Classifying sensitive authentication logs | LinuC Level 1 102 Exam original practice question

1.09.2Basic

Choose the syslog facility for sensitive authentication and authorization records.

Which facility is appropriate?

Hint 1: Focus on journal storage

Separate persistent storage, runtime-only storage, automatic selection, and disabled storage behavior.

Hint 2: Key terms

Review the short definitions of journal storage, persistence, rotation, and runtime behavior involved.

authpriv: The facility for sensitive authentication and authorization messages.
kern: The facility used for messages generated by the kernel.
mail: The facility used for messages from mail systems.
local0: One of the facilities reserved for local applications.
Syslog facility: The syslog field that classifies where a message originated.

Detailed explanation

Correctauthpriv

Correct. authpriv is for sensitive authentication-related messages.

Incorrectkern

Incorrect. kern is for kernel messages.

Incorrectmail

Incorrect. mail is for mail-system messages.

Incorrectlocal0

Incorrect. local0 is a locally assigned facility, not specifically authentication.

An example you can run in a temporary verification environment.

printf '%s
' authpriv kern mail local0

4つのfacility名

Foundation review

Metadata that classifies a message source and its severity.

Whether systemd journal data survives a reboot and where it is stored.

A process that retains, renames, compresses, or removes log generations.

Question IDKL-102-1085

Environmentprintf / 設定変更なし

Last technical review2026-08-13

More practice in this area