LFCS User and Group Management — 40 Questions

Question 1

A developer was removed from the 'developers' group but still needs to run commands that require membership in that group. The user has logged out and back in, but the issue persists. What is the most likely cause?

Accepted Answer

The user did not explicitly start a new login shell after group removal.. When a user is removed from a supplementary group, the group membership is cached in the user's current login session. Even after logging out and back in, if the user does not explicitly start a new login shell (e.g., by using `su -` or `login`), the old group membership persists because the session's group list is inherited from the parent process. The `newgrp` command or a fresh login shell is required to re-read the group database and update the group list.

Answer

The user's primary group is different from the 'developers' group.

Answer

The user is using 'newgrp developers' but is no longer a member.

Answer

The 'id' command shows the old group because the user's shell is still running.

Question 2

A system administrator needs to create a user 'john' with a home directory in /data/users and an expiry date of 2025-12-31. Which command accomplishes this?

Accepted Answer

useradd -d /data/users -e 2025-12-31 john. Option C is correct because the `useradd` command with `-d /data/users` sets the home directory to the specified path, and `-e 2025-12-31` sets the account expiry date in YYYY-MM-DD format. The `-e` flag directly corresponds to the `EXPIRE_DATE` field in `/etc/shadow`, which controls when the account becomes locked.

Answer

useradd -d /data/users -c 2025-12-31 john

Answer

adduser --home /data/users --expiredate 2025-12-31 john

Answer

useradd -m -e 2025-12-31 john

Question 3

An administrator needs to set up a shared directory /project for the group 'projectteam' (GID 5000). All members of the group should be able to create and delete files, but only the file owner can modify their own files. The directory should also ensure that new files inherit the group ownership. Which set of commands achieves this?

Accepted Answer

chown root:projectteam /project; chmod 2770 /project; setfacl -d -m o::--- /project. Option B is correct because it sets the SGID bit (2770) so new files inherit the group 'projectteam', grants rwx to the group, and uses a default ACL with `setfacl -d -m o::---` to remove 'other' permissions, ensuring only the file owner can modify their own files while group members can create/delete but not modify others' files.

Answer

chown root:projectteam /project; chmod 2775 /project; setfacl -m g:projectteam:rwx /project

Answer

chown root:projectteam /project; chmod 2775 /project

Answer

chown root:projectteam /project; chmod 1770 /project; setfacl -m m::rwx /project

Question 4

A user 'alice' is unable to log in via SSH. The administrator checks /etc/shadow and sees 'alice:!:19234:0:99999:7:::'. What does the '!' in the password field indicate?

Accepted Answer

The account is locked.. The '!' in the password field of /etc/shadow indicates that the account is locked. This is a standard convention in Linux shadow password files: an exclamation mark placed before the hashed password (or replacing it entirely) disables password-based authentication, effectively locking the account. SSH login fails because the system refuses to authenticate any password attempt against a locked entry.

Answer

The password must be changed at next login.

Answer

The account is disabled.

Answer

The password is expired.

Question 5

An administrator wants to enforce that users in the 'contractors' group must change their password every 30 days, with a warning 7 days before expiry. Which command should be used?

Accepted Answer

chage -M 30 -W 7 contractors. The `chage` command is specifically designed to manage user password aging policies. The `-M 30` option sets the maximum number of days a password is valid (30 days), and `-W 7` sets the number of days before expiry to start warning the user (7 days). This directly fulfills the requirement for the 'contractors' group by applying the policy to each user in that group.

Answer

groupmod -p 30 contractors

Answer

passwd -x 30 -w 7 contractors

Answer

usermod -e 30 contractors

Question 6

Which TWO commands can be used to list all users currently logged into the system?

Accepted Answer

w. The `w` command displays a list of currently logged-in users along with detailed information such as login time, idle time, JCPU, PCPU, and the current process. It reads from /var/run/utmp to show active sessions, making it a correct choice for listing current users.

Answer

last

Answer

users

Answer

id

Question 7

Which THREE files are directly related to user and group management in a Linux system? (Select three.)

Accepted Answer

/etc/group. The files /etc/passwd, /etc/group, and /etc/shadow are the core local databases for user and group management. /etc/passwd stores user account information (username, UID, GID, home directory, shell), /etc/group stores group definitions (group name, GID, member list), and /etc/shadow stores encrypted password hashes and password aging data. These three files are directly consulted by commands like useradd, usermod, groupadd, and login for authentication and identity management.

Answer

/etc/sudoers

Answer

/etc/login.defs

Question 8

You are the Linux administrator for a medium-sized company that uses a centralized authentication system (LDAP) for user accounts, but local files (/etc/passwd, /etc/shadow, /etc/group) are also used for a few service accounts. The server is running RHEL 8. A new employee, 'jane', needs to be added to the local system for a temporary project. You create the user with 'useradd jane' and set a password with 'passwd jane'. However, when jane tries to log in via SSH using her password, she receives 'Permission denied, please try again.' The SSH server is configured to allow password authentication. Other users (both LDAP and local) can log in successfully. You verify that the password was set correctly and that the account is not locked. What is the most likely cause and solution?

Accepted Answer

Change jane's login shell to /bin/bash using usermod -s /bin/bash jane. Option B is correct because the default shell for a new user created with 'useradd' on RHEL 8 is often /sbin/nologin, which prevents login. SSH authentication succeeds at the password level, but the session is immediately rejected because the shell is not a valid interactive shell. Changing the shell to /bin/bash with 'usermod -s /bin/bash jane' resolves this.

Answer

Configure the SSH daemon to allow password authentication for local users

Answer

Unlock the account using passwd -u jane

Answer

Remove the password expiry for jane using chage -E -1 jane

Question 9

A system administrator needs to ensure that all users in the 'developers' group have read and write access to a shared project directory /project/data, but new files created in that directory should belong to the 'developers' group automatically. Which command sequence achieves this goal?

Accepted Answer

chown :developers /project/data && chmod g+s /project/data. Option D is correct because `chown :developers /project/data` changes the group ownership of the directory to 'developers', and `chmod g+s /project/data` sets the setgid bit on the directory. The setgid bit ensures that new files created inside inherit the directory's group ('developers') instead of the creator's primary group, and the group ownership gives all members of 'developers' read and write access based on the directory's permissions (e.g., 775).

Answer

setfacl -m g:developers:rwx /project/data && chmod 2775 /project/data

Answer

chown root:developers /project/data && chmod u+s /project/data

Answer

chmod g+s /project/data && chown root:developers /project/data

Question 10

A user 'alice' cannot log in via SSH. The administrator checks /etc/passwd and sees: alice:x:1002:1002::/home/alice:/sbin/nologin. Which command should be used to allow alice to log in with a bash shell?

Accepted Answer

usermod -s /bin/bash alice. Option C is correct because the /sbin/nologin shell in the /etc/passwd entry prevents alice from logging in via SSH. The usermod -s /bin/bash alice command changes alice's login shell to /bin/bash, allowing interactive SSH sessions. This directly addresses the shell restriction without altering other account properties.

Answer

usermod -d /home/alice alice

Answer

usermod -u 1002 alice

Answer

useradd -m -s /bin/bash alice

Question 11

An administrator wants to add user 'bob' to the supplementary group 'docker' without removing bob from any existing groups. Which command accomplishes this?

Accepted Answer

usermod -aG docker bob. Option B is correct because the `-a` (append) flag combined with `-G` (supplementary groups) ensures user 'bob' is added to the 'docker' group without removing him from any existing supplementary groups. Without `-a`, the `-G` flag replaces the user's current supplementary group list with the specified groups.

Answer

usermod -g docker bob

Answer

usermod -G docker bob

Answer

usermod -G docker bob

Question 12

A security policy requires that user 'svc_backup' have a password that never expires. Additionally, the account should be locked after 90 days of inactivity. Which set of commands achieves this?

Accepted Answer

chage -M 99999 -I 90 svc_backup. Option C is correct because `chage -M 99999` sets the maximum password age to 99999 days, effectively preventing the password from ever expiring (since 99999 days far exceeds any practical lifespan). The `-I 90` flag sets the inactivity period to 90 days, meaning the account will be locked after 90 days of no login activity. This combination satisfies both security policy requirements: a non-expiring password and automatic lockout after 90 days of inactivity.

Answer

chage -W 7 -I 90 svc_backup

Answer

chage -E 2025-01-01 -I 90 svc_backup

Answer

chage -M 90 -I 90 svc_backup

Question 13

Which TWO commands can be used to display the groups to which the current user belongs? (Select exactly two.)

Accepted Answer

id. The `id` command (option C) displays the current user's UID, GID, and all supplementary group memberships. When run without arguments, it shows the effective user and group IDs along with all groups the user belongs to, making it a direct and reliable way to list group membership.

Answer

cat /etc/group

Answer

groupmems -l

Answer

getent group

Question 14

You are managing a multi-user Linux server used by a development team. The server has a shared directory /data/projects where each project has a subdirectory owned by a project lead. The requirement is that all members of the 'devteam' group need to be able to create files in any project subdirectory, but only the project lead (owner) should be able to delete files. Currently, members of devteam are unable to create files in /data/projects. You check permissions: /data/projects has drwxrwxr-x root:devteam. Each project subdirectory, e.g., /data/projects/proj1, has drwx------ lead1:devteam. The lead1 user is in devteam. What is the most likely reason that devteam members cannot create files in proj1, and what is the correct solution?

Accepted Answer

The proj1 directory lacks group write and execute permissions; use chmod g+rwx proj1 and chmod g+s proj1 to allow group members to create files and ensure new files inherit group.. Option D is correct because the project subdirectory /data/projects/proj1 has permissions drwx------ (700), which means only the owner (lead1) has read, write, and execute access. The devteam group lacks both write and execute permissions, preventing group members from creating files. The solution is to add group write and execute permissions (chmod g+rwx proj1) and set the setgid bit (chmod g+s proj1) so that new files inherit the group ownership, ensuring all devteam members can create files while only the owner can delete them.

Answer

The devteam group does not include all members; add each user to the devteam group.

Answer

The parent directory /data/projects lacks execute permission for devteam; add execute permission to /data/projects.

Answer

The sticky bit is not set; set the sticky bit on proj1 to allow only owners to delete files.

Question 15

An administrator needs to grant a user named 'john' the ability to switch to any other user without a password. Which TWO of the following steps are required to achieve this?

Accepted Answer

Add 'john' to the 'wheel' group and configure /etc/pam.d/su to use pam_wheel.so with the 'trust' option.. Option A is correct because adding 'john' to the 'wheel' group and configuring /etc/pam.d/su with pam_wheel.so and the 'trust' option allows members of the 'wheel' group to switch to any user via su without being prompted for a password. The 'trust' modifier in PAM bypasses the password authentication for users in the specified group, effectively granting passwordless su access.

Answer

Set the suid bit on /bin/su.

Answer

Run 'usermod -L john'.

Answer

Add 'john' to the 'root' group.

Question 16

A user named 'charlie' has just been added to the 'devops' group. However, when 'charlie' runs 'sudo -l', no sudo entries are shown. What is the most likely cause?

Accepted Answer

'charlie' must log out and log back in for the group change to take effect.. Option B is correct because when a user is added to a new group, the group membership is only applied to new login sessions. The `sudo -l` command checks the user's current group memberships, which are cached at login time. Since 'charlie' was added to the 'devops' group while already logged in, the new group membership is not reflected until 'charlie' logs out and logs back in, or uses `newgrp` or `sg` to start a new session with the updated groups.

Answer

'charlie' is not listed by name in the sudoers file.

Answer

'charlie' is also a member of another group that restricts sudo.

Answer

The systemctl command is not executable by 'charlie'.

Answer

The sudoers file has a syntax error.

Question 17

Scenario: You are managing a Linux server that hosts a web application. The application runs under the user 'webapp' and the group 'webgroup'. Recently, a new intern 'john' (username 'john') needs to be able to view and modify files in /var/www/html, which is owned by root:webgroup with permissions 775. John is currently a member of the group 'staff', but not 'webgroup'. The security policy requires that John must be able to edit files without using sudo, and his primary group must remain 'staff'. Which of the following actions should you take to meet the requirements?

Accepted Answer

Add John to the 'webgroup' supplementary group with 'usermod -a -G webgroup john'.. Option A is correct because adding John to the 'webgroup' supplementary group with `usermod -a -G webgroup john` grants him group-level access to /var/www/html (owned by root:webgroup with permissions 775) without changing his primary group 'staff'. This allows him to view and modify files as a member of 'webgroup', satisfying the security policy that he must not use sudo and his primary group must remain unchanged.

Answer

Change the group ownership of /var/www/html to 'staff' and set the setgid bit.

Answer

Change John's primary group to 'webgroup' with 'usermod -g webgroup john'.

Answer

Set the setgid bit on /var/www/html with 'chmod g+s /var/www/html'.

Question 18

Arrange the steps to configure a new user account with sudo privileges on a Linux system.

Question 19

Order the steps to create a systemd service unit that runs a script at boot.

Question 20

Order the steps to set up passwordless SSH key-based authentication.