Exam 702 BSD Specialist Free Sample Questions

Setting kern.securelevel to 2 provides all the protections of level 1 (such as immutable file flags and preventing writing to raw disk devices) and additionally prevents the loading or unloading of kernel modules. This directly meets the requirement of preventing runtime modifications to kernel modules.

The lastcomm utility, when process accounting is enabled, provides detailed information about previously executed commands from the accounting file. Specifying the username rogueuser filters the output to show only commands executed by that user, which is exactly what is needed for the forensic analysis. last shows login sessions, ac shows connect time, and sa summarizes accounting information, but lastcomm lists the actual commands.

In OpenBSD's /etc/resolv.conf, the lookup directive specifies the sources and order for name resolution. By setting it to lookup file, the system is instructed to ONLY use the /etc/hosts file for lookups and to not query any DNS servers (bind). This effectively blocks external DNS queries and meets the security requirement.

In the FreeBSD ports system, the make install command will automatically fetch, extract, patch, configure, build, and install the software. Crucially, it also handles dependencies recursively. If a dependency is not found, the ports framework will descend into that dependency's port directory and build and install it first. The install-recursive target is an alias that makes this behavior explicit, but make install is the standard, idiomatic way to achieve this.

This command correctly uses a standard Unix pipeline. tar -cf - /etc creates an archive of /etc and writes it to standard output (the - filename). The pipe | redirects this standard output to the standard input of the xz command, which compresses the data and writes it to its standard output. Finally, the > redirects the compressed output stream to the specified file /backups/etc.tar.xz. While BSD tar often has integrated compression flags (-J for xz), this pipeline method is the most portable and fundamental way to accomplish the task.

uname -a is a standard POSIX command available on all three BSD variants. It prints all available system information, including the operating system name, hostname, release level, version, and machine hardware name, making it a reliable first step for identification.

The sysctl utility is fundamental to all BSDs for querying kernel state. The kern.version MIB specifically contains a detailed string with the OS name, release, and build information. Using sysctl -n kern.version provides this data in a clean, scriptable format across FreeBSD, OpenBSD, and NetBSD.

This command correctly combines find and grep. find /var/log -mtime -1 -type f locates all regular files (-type f) in /var/log modified within the last 24 hours (-mtime -1). The -exec grep -il "error" {} + part is the most efficient way to process the results. It executes grep with -i (case-insensitive) and -l (list filenames only), passing multiple filenames found by find ({}) at once (+) to a single grep command, which is much more efficient than executing grep for every single file.

The du command estimates file space usage. The -s flag provides a summary for each argument, and -h makes the output human-readable (e.g., KB, MB, GB). The glob /* expands to all files and directories directly under the root /, so du -sh /* will calculate and display the total size of each top-level directory individually, allowing the administrator to quickly identify the largest consumers of space.

True. Since OpenBSD 6.0, the pkg_add utility is configured by default to use https://cdn.openbsd.org for fetching packages. This simplifies the initial setup process as administrators no longer need to manually edit /etc/installurl to point to a suitable mirror.

The standard configuration file for the ntpd daemon on NetBSD (and most other Unix-like systems, including FreeBSD) is /etc/ntp.conf. This file is used to specify the upstream time servers, restrict access, and configure other operational parameters of the NTP daemon.