Quiz: confinement and audit

One correct answer

You set a rule with auditctl -w …, but it vanished after an auditd restart. How do you make it persistent?

• A Write the rule line to a file in /etc/audit/rules.d and apply augenrules --load.
• B Add the auditctl command to ~/.bashrc.
• C Leave it as is — the rule restores itself.