Identify the two security features incorporated in the Oracle Solaris 11 Cryptographic Framework.
The framework enables providers of cryptographic services to have their services used by many
consumers in the Oracle Solaris operating system. Another name for providers is plugins. The
framework allows three types of plugins:
* User-level plugins - Shared objects that provide services by using PKCS #11 libraries, such as
* Kernel-level plugins - Kernel modules that provide implementations of cryptographic algorithms in
software, such as AES.
Many of the algorithms in the framework are optimized for x86 with the SSE2 instruction set and for
* Hardware plugins - Device drivers and their associated hardware accelerators. The Niagara chips,
the ncp and n2cp device drivers, are one example. A hardware accelerator offloads expensive
cryptographic functions from the operating system. The Sun Crypto Accelerator 6000 board is one
Reference: Oracle Solaris Cryptographic Framework
Review the ZFS dataset output that is displayed on your system:
Which four correctly describe the output?
A, C, E, G
A: + Indicates the file/directory was added in the later dataset
C: R Indicates the file/directory was renamed in the later dataset
E: - Indicates the file/directory was removed in the later dataset
G: M Indicates the file/directory was modified in the later dataset
Note: Identifying ZFS Snapshot Differences (zfs diff)
You can determine ZFS snapshot differences by using the zfs diff command.
The following table summarizes the file or directory changes that are identified by the zfs diff
File or Directory Change Identifier
* File or directory is modified or file or directory link changed
* File or directory is present in the older snapshot but not in the newer snapshot
* File or directory is present in the newer snapshot but not in the older snapshot
* File or directory is renamed
Which five statements describe options available for installing the Oracle Solaris 11operating system
using the installation media?
A: If the network is setup to perform automated installations, you can perform a text installation over
the network by setting up an install service on the network and selecting a text installation when the
client system boots.
B: After a fresh install of Solaris 11 express, only the console mode is activated.
To add Gnome, simply do :
$ sudo pkg install slim_install
This will install additional packages that are not installed by default.
D: The text installer advantages over the GUI installer include:
* In addition to modifying partitions, the text installer enables you to create and modify VTOC slices
within the Solaris partition.
F: How do I upgrade my Solaris 10 or lower systems to Solaris 11?
Unfortunately, you CAN'T. There is no direct upgrade installer or other tool that will allow you to
upgrade from earlier releases of Solaris to Solaris 11. This is primarily due to the vast changes in the
packaging mechanism in Solaris 10.
E: Both installers can be used to install Oracle Solaris on the x86 platform. The text installer can also
be used to install Oracle Solaris on the SPARC platform.
G: Both installers enable you to select, create, or modify disk partitions during an installation.
H: Both installers can be used to install Oracle Solaris on the x86 platform. The text installer can also
be used to install Oracle Solaris on the SPARC platform.
Reference: Oracle Solaris 11 Information Library, Comparing Installation Options
When setting up Automated Installer (AI) clients, an interactive tool can be used to generate a
custom system configuration profile. The profile will specify the time zone, data and time, user and
root accounts, and name services used for an AI client installation. This interactive tool will prompt
you to enter the client information and an SC profile (XML) will be created.
Which interactive tool can be used to generate this question configuration?
Use the installadm set-criteria command to update the client criteria associated with an AI manifest
that you already added to a service using installadm add-manifest.
Use the installadm add-manifest command to add a custom AI manifest to an install service.
The value of manifest is a full path and file name with .xml extension. The manifest file contains an AI
manifest (installation instructions). The manifest file can also reference or embed an SC manifest
(system configuration instructions).
A: The sys-unconfig command is used to restore a system's configuration to
an "as-manufactured" state, ready to be reconfigured again.
C: You can use the sysconfig create-profile command to create a new system configuration profile.
Thesysconfigcommand affects all functional groupings in the Solaris instance.
D: Use the installadm create-profile command to add a system configuration profile to an install
service. The create-profile subcommand validates profiles before adding them to the install service.
Specify criteria so that appropriate clients select that configuration profile. If no criteria are specified,
all clients use this profile.
Review the zonestat command:
zonestate - q physical - memory -R high -z -p -p zones 10 24h 60m
Select the option that correctly describes the information that is displayed by this command.
* (Not A, B, C): interval (here 10 seconds): Specifies the length in seconds to pause between each
* duration (here 24 h)
* -R report[,report] (here high)
Print a summary report.
high Print a summary report detailing the highest usage of each resource and zone during any
interval of thezonestatutility invocation.
Note: The zonestat utility reports on the cpu, memory, and resource control utilization of the
currently running zones. Each zone's utilization is reported both as a percentage of system resources
and the zone's configured limits.
The zonestat utility prints a series of interval reports at the specified interval. It optionally also prints
one or more summary reports at a specified interval.
The default output is a summary of cpu, physical, and virtual memory utilization. The -r option can be
used to choose detailed output for specific resources.
You are configuring NFS on a server. Select the two statements that are true.
A: ZFS can automatically share file systems by setting the sharenfs property. Using this property, you
do not have to modify the /etc/dfs/dfstab file when a new file system is shared. The sharenfs
property is a comma-separated list of options to pass to the share command. The value on is an alias
for the default share options, which provides read/write permissions to anyone. The value off
indicates that the file system is not managed by ZFS and can be shared through traditional means,
such as the /etc/dfs/dfstab file. All file systems whose sharenfs property is not off are shared during
D: A share can define options for both NFS and SMB sharing.
You have already generated a 256-bit AES raw key and named the keystore file /mykey. You need to
use the key to create an encrypted file system.
Which command should you use to create a ZFS encrypted file system named pool1/encrypt using
the /mykey keystore?
Example: Encrypting a ZFS File System by Using a Raw Key
In the following example, an aes-256-ccm encryption key is generated by using the pktool command
and is written to a file, /cindykey.file.
# pktool genkey keystore=file outkey=/cindykey.file keytype=aes keylen=256
Then, the /cindykey.file is specified when the tank/home/cindy file system is created.
# zfs create -o encryption=aes-256-ccm -o keysource=raw,file:///cindykey.file tank/home/cindys
Reference: Oracle Solaris ZFS Administration Guide, Examples of Encrypting ZFS File Systems
You need to set up an Oracle Solaris 11 host as an iSCSI target so that the host's disk can be accessed
over a storage network. The disk device is c3t4d0.
Which six options describe the steps that need to be taken on this host to enable an iSCSI target?
B, C, D, F, H, I
How to Create an iSCSI LUN
The following steps are completed on the system that is providing the storage device.
1.Create a ZFS storage pool.
Example: target# zpool create sanpool mirror c2t3d0 c2t4d0
(C)2. Create a ZFS volume to be used as a SCSI LUN.
(D)3. Create a LUN for the ZFS volume.
target# stmfadm create-lu /dev/zvol/rdsk/sanpool/vol1
Logical unit created: 600144F0B5418B0000004DDAC7C10001
4. Confirm that the LUN has been created.
target# stmfadm list-lu
LU Name: 600144F0B5418B0000004DDAC7C10001
(F) 5. Add the LUN view.
This command makes the LUN accessible to all systems.
target# stmfadm add-view 600144F0B5418B0000004DDAC7C10001
How to Create the iSCSI Target
This procedure assumes that you are logged in to the local system will contains the iSCSI target.
Note: The stmfadm command manages SCSI LUNs. Rather than setting a special iSCSI property on the
ZFS volume, create the volume and use stmfadm to create the LUN.
(H) 1. Enable the iSCSI target service.
target# svcadm enable -r svc:/network/iscsi/target:default
(I) 2. Create the iSCSI target.
target# itadm create-target
Reference: Oracle Solaris Administration: Devices and File Systems, Configuring iSCSI Devices With
Identify the Automated Installer’s (AI) equivalent to jumpStart’s finish scripts and sysidcfg files.
ComparingsysidcfgFile Keywords to System Configuration Profile Directives
The following table comparessysidcfgfile keywords with example AI system configuration profile
System Configuration Profile Directives
You need to update an OS image on a client. The pkg publishers command displays the wrong
publisher with the wrong update:
The update is available on the updated publisher:
Select the option that describes the procedure used to update the OS image on the system from the
You can use the pkg set-publisher command to change a publisher URI.
Changing a Publisher Origin URI
To change the origin URI for a publisher, add the new URI and remove the old URI. Use the -g option
to add a new origin URI. Use the -G option to remove the old origin URI.
# pkg set-publisher -g http://pkg.example.com/support \
-G <http://pkg.example.com/release example.com>
Note: You can use either the install or update subcommand to update a package.
The install subcommand installs the package if the package is not already installed in the image. If
you want to be sure to update only packages that are already installed, and not install any new
packages, then use the update subcommand.
Reference: Oracle Solaris 11 Express Image Packaging System Guide, Managing Package Publishers