happened?

You notice that the following line has been added to /etc/passwd:

admin:x:0:0:Administrator:/:/bin/sh

You try to determine when this file was changed. You look at the file creation date, but based on that information, the file has not been touched since the system was installed. You look at the BSM logs for this system and find the three records that are shown in the exhibit.

What happened?

A.
User root changed /etc/passwd and set the date of that file to 06/05/02.

B.
User root changed /etc/passwd after setting the system date to 06/05/02.

C.
User foo used su to become root, changed /etc/passwd, and set the date of that file to 06/05/02.

D.
User foo used su to become root and changed /etc/passwd after setting the system date to 06/05/02.

Prev Question
Next Question

Leave a Reply

Your email address will not be published. Required fields are marked *