Examine this command and output:
# mdadm --detail /dev/md0
/dev/md0:
Version: 1.2
Creation Time: Tue Oct 27 16:53:38 2020
Raid Level: raid5
Array Size: 207872 (203.03 MiB 212.86 MB)
Used Dev Size: 103936 (101.52 MiB 106.43 MB)
Raid Devices: 3
Total Devices: 3
Persistence : Superblock is persistent
Update Time: Tue Oct 27 16:53:38 2020
State: clean, degraded, recovering
Active Devices: 2
Working Devices: 3
Failed Devices: 0
Spare Devices: 1
Layout: left-symmetric
Chunk Size: 512K
Rebuild Status: 60% complete
Name: ol8.example.com:0 (local to host ol8.example.com)
UUID: 70f8bd2f:0505d92d:750a781e:c224508d
Events: 66
Number Major Minor RaidDevice State
0 8 49 0 active sync /dev/sdd1
1 8 65 1 active sync /dev/sde1
3 8 81 2 spare rebuilding /dev/sdf1
Which two are true?

• A. The RAID set read and write performance is currently sub-optimal.
• B. A new RAID device was just added to replace a failed one.
• C. A RAID device failed and has returned to normal operating status.
• D. An extra device was added to this RAID set to increase its size.
• E. Only write performance is currently sub-optimal on this RAID set.

Which two statements are true about the Linux Auditing System?

• A. Auditing modes include permissive, enforcing, and disabled.
• B. Auditing can scan for Common Vulnerabilities and Exposures (CVE) and automatically apply needed patches to a system.
• C. Auditing includes security policies, each of which includes security rules, or checks, which are checked when you run a security scan.
• D. Auditing system call rules can affect system performance depending on the amount of information that is logged.
• E. Auditing rules can log administrator attempts to access user home directories.

Examine this command and output:
$ ftp host01.example.com
Connected to host01.example.com (192.168.40.131).
220 (vsFTPd 3.0.2)
Name (host01.example.com:oracle):
After entering a carriage return, this error message is displayed:
530 Permission denied
Login Failed
ftp>
Why is the oracle user denied access to the FTP server on host01.example.com?

• A. LOCAL_ENABLE is set to NO in /etc/vsftpd/vsftpd.conf.
• B. The oracle user does not exist on host01.example.com.
• C. The oracle user is listed in /etc/vsftpd/user_list and USERLIST_ENABLE is set to YES in /etc/vsftpd
  /vsftpd.conf.
• D. The oracle user is listed in /etc/vsftpd/user_list and USERLIST_ENABLE is set to NO in /etc/vsftpd
  /vsftpd.conf.
• E. The oracle user is listed in /etc/vsftpd/ftpusers.

Examine this segment of /etc/rsyslog.conf:
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg :omusrmsg:*
Now examine this log output:
less
Nov 9 20:32:16 server02 sudo[4570]: pam_unix(sudo:session): session opened for user opc (uid=0) Nov 9 20:32:17 server02 sudo[4570]: pam_unix(sudo:session): session closed Nov 9 20:32:24 server02 unix_chkpwd[4661]: password check failed for user Nov 9 20:32:24 server02 su[4581]: pam_unix(su:auth): authentication failed; logname= uid=1000 euid=0 tty=pts/0 ruser=opc rhost= user=root Which setting enabled the reporting of this log file output?

• A. cron.* /var/log/cron
• B. authpriv.* /var/log/auth
• C. #kern.* /dev/sssd/sssd.log
• D. *.emerg *
• E. *.info;mail.none;authpriv.none;cron.none /var/log/messages

Which two directories store PAM authentication modules?

• A. /var/lib
• B. /lib/security
• C. /etc/pam.d
• D. /usr/lib
• E. /lib64/security