Exam CS0-002 topic 1 question 123 discussion

B is non-reportable. C is the correct answer

The provided line "su vi syslog.conf failed" indicates an unsuccessful attempt to gain elevated privileges and edit the system log file on a server named "financeserver" by a user named "joe". This event suggests a potential security concern, as a regular user attempted to gain administrator privileges and modify a critical system file. It's important to investigate this event further to understand the context and potential motivations behind the attempt.

Answer has to be C. "SU" meaning switch user to the root account which is a succeful logon with admin privilege .

su switches permanently

Sudo is the command for elevated admin privileges and C doesn't have this command and was successful.

The event that is the highest reporting priority is C. According to the organization's reporting priorities, a successful administrator login is a high priority, and a failed administrator login is a medium priority. In this log message, the user is attempting to log in to the administrator account using the "su" command, which suggests that the user is attempting to gain elevated privileges. Therefore, this event is a failed administrator login, which is a medium reporting priority. In comparison, the other log messages in the choices provided involve the use of the "sudo" command, which indicates that the user is attempting to temporarily escalate permissions rather than logging in to the administrator account. As such, these events would not be considered administrator login events and would not be considered high or medium reporting priorities. Instead, they would be considered temporary elevated permissions events, which have a low or non-reportable reporting priority according to the organization's reporting priorities.

This is a tricky question. However, the main difference between the two is that su requires the password of the target account, while sudo requires the password of the current user. So, I would go with C.

Definitely C

C indicates root access and using root priveleges