LFCS User and Group Management Practice Test 2 — 15 Questions

Question 1

An administrator needs to grant a user named 'john' the ability to switch to any other user without a password. Which TWO of the following steps are required to achieve this?

Accepted Answer

Add 'john' to the 'wheel' group and configure /etc/pam.d/su to use pam_wheel.so with the 'trust' option.. Adding 'john' to the 'wheel' group and configuring /etc/pam.d/su with pam_wheel.so and the 'trust' option allows members of the 'wheel' group to switch to any user via su without being prompted for a password. The 'trust' modifier in PAM bypasses the password authentication for users in the specified group, effectively granting passwordless su access.

Answer

Set the suid bit on /bin/su.

Answer

Run 'usermod -L john'.

Answer

Add 'john' to the 'root' group.

Question 2

A user named 'charlie' has just been added to the 'devops' group. However, when 'charlie' runs 'sudo -l', no sudo entries are shown. What is the most likely cause?

Accepted Answer

'charlie' must log out and log back in for the group change to take effect.. When a user is added to a new group, the group membership is only applied to new login sessions. The `sudo -l` command checks the user's current group memberships, which are cached at login time. Since 'charlie' was added to the 'devops' group while already logged in, the new group membership is not reflected until 'charlie' logs out and logs back in, or uses `newgrp` or `sg` to start a new session with the updated groups.

Answer

'charlie' is not listed by name in the sudoers file.

Answer

'charlie' is also a member of another group that restricts sudo.

Answer

The systemctl command is not executable by 'charlie'.

Answer

The sudoers file has a syntax error.

Question 3

Scenario: You are managing a Linux server that hosts a web application. The application runs under the user 'webapp' and the group 'webgroup'. Recently, a new intern 'john' (username 'john') needs to be able to view and modify files in /var/www/html, which is owned by root:webgroup with permissions 775. John is currently a member of the group 'staff', but not 'webgroup'. The security policy requires that John must be able to edit files without using sudo, and his primary group must remain 'staff'. Which of the following actions should you take to meet the requirements?

Accepted Answer

Add John to the 'webgroup' supplementary group with 'usermod -a -G webgroup john'.. Adding John to the 'webgroup' supplementary group with `usermod -a -G webgroup john` grants him group-level access to /var/www/html (owned by root:webgroup with permissions 775) without changing his primary group 'staff'. This allows him to view and modify files as a member of 'webgroup', satisfying the security policy that he must not use sudo and his primary group must remain unchanged.

Answer

Change the group ownership of /var/www/html to 'staff' and set the setgid bit.

Answer

Change John's primary group to 'webgroup' with 'usermod -g webgroup john'.

Answer

Set the setgid bit on /var/www/html with 'chmod g+s /var/www/html'.

Question 4

Arrange the steps to configure a new user account with sudo privileges on a Linux system.

Accepted Answer

Step 1: Create the user account with useradd. Step 2: Set a password with passwd. Step 3: Add the user to the sudo group (e.g., wheel) with usermod -aG. Step 4: Verify sudo access by running a command like 'sudo -l' or 'sudo whoami'.. After creating the user and setting a password, adding to the wheel group grants sudo access. Verification and testing confirm it works.

Answer

Step 1: Create the user account. Step 2: Set a password. Step 3: Test sudo access. Step 4: Add the user to the sudo group.

Answer

Step 1: Create the user account. Step 2: Add the user to the sudo group. Step 3: Test sudo access. Step 4: Set a password.

Answer

Step 1: Add the user to the sudo group. Step 2: Create the user account. Step 3: Set a password. Step 4: Test sudo access.

Question 5

Order the steps to create a systemd service unit that runs a script at boot.

Accepted Answer

Create the unit file, then enable the service for boot, then start the service, then check the status.. Creating the unit file, enabling for boot, starting, and checking status are standard steps.

Answer

Start the service, then create the unit file, then enable for boot, then check status.

Answer

Enable the service for boot, then create the unit file, then start, then check status.

Answer

Create the unit file, then start the service, then enable for boot, then check status.

Question 6

Order the steps to set up passwordless SSH key-based authentication.

Accepted Answer

Generate SSH key pair using ssh-keygen, then copy the public key to the remote server using ssh-copy-id, then set correct permissions on the remote server (chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys), then test the SSH login without a password prompt.. Key generation, copying, and testing are essential; permissions and file verification ensure security.

Answer

Copy the public key to the remote server using ssh-copy-id first, then generate the SSH key pair, then set permissions, then test login.

Answer

Generate SSH key pair, then set permissions on the remote server, then test login, then copy the public key.

Answer

Generate SSH key pair, then set permissions on the local machine, then copy the public key to the remote server, then test login.

Question 7

Match each Linux boot component to its description.

Accepted Answer

BIOS/UEFI: Firmware that initializes hardware and loads the bootloader.. The correct matches are: BIOS/UEFI initializes hardware and loads the bootloader; Initramfs is the temporary root filesystem; Systemd is the init system. Common confusions occur between kernel and bootloader roles.

Answer

Bootloader (GRUB): Core of the OS that manages hardware and processes.

Answer

Kernel: Loads the kernel and initramfs into memory.

Question 8

Match each Linux filesystem hierarchy standard (FHS) directory to its purpose.

Accepted Answer

/boot: Contains the boot loader and kernel images. The correct matches pair each standard FHS directory with its primary purpose. Common confusions include mixing up /bin with /etc, /root with /dev, and /opt with /tmp.

Answer

/bin: Contains configuration files

Answer

/root: Contains device files

Answer

/opt: Contains temporary files

Question 9

Match each logical volume management (LVM) term to its definition.

Accepted Answer

Physical Volume: A physical disk or partition used by LVM.. Physical Volume (PV) is the raw disk/partition; Volume Group (VG) pools PVs; Logical Volume (LV) is a virtual device from a VG; Physical Extent (PE) is the fixed-size chunk in a PV. Common confusions: swapping LV and PV, or VG and PE.

Answer

Physical Volume: A virtual block device created from a volume group.

Answer

Volume Group: The smallest unit of storage in a physical volume.

Question 10

A system administrator needs to create a user account for a temporary contractor. The account should have a home directory under /home/contractors, the login shell should be /bin/bash, and the user should be a member of the 'contractors' group. Which command accomplishes this?

Accepted Answer

useradd -m -d /home/contractors/tempuser -s /bin/bash -g contractors tempuser. The `-g` flag specifies the primary group for the user, which in this case is 'contractors'. The `-m` flag creates the home directory, `-d` sets the home directory path to `/home/contractors/tempuser`, and `-s` sets the login shell to `/bin/bash`. This satisfies all requirements: the user 'tempuser' will have a home directory under `/home/contractors`, use `/bin/bash` as their shell, and be a member of the 'contractors' group as their primary group.

Answer

useradd -m -d /home/contractors/tempuser -s /bin/bash -G contractors tempuser

Answer

useradd -m -h /home/contractors/tempuser -s /bin/bash -g contractors tempuser

Answer

useradd -m -d /home/contractors/tempuser -s /bin/bash -p contractors tempuser

Question 11

A security policy requires that a user's password must expire 90 days after last change, and the user must change it immediately on next login. The last password change was 30 days ago. Which set of commands achieves this?

Accepted Answer

chage -M 90 user1; chage -d 0 user1. `chage -M 90 user1` sets the maximum password age to 90 days, and `chage -d 0 user1` forces the password to expire immediately (setting the last change date to epoch 0), which requires the user to change the password on the next login. This satisfies both requirements: the password will expire 90 days after the forced change, and the user must change it immediately.

Answer

chage -M 90 user1; chage -m 1 user1

Answer

chage -M 90 user1; chage -W 7 user1

Answer

chage -M 90 user1; chage -I 5 user1

Question 12

An administrator needs to create a system user that runs a service (no login, no home directory). Which command is appropriate?

Accepted Answer

useradd -r -M myservice. The `-r` flag creates a system user (UID below SYSTEM_UID_MIN, typically 1000) without a home directory by default, and `-M` explicitly overrides any default that might create a home directory, ensuring no home directory is created. This matches the requirement for a service account that does not need login or a home directory.

Answer

useradd -r myservice

Answer

useradd -r -m myservice

Answer

useradd -M myservice

Question 13

Existing user 'jdoe' is a member of groups 'users' (primary) and 'staff'. The administrator needs to add 'jdoe' to group 'projectx' while preserving existing supplementary group memberships. Which command achieves this?

Accepted Answer

usermod -a -G projectx jdoe. The `-a` (append) flag combined with `-G` (supplementary groups) adds the user to the specified group without removing existing supplementary group memberships. Without `-a`, the `-G` flag replaces all supplementary groups with the listed ones, which would remove the 'staff' group membership.

Answer

usermod -g projectx -G projectx jdoe

Answer

usermod -g projectx jdoe

Answer

usermod -G projectx jdoe

Question 14

An administrator needs to delete user 'obsolete' and remove its home directory and mail spool. Which command should be used?

Accepted Answer

userdel -r obsolete. The correct command is `userdel -r obsolete` because the `-r` flag removes the user's home directory and mail spool in addition to deleting the user account. This matches the requirement to delete the user 'obsolete' along with its home directory and mail spool, as specified in the question.

Answer

userdel -f obsolete

Answer

userdel obsolete

Answer

groupdel obsolete

Question 15

A company follows the principle of least privilege. Several developers need sudo access to run specific commands like systemctl and journalctl. What is the best practice for granting this access?

Accepted Answer

Create a new group 'devops', add developers to it, and create a sudoers drop-in file with rules for specific commands. It follows the principle of least privilege by creating a dedicated 'devops' group and using a sudoers drop-in file (e.g., /etc/sudoers.d/devops) to grant only specific commands like systemctl and journalctl. This avoids modifying the main /etc/sudoers file directly, which is error-prone, and ensures that developers have no more privileges than necessary. The drop-in file approach is the recommended best practice for maintainability and security.

Answer

Use 'usermod -a -G sudo' for each developer and edit /etc/sudoers manually with visudo

Answer

Add all developers to the 'wheel' group and configure %wheel ALL=(ALL) ALL

Answer

Edit /etc/sudoers directly to add each developer username with command restrictions