LFCS User and Group Management — 20 Questions

Question 1

A developer was removed from the 'developers' group but still needs to run commands that require membership in that group. The user has logged out and back in, but the issue persists. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user did not explicitly start a new login shell after group removal.. When a user is removed from a supplementary group, the group membership is cached in the user's current login session. Even after logging out and back in, if the user does not explicitly start a new login shell (e.g., by using `su -` or `login`), the old group membership persists because the session's group list is inherited from the parent process. The `newgrp` command or a fresh login shell is required to re-read the group database and update the group list.

Answer

The user's primary group is different from the 'developers' group.

Answer

The user is using 'newgrp developers' but is no longer a member.

Answer

The 'id' command shows the old group because the user's shell is still running.

Question 2

A system administrator needs to create a user 'john' with a home directory in /data/users and an expiry date of 2025-12-31. Which command accomplishes this?

Accepted Answer

useradd -d /data/users -e 2025-12-31 john. The `useradd` command with `-d /data/users` sets the home directory to the specified path, and `-e 2025-12-31` sets the account expiry date in YYYY-MM-DD format. The `-e` flag directly corresponds to the `EXPIRE_DATE` field in `/etc/shadow`, which controls when the account becomes locked.

Answer

useradd -d /data/users -c 2025-12-31 john

Answer

adduser --home /data/users --expiredate 2025-12-31 john

Answer

useradd -m -e 2025-12-31 john

Question 3

An administrator needs to set up a shared directory /project for the group 'projectteam' (GID 5000). All members of the group should be able to create and delete files, but only the file owner can modify their own files. The directory should also ensure that new files inherit the group ownership. Which set of commands achieves this?

Accepted Answer

chown root:projectteam /project; chmod 2770 /project; setfacl -d -m o::--- /project. Option B correctly achieves all requirements. 'chown root:projectteam /project' sets the owner and group. 'chmod 2770 /project' sets the SGID bit (2) so new files inherit the group 'projectteam', and gives the owner and group full rwx on the directory (allowing group members to create and delete files), while granting no permissions to others. 'setfacl -d -m o::---' adds a default ACL that denies all access to others for new items. Since no default group ACL is defined, new files inherit group permissions from the process umask (typically 022, giving group read-only). Thus, group members have read-only access to files owned by others, so only the file owner can modify their files. All requirements are met without unnecessary ACLs for the group.

Answer

chown root:projectteam /project; chmod 2775 /project; setfacl -m g:projectteam:rwx /project

Answer

chown root:projectteam /project; chmod 2775 /project

Answer

chown root:projectteam /project; chmod 1770 /project; setfacl -m m::rwx /project

Question 4

A user 'alice' is unable to log in via SSH. The administrator checks /etc/shadow and sees 'alice:!:19234:0:99999:7:::'. What does the '!' in the password field indicate?

Accepted Answer

The account is locked.. The '!' in the password field of /etc/shadow indicates that the account is locked. This is a standard convention in Linux shadow password files: an exclamation mark placed before the hashed password (or replacing it entirely) disables password-based authentication, effectively locking the account. SSH login fails because the system refuses to authenticate any password attempt against a locked entry.

Answer

The password must be changed at next login.

Answer

The account is disabled.

Answer

The password is expired.

Question 5

You are the Linux administrator for a medium-sized company that uses a centralized authentication system (LDAP) for user accounts, but local files (/etc/passwd, /etc/shadow, /etc/group) are also used for a few service accounts. The server is running RHEL 8. A new employee, 'jane', needs to be added to the local system for a temporary project. You create the user with 'useradd jane' and set a password with 'passwd jane'. However, when jane tries to log in via SSH using her password, she receives 'Permission denied, please try again.' The SSH server is configured to allow password authentication. Other users (both LDAP and local) can log in successfully. You verify that the password was set correctly and that the account is not locked. What is the most likely cause and solution?

Accepted Answer

Change jane's login shell to /bin/bash using usermod -s /bin/bash jane. SSH login may fail if the user's login shell is not a valid interactive shell listed in /etc/shells. While the default shell for new users on RHEL 8 is /bin/bash, the 'useradd' command can be configured with different defaults. In this case, jane's shell might be set to /sbin/nologin, preventing SSH session establishment after successful authentication. Changing it to /bin/bash with 'usermod -s /bin/bash jane' resolves the issue.

Answer

Configure the SSH daemon to allow password authentication for local users

Answer

Unlock the account using passwd -u jane

Answer

Remove the password expiry for jane using chage -E -1 jane

Question 6

A system administrator needs to ensure that all users in the 'developers' group have read and write access to a shared project directory /project/data, but new files created in that directory should belong to the 'developers' group automatically. Which command sequence achieves this goal?

Accepted Answer

chown :developers /project/data && chmod g+s /project/data. `chown :developers /project/data` changes the group ownership of the directory to 'developers', and `chmod g+s /project/data` sets the setgid bit on the directory. The setgid bit ensures that new files created inside inherit the directory's group ('developers') instead of the creator's primary group, and the group ownership gives all members of 'developers' read and write access based on the directory's permissions (e.g., 775).

Answer

setfacl -m g:developers:rwx /project/data && chmod 2775 /project/data

Answer

chown root:developers /project/data && chmod u+s /project/data

Answer

chmod g+s /project/data && chown root:developers /project/data

Question 7

An administrator wants to add user 'bob' to the supplementary group 'docker' without removing bob from any existing groups. Which command accomplishes this?

Accepted Answer

usermod -aG docker bob. The `-a` (append) flag combined with `-G` (supplementary groups) ensures user 'bob' is added to the 'docker' group without removing him from any existing supplementary groups. Without `-a`, the `-G` flag replaces the user's current supplementary group list with the specified groups.

Answer

usermod -g docker bob

Answer

usermod -G docker bob

Answer

usermod -G docker bob

Question 8

Which TWO commands can be used to display the groups to which the current user belongs? (Select exactly two.)

Accepted Answer

id. Option C, `id`, is correct because when run without arguments it prints the current user's UID, GID, and the complete list of supplementary groups the user is a member of (e.g., `uid=1000(user) gid=1000(user) groups=1000(user),27(sudo)`). Option E, `groups`, is correct because it displays the group names the current user belongs to, listing the primary group first followed by supplementary groups. Option A, `cat /etc/group`, only dumps the entire group database file and does not resolve which entries apply to the current user. Option B, `groupmems -l`, lists members of a specific group (and requires the `-g` group argument), not the groups of the current user. Option D, `getent group`, queries the group database (including NSS sources like LDAP) and lists all groups, but does not filter for the current user's memberships.

Answer

cat /etc/group

Answer

groupmems -l

Answer

getent group

Question 9

You are managing a multi-user Linux server used by a development team. The server has a shared directory /data/projects where each project has a subdirectory owned by a project lead. The requirement is that all members of the 'devteam' group need to be able to create files in any project subdirectory, but only the project lead (owner) should be able to delete files. Currently, members of devteam are unable to create files in /data/projects. You check permissions: /data/projects has drwxrwxr-x root:devteam. Each project subdirectory, e.g., /data/projects/proj1, has drwx------ lead1:devteam. The lead1 user is in devteam. What is the most likely reason that devteam members cannot create files in proj1, and what is the correct solution?

Accepted Answer

The proj1 directory lacks group write and execute permissions; use chmod g+rwx proj1 and chmod g+s proj1 to allow group members to create files and ensure new files inherit group.. The project subdirectory /data/projects/proj1 has permissions drwx------ (700), which means only the owner (lead1) has read, write, and execute access. The devteam group lacks both write and execute permissions, preventing group members from creating files. The solution is to add group write and execute permissions (chmod g+rwx proj1) and set the setgid bit (chmod g+s proj1) so that new files inherit the group ownership, ensuring all devteam members can create files while only the owner can delete them.

Answer

The devteam group does not include all members; add each user to the devteam group.

Answer

The parent directory /data/projects lacks execute permission for devteam; add execute permission to /data/projects.

Answer

The sticky bit is not set; set the sticky bit on proj1 to allow only owners to delete files.

Question 10

An administrator needs to grant a user named 'john' the ability to switch to any other user without a password. Which TWO of the following steps are required to achieve this?

Accepted Answer

Add 'john' to the 'wheel' group and configure /etc/pam.d/su to use pam_wheel.so with the 'trust' option.. Adding 'john' to the 'wheel' group and configuring /etc/pam.d/su with pam_wheel.so and the 'trust' option allows members of the 'wheel' group to switch to any user via su without being prompted for a password. The 'trust' modifier in PAM bypasses the password authentication for users in the specified group, effectively granting passwordless su access.

Answer

Set the suid bit on /bin/su.

Answer

Run 'usermod -L john'.

Answer

Add 'john' to the 'root' group.

Question 11

Match each Linux filesystem hierarchy standard (FHS) directory to its purpose.

Accepted Answer

/boot: Contains the boot loader and kernel images. The correct matches pair each standard FHS directory with its primary purpose. Common confusions include mixing up /bin with /etc, /root with /dev, and /opt with /tmp.

Answer

/bin: Contains configuration files

Answer

/root: Contains device files

Answer

/opt: Contains temporary files

Question 12

Match each logical volume management (LVM) term to its definition.

Accepted Answer

Physical Volume: A physical disk or partition used by LVM.. Physical Volume (PV) is the raw disk/partition; Volume Group (VG) pools PVs; Logical Volume (LV) is a virtual device from a VG; Physical Extent (PE) is the fixed-size chunk in a PV. Common confusions: swapping LV and PV, or VG and PE.

Answer

Physical Volume: A virtual block device created from a volume group.

Answer

Volume Group: The smallest unit of storage in a physical volume.

Question 13

A system administrator needs to create a user account for a temporary contractor. The account should have a home directory under /home/contractors, the login shell should be /bin/bash, and the user should be a member of the 'contractors' group. Which command accomplishes this?

Accepted Answer

useradd -m -d /home/contractors/tempuser -s /bin/bash -g contractors tempuser. The `-g` flag specifies the primary group for the user, which in this case is 'contractors'. The `-m` flag creates the home directory, `-d` sets the home directory path to `/home/contractors/tempuser`, and `-s` sets the login shell to `/bin/bash`. This satisfies all requirements: the user 'tempuser' will have a home directory under `/home/contractors`, use `/bin/bash` as their shell, and be a member of the 'contractors' group as their primary group.

Answer

useradd -m -d /home/contractors/tempuser -s /bin/bash -G contractors tempuser

Answer

useradd -m -h /home/contractors/tempuser -s /bin/bash -g contractors tempuser

Answer

useradd -m -d /home/contractors/tempuser -s /bin/bash -p contractors tempuser

Question 14

An administrator needs to create a system user that runs a service (no login, no home directory). Which command is appropriate?

Accepted Answer

useradd -r -M myservice. The `-r` flag creates a system user (UID below SYSTEM_UID_MIN, typically 1000) without a home directory by default, and `-M` explicitly overrides any default that might create a home directory, ensuring no home directory is created. This matches the requirement for a service account that does not need login or a home directory.

Answer

useradd -r myservice

Answer

useradd -r -m myservice

Answer

useradd -M myservice

Question 15

A user reports that they cannot log in via SSH. The system administrator checks that the account is not locked, the password is correct, and the shell is valid. However, the user's home directory is owned by root instead of the user. What is the most likely cause of the login failure?

Accepted Answer

The home directory ownership is incorrect, causing SSH PAM session module to reject login. When a user's home directory is owned by root instead of the user, the PAM `pam_namespace` or `pam_selinux` session modules may reject the login because they enforce strict ownership and permissions on the home directory for security. Specifically, `pam_namespace` requires the home directory to be owned by the user to create a polyinstantiated namespace, and `pam_selinux` may fail if it cannot relabel the directory. This results in SSH authentication succeeding but the session failing to open, causing a login failure.

Answer

The user's login shell is not listed in /etc/shells

Answer

The /etc/nologin file exists

Answer

The user's entry in /etc/shadow is corrupted

Question 16

A team of developers must share files under /opt/project. All developers are members of the 'devteam' group. New files must be automatically assigned to group 'devteam' and be writable by the group. Which umask and setgid configuration should be applied?

Accepted Answer

Set setgid bit on /opt/project and set umask for developers to 002. Setting the setgid bit on /opt/project ensures that new files inherit the group ownership of the directory (devteam), and setting the umask to 002 removes write permission for others but preserves group write permission, so new files are group-writable. This combination meets both requirements automatically without manual intervention.

Answer

Set setgid bit on /opt/project and set umask to 007

Answer

Set the sticky bit on /opt/project and umask to 022

Answer

Set umask for developers to 002 only

Question 17

An administrator wants to temporarily disable a user account without deleting it. The account should be locked, expire immediately, and the user should not be able to log in. Which single command accomplishes this with minimum side effects?

Accepted Answer

usermod -L -e 1970-01-01 user1. It combines `usermod -L` to lock the password (preventing authentication via password) with `-e 1970-01-01` to set the account expiration date to January 1, 1970, which immediately expires the account (the epoch date is treated as already past). This ensures the user cannot log in via any method (password, SSH keys, etc.) because the account is both locked and expired, with minimal side effects — no files or home directory are removed.

Answer

usermod -L user1; chage -E 0 user1

Answer

usermod -L user1

Answer

usermod -e 1970-01-01 user1

Question 18

Which TWO commands can change a user's primary group?

Accepted Answer

groupmod -g newGID groupname. Option C, `usermod -g groupname username`, is correct because the `-g` flag of `usermod` explicitly sets the user's primary group (the GID stored in `/etc/passwd`) to the specified group. Option B, `groupmod -g newGID groupname`, is correct because changing a group's GID with `groupmod -g` effectively changes the primary group identity for every user whose primary GID matches that group, since primary group membership is tracked by GID in `/etc/passwd`. Option A, `groupdel groupname`, only removes a group and cannot assign a new primary group to a user. Option D, `usermod -G groupname username`, adds the user to a supplementary group (listed in `/etc/group`), not the primary group. Option E, `useradd -g groupname username`, sets the primary group only at account creation time and cannot modify an existing user's primary group.

Answer

groupdel groupname

Answer

usermod -G groupname username

Answer

useradd -g groupname username

Question 19

Which TWO options in /etc/shadow are correctly described?

Accepted Answer

The minimum number of days between password changes is the fourth field. Option B is correct because in /etc/shadow the fourth field holds the minimum number of days that must pass between password changes (PASS_MIN_DAYS). Option E is correct because the fifth field stores the maximum number of days a password remains valid before it must be changed (PASS_MAX_DAYS). Option A is wrong because the third field contains the date of the last password change (days since Jan 1, 1970), not the expiration date. Option C is wrong because the sixth field is the warning period (days before expiration that the user is warned), not the account expiration date. Option D is wrong because the seventh field is the inactivity period (days after password expiration before the account is disabled), while the account expiration date is actually the eighth field.

Answer

The password expiration date is stored in the third field

Answer

The account expiration date is the sixth field

Answer

The number of days since Jan 1, 1970 until the account expires is stored in the seventh field

Question 20

Refer to the exhibit. User 'alice' cannot log in. What is the most likely problem?

Accepted Answer

The home directory ownership is incorrect. The exhibit shows that the home directory /home/alice is owned by root, not by user alice. When a user's home directory ownership is incorrect, the login process may fail or the user may be dropped into a restricted environment, as the system cannot write necessary files (like .bashrc or .bash_logout) to the home directory. This is a common misconfiguration that prevents normal login.

Answer

The shadow file is missing alice's entry

Answer

The user's UID or GID is not unique

Answer

The login shell /bin/bash does not exist