1z0-820 Sample Questions Answers

The configuration element supports non-global zone configurations. When installing a global zone system, the zone configurations specified in the AI manifest are used to install non-global zones onto the system after the global zone has been installed

The configuration element has the following attributes:

type

The type of configuration to install. The only type supported by AI is zone.

name

A name given to the configuration. This name must be unique across all configuration elements in an AI manifest. For configurations of type zone, this name is also used as the zonename for the zone.

source

The location from which AI downloads the configuration file for this configuration element. The value can be an HTTP or FILE URI specification. For configurations of type zone, this value should point to a zone configuration file as produced from the zonecfg export command.

B: The Network Status notification icon is only displayed on the desktop if you are using NWAM to automatically configure your network.

C: All online (Wireless)

Indicates all manually enabled connections in the enabled network profile are online and that the required number of connections in the enabled profile group (if such a group exists) are online. The required number is the same as those described for the All online (Wired) status.

Note that at least one online connection is wireless.

D: According to line /etc/security

F: According to line /export/home

Not E: According to line IGNORE dirmtime

Note: In default mode, the bart compare command, as shown in the following example, checks all the files installed on the system, with the exception of modified directory timestamps (dirmtime):

CHECK all

IGNORE dirmtime

Note 2: The Basic Audit Reporting Tool (BART) feature of Oracle Solaris enables you to comprehensively validate systems by performing file-level checks of a system over time. By creating BART manifests, you can easily and reliably gather information about the components of the software stack that is installed on deployed systems.

BART is a useful tool for integrity management on one system or on a network of systems.

Decompress using savecore -f vmdump.0

savecore - save a crash dump of the operating system

-f dumpfile Attempt to save a crash dump from the speci-

fied file instead of from the system's

current dump device. This option may be use-

ful if the information stored on the dump

device has been copied to an on-disk file by

means of the dd(1M) command.

Example: Encrypting a ZFS File System by Using a Raw Key

In the following example, an aes-256-ccm encryption key is generated by using the pktool command and is written to a file, /cindykey.file.

# pktool genkey keystore=file outkey=/cindykey.file keytype=aes keylen=256

Then, the /cindykey.file is specified when the tank/home/cindy file system is created.

# zfs create -o encryption=aes-256-ccm -o keysource=raw,file:///cindykey.file tank/home/cindys

dlstat show-aggr [-r | -t] [-i interval] [-p] [ -o field[,...]] [-u R|K|M|G|T|P] [link]

Display per-port statistics for an aggregation.

installadm add-manifest

Associates manifests with a specific install

service, thus making the manifests available on

the network, independently from creating a

service. When publishing a non-default manifest,

it is required to associate criteria either via

criteria entered on the command line (-c) or

via a criteria XML file (-C).

rctladm - display and/or modify global state of system

resource controls

The following command activates system logging of all viola-

tions of task.max-lwps.

# rctladm -e syslog task.max-lwps

#

* (Not A, B, C): interval (here 10 seconds): Specifies the length in seconds to pause between each interval report.

* duration (here 24 h)

* -R report[,report] (here high)

Print a summary report.

high Print a summary report detailing the highest usage of each resource and zone during any interval of the zonestat utility invocation.

Note: The zonestat utility reports on the cpu, memory, and resource control utilization of the currently running zones. Each zone's utilization is reported both as a percentage of system resources and the zone's configured limits.

The zonestat utility prints a series of interval reports at the specified interval. It optionally also prints one or more summary reports at a specified interval.

The default output is a summary of cpu, physical, and virtual memory utilization. The -r option can be used to choose detailed output for specific resources.

How to Create an iSCSI LUN

The disk volume provided by the server is referred to as the target. When the LUN is associated with an iSCSI target, it can be accessed by an iSCSI initiator.

The following tasks are completed on the system that is providing the storage device.

1. Install the COMSTAR storage server software.

target# pkg install storage-server

Etc.

The prctl utility allows the examination and modification of the resource controls associated with an active process, task, or project on the system. It allows access to the basic and privileged limits and the current usage on the specified entity.

How to Change the zone.cpu-shares Value in a Zone Dynamically

This procedure can be used in the global zone or in a non-global zone.

• Be superuser, or have equivalent authorizations.

For more information about roles, see Configuring and Using RBAC (Task Map) in System Administration Guide: Security Services.

• Use the prctl command to specify a new value for cpu-shares.

# prctl -n zone.cpu-shares -r -v value -i zone zonename

idtype is either the zonename or the zoneid. value is the new value.

Note: project.cpu-shares

Number of CPU shares granted to a project for use with the fair share scheduler

A: The beadm utility includes support for creating and administering non-global zone boot environments.

Note: A boot environment is a bootable instance of the Oracle Solaris operating system image plus any other application software packages installed into that image. System administrators can maintain multiple boot environments on their systems, and each boot environment can have different software versions installed.

B: Role-based access control (RBAC) is a security feature for controlling user access to tasks that would normally be restricted to the root role. By applying security attributes to processes and to users, RBAC can divide up superuser capabilities among several administrators.

The dispadmin command displays or changes process scheduler parameters while the system is running.

-c class

Specifies the class whose parameters are to be displayed or changed. Valid class values are: RT for the real-time class, TS for the time-sharing class, IA for the inter-active class, FSS for the fair-share class, and FX for the fixed-priority class. The time-sharing and inter-active classes share the same scheduler, so changes to the scheduling parameters of one will change those of the other.

-g

Gets the parameters for the specified class and writes them to the standard output.

B:

Note: You can create custom AI manifests for particular clients.

Create a custom XML AI manifest file. This method is best suited to an environment where few systems require custom provisioning. Most systems to be installed have identical or similar hardware and will be provisioned identically.

Write a script that dynamically creates an AI manifest for each client at installation time. Use this method to create a custom installation for each client, based on client characteristics discovered at installation time.

E: AI Server Software Requirements include

Software package repository

Ensure that the install server can access an IPS software package repository. AI requires the install/installadm package.

F: Install Server Requirements

Any system that meets these requirements can be used as an AI install server, including laptops, desktops, virtual machines, and enterprise servers. The install server can be either an x86 machine or a SPARC machine. An x86 install server can install both SPARC and x86 clients, and a SPARC install server can install both SPARC and x86 clients.

Note: To install clients over the network, AI requires a separate system to be an install server. On the install server, create an AI install service to provide a net image and instructions for installing the Oracle Solaris 11 OS on different clients.

ai_manifest

- Automated installation manifest file format

Synopsis

/usr/share/install/ai.dtd.1

Some customizations have been made, such as the selection of specific locales.

A: Configure the Repository Server Service

To enable clients to access the local repository via HTTP, enable the application/pkg/server

Service Management Facility (SMF) service.

# svccfg -s application/pkg/server setprop pkg/inst_root=/export/repoSolaris11

# svccfg -s application/pkg/server setprop pkg/readonly=true

B: Binary Signatures for Third-Party Software

The elfsign command provides a means to sign providers to be used with the Oracle Solaris Cryptographic Framework. Typically, this command is run by the developer of a provider.

The elfsign command has subcommands to request a certificate from Sun and to sign binaries. Another subcommand verifies the signature. Unsigned binaries cannot be used by the Oracle Solaris Cryptographic Framework. To sign one or more providers requires the certificate from Sun and the private key that was used to request the certificate.

C: Export law in the United States requires that the use of open cryptographic interfaces be restricted. The Oracle Solaris Cryptographic Framework satisfies the current law by requiring that kernel cryptographic providers and PKCS #11 cryptographic providers be signed.

zonep2vchk

- check a global zone's configuration for physical to virtual migration into non-global zone

The zonep2vchk utility is used to evaluate a global zone's configuration before the process of physical-to-virtual (p2v) migration into a non-global zone.

The p2v process involves archiving a global zone (source), and then installing a non-global zone (target) using that archive

zonep2vchk serves two functions. First, it can be used to report issues on the source which might prevent a successful p2v migration. Second, it can output a template zonecfg, which can be used to assist in configuring the non-global zone target.

zonep2vchk can be executed on a Solaris 10 or later global zone. To execute on Solaris 10, copy the zonep2vchkutility to the Solaris 10 source global zone.

When run on Solaris 10, a target release of S11 can be specified, which will check for p2v into a Solaris 10 Branded zone.

The framework enables providers of cryptographic services to have their services used by many consumers in the Oracle Solaris operating system. Another name for providers is plugins. The framework allows three types of plugins:

* User-level plugins - Shared objects that provide services by using PKCS #11 libraries, such as pkcs11_softtoken.so.1.

* Kernel-level plugins - Kernel modules that provide implementations of cryptographic algorithms in software, such as AES.

Many of the algorithms in the framework are optimized for x86 with the SSE2 instruction set and for SPARC hardware.

* Hardware plugins - Device drivers and their associated hardware accelerators. The Niagara chips, the ncp and n2cp device drivers, are one example. A hardware accelerator offloads expensive cryptographic functions from the operating system. The Sun Crypto Accelerator 6000 board is one example.

There is no data-link named vswitch192.168.

We need to create an etherstub first.

See Note and example below for details.

Note: Create a VNIC in the system's global zone.

# dladm create-vnic -l data-link vnic-name

data-link is the name of the interface where the VNIC is to be configured.

-l link, --link=link

link can be a physical link or an etherstub.

vnic-name is the name that you want to give the VNIC.

For example, to create a VNIC named vnic0 on interface e1000g0, you would type the following:

# dladm create-vnic -l e1000g0 vnic0

Example: Creating a Virtual Network Without a Physical NIC

First, create an etherstub with name stub1:

# dladm create-etherstub stub1

Create two VNICs with names hello0 and test1 on the etherstub. This

operation implicitly creates a virtual switch connecting hello0 and

test1.

# dladm create-vnic -l stub1 hello0

# dladm create-vnic -l stub1 test1

The following options are supported:

-C

Connects to the zone console. Connects to the zone console.

Note:

After you install a zone, you must log in to the zone to complete its application environment. You might log in to the zone to perform administrative tasks as well. Unless the -C option is used to connect to the zone console, logging in to a zone using zlogin starts a new task. A task cannot span two zones

JumpStart: Use the setup_install_server(1M) command.

AI: Use the installadm create-service command.

A: -n

Uses this install service name instead of default

service name.

B: -i

Sets up a new DHCP server. The IP addresses,

starting from dhcp_address_start, are set up.

D: -c

Sets up a total number of IP addresses in the

DHCP table equal to the value of the

count_of_ipaddr. The first IP address is the

value of dhcp_ip_start that is provided by the

-i option.

F: -s

Specifies location of AI ISO image to use for

setting up the install service.

Required: Specifies location to set up net image.

A: To rename the bge0 link to mgmt0, enter the following command:

# dladm rename-link bge0 mgmt0

E: Consider that the bge0 device, whose link was named mgmt0 as shown in the previous example, needs to be replaced with a ce0 device because of a hardware failure. The bge0 NIC is physically removed, and replaced with a new ce0 NIC. To associate the newly added ce0 device with the mgmt0 configuration previously associated with bge0, enter the following command:

# dladm rename-link ce0 mgmt0

Note: How to Rename a Datalink

Use this procedure if you want to change a datalink name to a customized name. For example, some of the datalinks in upgraded system might have retained legacy hardware-based names and you want to change these names to generic ones.

Note: dladm rename-link [-R root-dir] link new-link

Rename link to new-link. This is used to give a link a meaningful name, or to associate existing link configuration such as link properties of a removed device with a new device.