LFCS User and Group Management Practice Test 2 — 15 Questions

Question 1

A team of developers must share files under /opt/project. All developers are members of the 'devteam' group. New files must be automatically assigned to group 'devteam' and be writable by the group. Which umask and setgid configuration should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set setgid bit on /opt/project and set umask for developers to 002. Setting the setgid bit on /opt/project ensures that new files inherit the group ownership of the directory (devteam), and setting the umask to 002 removes write permission for others but preserves group write permission, so new files are group-writable. This combination meets both requirements automatically without manual intervention.

Answer

Set setgid bit on /opt/project and set umask to 007

Answer

Set the sticky bit on /opt/project and umask to 022

Answer

Set umask for developers to 002 only

Question 2

An administrator wants to temporarily disable a user account without deleting it. The account should be locked, expire immediately, and the user should not be able to log in. Which single command accomplishes this with minimum side effects?

Accepted Answer

usermod -L -e 1970-01-01 user1. It combines `usermod -L` to lock the password (preventing authentication via password) with `-e 1970-01-01` to set the account expiration date to January 1, 1970, which immediately expires the account (the epoch date is treated as already past). This ensures the user cannot log in via any method (password, SSH keys, etc.) because the account is both locked and expired, with minimal side effects — no files or home directory are removed.

Answer

usermod -L user1; chage -E 0 user1

Answer

usermod -L user1

Answer

usermod -e 1970-01-01 user1

Question 3

Which TWO commands can change a user's primary group?

Accepted Answer

groupmod -g newGID groupname. Option C, `usermod -g groupname username`, is correct because the `-g` flag of `usermod` explicitly sets the user's primary group (the GID stored in `/etc/passwd`) to the specified group. Option B, `groupmod -g newGID groupname`, is correct because changing a group's GID with `groupmod -g` effectively changes the primary group identity for every user whose primary GID matches that group, since primary group membership is tracked by GID in `/etc/passwd`. Option A, `groupdel groupname`, only removes a group and cannot assign a new primary group to a user. Option D, `usermod -G groupname username`, adds the user to a supplementary group (listed in `/etc/group`), not the primary group. Option E, `useradd -g groupname username`, sets the primary group only at account creation time and cannot modify an existing user's primary group.

Answer

groupdel groupname

Answer

usermod -G groupname username

Answer

useradd -g groupname username

Question 4

Which TWO options in /etc/shadow are correctly described?

Accepted Answer

The minimum number of days between password changes is the fourth field. Option B is correct because in /etc/shadow the fourth field holds the minimum number of days that must pass between password changes (PASS_MIN_DAYS). Option E is correct because the fifth field stores the maximum number of days a password remains valid before it must be changed (PASS_MAX_DAYS). Option A is wrong because the third field contains the date of the last password change (days since Jan 1, 1970), not the expiration date. Option C is wrong because the sixth field is the warning period (days before expiration that the user is warned), not the account expiration date. Option D is wrong because the seventh field is the inactivity period (days after password expiration before the account is disabled), while the account expiration date is actually the eighth field.

Answer

The password expiration date is stored in the third field

Answer

The account expiration date is the sixth field

Answer

The number of days since Jan 1, 1970 until the account expires is stored in the seventh field

Question 5

Refer to the exhibit. User 'alice' cannot log in. What is the most likely problem?

Accepted Answer

The home directory ownership is incorrect. The exhibit shows that the home directory /home/alice is owned by root, not by user alice. When a user's home directory ownership is incorrect, the login process may fail or the user may be dropped into a restricted environment, as the system cannot write necessary files (like .bashrc or .bash_logout) to the home directory. This is a common misconfiguration that prevents normal login.

Answer

The shadow file is missing alice's entry

Answer

The user's UID or GID is not unique

Answer

The login shell /bin/bash does not exist

Question 6

Refer to the exhibit. User 'alice' is a member of groups 'users' and 'projectx'? She needs to be a member of 'staff' as well. Which of the following statements is true?

Accepted Answer

To become a member of 'staff', alice must either log out and log in, or use newgrp command. When a user is added to a new supplementary group (e.g., 'staff'), the group membership is only applied to new login sessions. The current shell session retains the old group set. To pick up the new group without logging out, the user can run `newgrp staff` to start a new shell with the updated group membership, or log out and log back in. This behavior is governed by how the `initgroups()` function and the `groups` command read the current session's cached group list.

Answer

Alice is a member of 'projectx' but the groups command is outdated

Answer

Alice's primary group is 'users' and she cannot have supplementary groups

Answer

The entry in /etc/group for 'projectx' is incorrect because alice is not a member

Question 7

Refer to the exhibit. Assuming today is Feb 20, 2025, what happens when 'bob' attempts to log in today?

Accepted Answer

Login is successful without warnings. The exhibit shows that 'bob's account has an expiration date of Mar 01, 2025, and today is Feb 20, 2025, so the account is still active. Additionally, the password last changed on Feb 01, 2025, with a maximum password age (PASS_MAX_DAYS) of 30 days, meaning the password will not expire until Mar 03, 2025. Therefore, both the account and password are valid, and no warnings are triggered because the password is not within the typical 7-day warning period (PASS_WARN_AGE) before expiration.

Answer

Login is denied because the password has expired

Answer

Login is successful, but a warning message is displayed that password will expire soon

Answer

Login is denied because the account expired on Mar 01

Question 8

An administrator created a new user 'john' with the default settings, but 'john' cannot log in. The error message indicates an invalid shell. Which command should the administrator use to fix this issue?

Accepted Answer

usermod -s /bin/bash john. The correct command is `usermod -s /bin/bash john` because it modifies an existing user's login shell in the `/etc/passwd` file. The error 'invalid shell' indicates the user's current shell is either missing or not listed in `/etc/shells`, and `usermod` is the proper tool to change a user's attributes after account creation.

Answer

passwd -s john

Answer

useradd -s /bin/bash john

Answer

chsh -s /bin/bash john

Question 9

A system administrator needs to create a new group named 'developers' with GID 1500 and add the user 'alice' to this group. Which set of commands accomplishes this?

Accepted Answer

groupadd -g 1500 developers; usermod -aG developers alice. `groupadd -g 1500 developers` creates the group with the specified GID, and `usermod -aG developers alice` adds the user 'alice' to the supplementary group 'developers' while preserving her existing group memberships (the `-a` flag is essential with `-G` to avoid overwriting them). This matches the requirement exactly.

Answer

newgrp -g 1500 developers; adduser alice developers

Answer

create group developers gid=1500; useradd -G developers alice

Answer

groupadd developers -g 1500; usermod -G developers alice

Question 10

An administrator needs to grant a user 'bob' the ability to run all commands as root without a password prompt. Which configuration in /etc/sudoers accomplishes this?

Accepted Answer

bob ALL=(ALL) NOPASSWD: ALL. Both options A and C grant user bob the ability to run all commands as root without a password. Option A uses `(ALL)` as the runas list, which includes root and any other user, while option C uses `(root)` to restrict to root only. Since the requirement is specifically to run commands as root, both entries satisfy it. Options B and D are incorrect because they require a password (PASSWD is explicit in B, and D omits NOPASSWD, defaulting to requiring a password).

Answer

bob ALL=(ALL) PASSWD: ALL

Answer

bob ALL=(ALL) ALL

Question 11

Which three files contain user account information?

Accepted Answer

/etc/passwd. The /etc/passwd file stores essential user account information, including username, UID, GID, GECOS field, home directory, and default shell. It is world-readable and contains the user's password hash only as a placeholder (typically 'x') to indicate that the actual hash is stored in /etc/shadow. This file is required for user authentication and identification on Linux systems.

Answer

/etc/gshadow

Answer

/etc/login.defs

Question 12

Refer to the exhibit. What is the most likely security issue with this configuration?

Accepted Answer

There are multiple users with UID 0.. The user 'admin' has UID 0 (root UID), giving it root privileges. This is a backdoor or misconfiguration.

Answer

The 'daemon' user has a login shell of /usr/sbin/nologin, which is not secure.

Answer

The 'user1' home directory does not match the username.

Answer

The 'admin' user has no password set (x in place of password).

Question 13

Refer to the exhibit. The 'developers' group has members alice, bob, and charlie. User 'charlie' is not in the 'developers' group. Which statement is true?

Accepted Answer

alice can write to file.txt because she is in the developers group and the file has group write.. alice is a member of the developers group, and the file.txt has group write permissions (as indicated by the exhibit). Therefore, alice can write to file.txt because group permissions apply to her. The group ownership of file.txt is likely 'developers', and the group permission includes write. This is a straightforward application of Linux file permissions.

Answer

bob can delete /shared/project because he is the owner? No, directory permissions apply.

Answer

charlie can read /shared because the directory has world read? No, it's --- for others.

Answer

charlie can list the contents of /shared if he knows the path.

Question 14

A user's account needs to be set to expire on a specific date. Which command should the administrator use?

Accepted Answer

chage -E 2025-01-01 username. The `chage -E` command sets the account expiration date for a user, which is the standard Linux method for specifying when a user account should become disabled. The `-E` flag accepts a date in YYYY-MM-DD format and updates the `/etc/shadow` file's eighth field (account expiration). This is the precise tool for the task described.

Answer

usermod -e 2025-01-01 username

Answer

usermod -c 'expire=2025-01-01' username

Answer

passwd -x 90 username

Question 15

An administrator runs 'pwck' and receives an error indicating a user in /etc/passwd has no matching group in /etc/group. What is the most likely cause and the appropriate corrective action?

Accepted Answer

The user's GID in /etc/passwd is invalid; use usermod -g to set a valid group.. The `pwck` command validates the integrity of the /etc/passwd file. When it reports that a user has no matching group in /etc/group, it means the user's primary group ID (GID) specified in /etc/passwd does not correspond to any existing group entry in /etc/group. The correct action is to use `usermod -g` to assign the user to a valid existing group, which updates the GID field in /etc/passwd.

Answer

The user's secondary group in /etc/group is missing; add the user back to the group.

Answer

The group was deleted with groupdel but the user's primary group in /etc/passwd was not updated; recreate the group.

Answer

The user's password hash is corrupted; run 'pwconv' to synchronize.