LFCS User and Group Management Practice Test 1 — 15 Questions

Question 1

A system administrator needs to add a new user 'alice' with UID 1050 and a home directory at /home/alice. Which command should be used?

Accepted Answer

useradd -u 1050 -d /home/alice -m alice. Options A and D are both correct. Option A uses `-u 1050` to set UID, `-d /home/alice` to specify the home directory, and `-m` to create it. Option D uses `--create-home` which creates the home directory at the default location `/home/alice`, and `--skel /etc/skel` to copy skeleton files; the home directory path defaults to `/home/alice`, satisfying the requirement. Option B uses incorrect flags `-U` and `-h`. Option C uses `--home` but does not include `--create-home` or `-m`, so the home directory is not created.

Answer

useradd -U 1050 -h /home/alice alice

Answer

useradd --uid 1050 --home /home/alice alice

Question 2

A developer was removed from the 'developers' group but still needs to run commands that require membership in that group. The user has logged out and back in, but the issue persists. What is the most likely cause?

Accepted Answer

The user did not explicitly start a new login shell after group removal.. When a user is removed from a supplementary group, the group membership is cached in the user's current login session. Even after logging out and back in, if the user does not explicitly start a new login shell (e.g., by using `su -` or `login`), the old group membership persists because the session's group list is inherited from the parent process. The `newgrp` command or a fresh login shell is required to re-read the group database and update the group list.

Answer

The user's primary group is different from the 'developers' group.

Answer

The user is using 'newgrp developers' but is no longer a member.

Answer

The 'id' command shows the old group because the user's shell is still running.

Question 3

A system administrator needs to create a user 'john' with a home directory in /data/users and an expiry date of 2025-12-31. Which command accomplishes this?

Accepted Answer

useradd -d /data/users -e 2025-12-31 john. The `useradd` command with `-d /data/users` sets the home directory to the specified path, and `-e 2025-12-31` sets the account expiry date in YYYY-MM-DD format. The `-e` flag directly corresponds to the `EXPIRE_DATE` field in `/etc/shadow`, which controls when the account becomes locked.

Answer

useradd -d /data/users -c 2025-12-31 john

Answer

adduser --home /data/users --expiredate 2025-12-31 john

Answer

useradd -m -e 2025-12-31 john

Question 4

An administrator needs to set up a shared directory /project for the group 'projectteam' (GID 5000). All members of the group should be able to create and delete files, but only the file owner can modify their own files. The directory should also ensure that new files inherit the group ownership. Which set of commands achieves this?

Accepted Answer

chown root:projectteam /project; chmod 2770 /project; setfacl -d -m o::--- /project. Option B correctly achieves all requirements. 'chown root:projectteam /project' sets the owner and group. 'chmod 2770 /project' sets the SGID bit (2) so new files inherit the group 'projectteam', and gives the owner and group full rwx on the directory (allowing group members to create and delete files), while granting no permissions to others. 'setfacl -d -m o::---' adds a default ACL that denies all access to others for new items. Since no default group ACL is defined, new files inherit group permissions from the process umask (typically 022, giving group read-only). Thus, group members have read-only access to files owned by others, so only the file owner can modify their files. All requirements are met without unnecessary ACLs for the group.

Answer

chown root:projectteam /project; chmod 2775 /project; setfacl -m g:projectteam:rwx /project

Answer

chown root:projectteam /project; chmod 2775 /project

Answer

chown root:projectteam /project; chmod 1770 /project; setfacl -m m::rwx /project

Question 5

A user 'alice' is unable to log in via SSH. The administrator checks /etc/shadow and sees 'alice:!:19234:0:99999:7:::'. What does the '!' in the password field indicate?

Accepted Answer

The account is locked.. The '!' in the password field of /etc/shadow indicates that the account is locked. This is a standard convention in Linux shadow password files: an exclamation mark placed before the hashed password (or replacing it entirely) disables password-based authentication, effectively locking the account. SSH login fails because the system refuses to authenticate any password attempt against a locked entry.

Answer

The password must be changed at next login.

Answer

The account is disabled.

Answer

The password is expired.

Question 6

An administrator wants to enforce that users in the 'contractors' group must change their password every 30 days, with a warning 7 days before expiry. Which command should be used?

Accepted Answer

chage -M 30 -W 7 contractors. None of the provided commands can be directly applied to a group. The `chage` command is the appropriate tool for password aging, but it requires a username as an argument. To enforce password aging on all users in the 'contractors' group, an administrator would need to iterate over each user in the group and run `chage -M 30 -W 7 <username>` for each.

Answer

groupmod -p 30 contractors

Answer

passwd -x 30 -w 7 contractors

Answer

usermod -e 30 contractors

Question 7

Which THREE commands can be used to list all users currently logged into the system?

Accepted Answer

w. The `w` command displays detailed information about currently logged-in users, including login time, idle time, and current process. The `users` command lists the usernames of all users currently logged in. The `who` command shows a list of users currently logged in, typically with login time and session details. All three commands read from /var/run/utmp or similar system files to present active sessions, making them valid for listing current users.

Answer

last

Answer

id

Question 8

Which THREE files are directly related to user and group management in a Linux system? (Select three.)

Accepted Answer

/etc/group. The files /etc/passwd, /etc/group, and /etc/shadow are the core local databases for user and group management. /etc/passwd stores user account information (username, UID, GID, home directory, shell), /etc/group stores group definitions (group name, GID, member list), and /etc/shadow stores encrypted password hashes and password aging data. These three files are directly consulted by commands like useradd, usermod, groupadd, and login for authentication and identity management.

Answer

/etc/sudoers

Answer

/etc/login.defs

Question 9

You are the Linux administrator for a medium-sized company that uses a centralized authentication system (LDAP) for user accounts, but local files (/etc/passwd, /etc/shadow, /etc/group) are also used for a few service accounts. The server is running RHEL 8. A new employee, 'jane', needs to be added to the local system for a temporary project. You create the user with 'useradd jane' and set a password with 'passwd jane'. However, when jane tries to log in via SSH using her password, she receives 'Permission denied, please try again.' The SSH server is configured to allow password authentication. Other users (both LDAP and local) can log in successfully. You verify that the password was set correctly and that the account is not locked. What is the most likely cause and solution?

Accepted Answer

Change jane's login shell to /bin/bash using usermod -s /bin/bash jane. SSH login may fail if the user's login shell is not a valid interactive shell listed in /etc/shells. While the default shell for new users on RHEL 8 is /bin/bash, the 'useradd' command can be configured with different defaults. In this case, jane's shell might be set to /sbin/nologin, preventing SSH session establishment after successful authentication. Changing it to /bin/bash with 'usermod -s /bin/bash jane' resolves the issue.

Answer

Configure the SSH daemon to allow password authentication for local users

Answer

Unlock the account using passwd -u jane

Answer

Remove the password expiry for jane using chage -E -1 jane

Question 10

A system administrator needs to ensure that all users in the 'developers' group have read and write access to a shared project directory /project/data, but new files created in that directory should belong to the 'developers' group automatically. Which command sequence achieves this goal?

Accepted Answer

chown :developers /project/data && chmod g+s /project/data. `chown :developers /project/data` changes the group ownership of the directory to 'developers', and `chmod g+s /project/data` sets the setgid bit on the directory. The setgid bit ensures that new files created inside inherit the directory's group ('developers') instead of the creator's primary group, and the group ownership gives all members of 'developers' read and write access based on the directory's permissions (e.g., 775).

Answer

setfacl -m g:developers:rwx /project/data && chmod 2775 /project/data

Answer

chown root:developers /project/data && chmod u+s /project/data

Answer

chmod g+s /project/data && chown root:developers /project/data

Question 11

A user 'alice' cannot log in via SSH. The administrator checks /etc/passwd and sees: alice:x:1002:1002::/home/alice:/sbin/nologin. Which command should be used to allow alice to log in with a bash shell?

Accepted Answer

usermod -s /bin/bash alice. The /sbin/nologin shell in the /etc/passwd entry prevents alice from logging in via SSH. The usermod -s /bin/bash alice command changes alice's login shell to /bin/bash, allowing interactive SSH sessions. This directly addresses the shell restriction without altering other account properties.

Answer

usermod -d /home/alice alice

Answer

usermod -u 1002 alice

Answer

useradd -m -s /bin/bash alice

Question 12

An administrator wants to add user 'bob' to the supplementary group 'docker' without removing bob from any existing groups. Which command accomplishes this?

Accepted Answer

usermod -aG docker bob. The `-a` (append) flag combined with `-G` (supplementary groups) ensures user 'bob' is added to the 'docker' group without removing him from any existing supplementary groups. Without `-a`, the `-G` flag replaces the user's current supplementary group list with the specified groups.

Answer

usermod -g docker bob

Answer

usermod -G docker bob

Answer

usermod -G docker bob

Question 13

A security policy requires that user 'svc_backup' have a password that never expires. Additionally, the account should be locked after 90 days of inactivity. Which set of commands achieves this?

Accepted Answer

chage -M 99999 -I 90 svc_backup. `chage -M 99999` sets the maximum password age to 99999 days, effectively preventing the password from ever expiring (since 99999 days far exceeds any practical lifespan). The `-I 90` flag sets the inactivity period to 90 days, meaning the account will be locked after 90 days of no login activity. This combination satisfies both security policy requirements: a non-expiring password and automatic lockout after 90 days of inactivity.

Answer

chage -W 7 -I 90 svc_backup

Answer

chage -E 2025-01-01 -I 90 svc_backup

Answer

chage -M 90 -I 90 svc_backup

Question 14

Which TWO commands can be used to display the groups to which the current user belongs? (Select exactly two.)

Accepted Answer

id. The `id` command (option C) displays the current user's UID, GID, and all supplementary group memberships. When run without arguments, it shows the effective user and group IDs along with all groups the user belongs to, making it a direct and reliable way to list group membership.

Answer

cat /etc/group

Answer

groupmems -l

Answer

getent group

Question 15

You are managing a multi-user Linux server used by a development team. The server has a shared directory /data/projects where each project has a subdirectory owned by a project lead. The requirement is that all members of the 'devteam' group need to be able to create files in any project subdirectory, but only the project lead (owner) should be able to delete files. Currently, members of devteam are unable to create files in /data/projects. You check permissions: /data/projects has drwxrwxr-x root:devteam. Each project subdirectory, e.g., /data/projects/proj1, has drwx------ lead1:devteam. The lead1 user is in devteam. What is the most likely reason that devteam members cannot create files in proj1, and what is the correct solution?

Accepted Answer

The proj1 directory lacks group write and execute permissions; use chmod g+rwx proj1 and chmod g+s proj1 to allow group members to create files and ensure new files inherit group.. The project subdirectory /data/projects/proj1 has permissions drwx------ (700), which means only the owner (lead1) has read, write, and execute access. The devteam group lacks both write and execute permissions, preventing group members from creating files. The solution is to add group write and execute permissions (chmod g+rwx proj1) and set the setgid bit (chmod g+s proj1) so that new files inherit the group ownership, ensuring all devteam members can create files while only the owner can delete them.

Answer

The devteam group does not include all members; add each user to the devteam group.

Answer

The parent directory /data/projects lacks execute permission for devteam; add execute permission to /data/projects.

Answer

The sticky bit is not set; set the sticky bit on proj1 to allow only owners to delete files.