702-100 BSD Specialist Practice Questions

The crontab format consists of five time-and-date fields followed by the command. The fields are: minute (0-59), hour (0-23), day of month (1-31), month (1-12), and day of week (0-7, where both 0 and 7 represent Sunday). Therefore, 15 3 * * 7 correctly specifies 15 minutes past the 3rd hour, on any day of the month, in any month, but only when the day of the week is Sunday.

This is the correct and most robust vi substitute command. The % specifies the range as the entire file. s is the substitute command. The . characters in the IP address must be escaped with a backslash (\.) to be treated as literal periods rather than regex wildcards. The /g flag at the end ensures that all occurrences on each line are replaced, not just the first one.

In the FreeBSD rc system, services are enabled by adding a line to /etc/rc.conf with the format service_name_enable="YES". The service name is derived from the script's filename in /usr/local/etc/rc.d/.

This entry includes several critical security options. noexec prevents the execution of any binaries from this filesystem. nodev prevents the interpretation of character or block special devices. nosuid prevents set-user-identifier or set-group-identifier bits from taking effect. This combination is a standard hardening practice for world-writable directories like /tmp.

A process in the 'Z' state is a 'zombie' or 'defunct' process. This means the process has completed execution, but it still has an entry in the process table. This entry remains until the parent process reads the child's exit status by calling the wait() system call. Zombie processes consume a negligible amount of system resources, but a large number of them can indicate a bug in the parent application.

Setting kern.securelevel to 2 provides all the protections of level 1 (such as immutable file flags and preventing writing to raw disk devices) and additionally prevents the loading or unloading of kernel modules. This directly meets the requirement of preventing runtime modifications to kernel modules.

The lastcomm utility, when process accounting is enabled, provides detailed information about previously executed commands from the accounting file. Specifying the username rogueuser filters the output to show only commands executed by that user, which is exactly what is needed for the forensic analysis. last shows login sessions, ac shows connect time, and sa summarizes accounting information, but lastcomm lists the actual commands.

In OpenBSD's /etc/resolv.conf, the lookup directive specifies the sources and order for name resolution. By setting it to lookup file, the system is instructed to ONLY use the /etc/hosts file for lookups and to not query any DNS servers (bind). This effectively blocks external DNS queries and meets the security requirement.

In the FreeBSD ports system, the make install command will automatically fetch, extract, patch, configure, build, and install the software. Crucially, it also handles dependencies recursively. If a dependency is not found, the ports framework will descend into that dependency's port directory and build and install it first. The install-recursive target is an alias that makes this behavior explicit, but make install is the standard, idiomatic way to achieve this.

This command correctly uses a standard Unix pipeline. tar -cf - /etc creates an archive of /etc and writes it to standard output (the - filename). The pipe | redirects this standard output to the standard input of the xz command, which compresses the data and writes it to its standard output. Finally, the > redirects the compressed output stream to the specified file /backups/etc.tar.xz. While BSD tar often has integrated compression flags (-J for xz), this pipeline method is the most portable and fundamental way to accomplish the task.