Which method helps identify recent changes to a configuration file?

• A. Rely on the file's content alone.
• B. Reboot the system.
• C. Check file mtimes using stat.
• D. Search the system logs for edits.

Answer: (C)

To see if a configuration file has been changed recently, focus on the file’s modification timestamp. The Modify time (the last time the file’s contents were changed) is updated whenever the actual content changes, making it the most direct indicator of recent edits. Using a command like stat on the file shows this Modify timestamp, giving you a clear, reliable signal of when the file was last altered.

Relying on the file’s content alone isn’t ideal because you’d need a saved baseline to compare against, and without that, you can’t tell when changes occurred. Rebooting the system doesn’t reveal what changed. Searching system logs for edits can help if there’s an audit trail, but logs aren’t always comprehensive or enabled for every file edit, so they aren’t as dependable for pinpointing recent changes.

So, checking the file’s mtimes with stat provides a straightforward, dependable way to identify recent modifications to a configuration file.