▸case-07 We need to convert our parsed file integrity check results into a structured, machine-readable format for ingestion by SIEM tools. Someone suggested saving the output as CSV or plain text. What structured format should be generated for these report files? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 I am authoring automated helper scripts to parse AIDE execution logs and generate structured compliance outputs on Linux servers. What language and minimum version runtime should be targeted for these scripts? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 Where on a standard Debian or Red Hat Linux filesystem does AIDE write its newly generated baseline database file before it is renamed or moved for operational checks? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 When running host integrity scans across system directories such as /etc, /sbin, and /boot, a developer suggested executing the tool under an unprivileged user like 'nobody' for isolation. What access privilege is required to perform system-wide file integrity checks? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 We want to schedule automated periodic integrity checks on our Linux servers. A junior admin drafted a cron job that runs 'aide --init' every night at 2 AM. What command should the automated cron task execute to detect file modifications? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 I am creating rules for AIDE to monitor kernel and bootloader files against unauthorized modification. A developer recommended setting the rule path to /var/boot. Which top-level directory must be monitored in the configuration to cover boot files? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 I am setting up osquery across our Linux servers to monitor file changes using the file_integrity_monitoring table. How do I configure the osquery.conf file_paths pack to track modifications under /etc? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 After running the initial database creation step in AIDE, running a check fails with an error stating that the baseline database is missing. What file management action must be taken immediately after database initialization before checks can run? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 I am writing a file integrity monitoring rules file for a Linux host to protect system files against unauthorized tampering. A colleague suggested only monitoring /var/log and /home. What critical system directories containing core binaries and system configurations should be monitored instead? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 I am automating Linux security deployment and need to place the primary rule definitions file for AIDE in its expected system location. A guide suggested naming it /etc/fim.conf. What is the standard configuration filename expected by AIDE? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 I need to configure Tripwire file integrity monitoring on a RHEL server, generate the site key, and sign the policy file using twadmin. How should I set up twpol.txt and initialize the Tripwire database? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 I am drafting an AIDE configuration file to protect administrative system binaries. A sysadmin claims /sbin can be omitted because /usr/local/bin covers administrative utilities. Which directory containing system administration binaries must be included? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 I am configuring a script to run AIDE checks and pass the summary to a report generator. The initial script draft redirects standard output to /dev/null and captures standard error. From which output stream should file change results be captured? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 When defining file integrity monitoring rules for core Linux system executables, someone suggested only monitoring /usr/share. Which root directory containing standard system binaries (like ls, cp, and bash) must be monitored? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 I need to initialize the baseline file integrity database using AIDE on an Ubuntu server. A technician recommended running 'aide --create-db' or 'aide --build'. What is the exact CLI command to generate the initial database? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 I want to perform a manual integrity check comparing current Linux system files against the stored baseline database using AIDE. A team member suggested running 'aide --verify'. What is the correct CLI flag to perform this integrity check? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 I am writing a log parsing script to process execution reports from AIDE checks. A teammate suggested only filtering for modified file permissions. What three core file status categories must be extracted from the output to report all filesystem changes? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 When generating structured file integrity reports for security auditing, a developer proposed sorting changed files purely by modification timestamp. What security assessment attribute should be assigned to detected changes in the final summary report? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 We are setting up file integrity rules for host operating system security. An engineer proposed excluding /etc because configuration files change frequently during standard maintenance. What directory must be included to monitor system configurations? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 I am designing a script that consumes raw check results and outputs an executive compliance report. A teammate says the report only needs to show total scanned file count. What file modification details must be presented alongside severity levels? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 I am writing a shell script to prepare a fresh Ubuntu or CentOS host for file integrity monitoring before initializing baseline databases. What package name must be installed using the distribution package manager? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 I want to set up real-time kernel file access auditing using auditd to log whenever a process opens /etc/shadow in real time. How do I configure auditctl rules for open syscall interception? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |