LFCS User and Group Management Practice Test 3 — 15 Questions

Question 1

A user reports that they cannot log in via SSH. The system administrator checks that the account is not locked, the password is correct, and the shell is valid. However, the user's home directory is owned by root instead of the user. What is the most likely cause of the login failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The home directory ownership is incorrect, causing SSH PAM session module to reject login. When a user's home directory is owned by root instead of the user, the PAM `pam_namespace` or `pam_selinux` session modules may reject the login because they enforce strict ownership and permissions on the home directory for security. Specifically, `pam_namespace` requires the home directory to be owned by the user to create a polyinstantiated namespace, and `pam_selinux` may fail if it cannot relabel the directory. This results in SSH authentication succeeding but the session failing to open, causing a login failure.

Answer

The user's login shell is not listed in /etc/shells

Answer

The /etc/nologin file exists

Answer

The user's entry in /etc/shadow is corrupted

Question 2

A team of developers must share files under /opt/project. All developers are members of the 'devteam' group. New files must be automatically assigned to group 'devteam' and be writable by the group. Which umask and setgid configuration should be applied?

Accepted Answer

Set setgid bit on /opt/project and set umask for developers to 002. Setting the setgid bit on /opt/project ensures that new files inherit the group ownership of the directory (devteam), and setting the umask to 002 removes write permission for others but preserves group write permission, so new files are group-writable. This combination meets both requirements automatically without manual intervention.

Answer

Set setgid bit on /opt/project and set umask to 007

Answer

Set the sticky bit on /opt/project and umask to 022

Answer

Set umask for developers to 002 only

Question 3

An administrator wants to temporarily disable a user account without deleting it. The account should be locked, expire immediately, and the user should not be able to log in. Which single command accomplishes this with minimum side effects?

Accepted Answer

usermod -L -e 1970-01-01 user1. It combines `usermod -L` to lock the password (preventing authentication via password) with `-e 1970-01-01` to set the account expiration date to January 1, 1970, which immediately expires the account (the epoch date is treated as already past). This ensures the user cannot log in via any method (password, SSH keys, etc.) because the account is both locked and expired, with minimal side effects — no files or home directory are removed.

Answer

usermod -L user1; chage -E 0 user1

Answer

usermod -L user1

Answer

usermod -e 1970-01-01 user1

Question 4

Which TWO commands can change a user's primary group?

Accepted Answer

groupmod -g newGID groupname. `groupmod -g newGID groupname` changes the GID of a group, and since a user's primary group is identified by GID in `/etc/passwd`, altering the group's GID effectively changes the primary group for all users who have that GID as their primary group. Option C is correct because `usermod -g groupname username` directly modifies the user's primary group entry in `/etc/passwd` to the specified group name or GID.

Answer

groupdel groupname

Answer

usermod -G groupname username

Answer

useradd -g groupname username

Question 5

Which TWO options in /etc/shadow are correctly described?

Accepted Answer

The minimum number of days between password changes is the fourth field. The fourth field in /etc/shadow stores the minimum number of days that must pass between password changes. This field prevents users from changing their password too frequently, enforcing password history policies. Option E is correct because the fifth field holds the maximum number of days a password is valid, after which the user is forced to change it.

Answer

The password expiration date is stored in the third field

Answer

The account expiration date is the sixth field

Answer

The number of days since Jan 1, 1970 until the account expires is stored in the seventh field

Question 6

Which THREE fields are part of a standard /etc/group entry?

Accepted Answer

Group password (often 'x'). The /etc/group file traditionally includes a password field for the group, which is often set to 'x' to indicate that a shadowed group password is stored in /etc/gshadow. This field is part of the standard colon-delimited format defined by the system's group database, even though group passwords are rarely used in modern Linux systems.

Answer

Primary GID of user

Answer

Home directory of group

Question 7

Refer to the exhibit. User 'alice' cannot log in. What is the most likely problem?

Accepted Answer

The home directory ownership is incorrect. The exhibit shows that the home directory /home/alice is owned by root, not by user alice. When a user's home directory ownership is incorrect, the login process may fail or the user may be dropped into a restricted environment, as the system cannot write necessary files (like .bashrc or .bash_logout) to the home directory. This is a common misconfiguration that prevents normal login.

Answer

The shadow file is missing alice's entry

Answer

The user's UID or GID is not unique

Answer

The login shell /bin/bash does not exist

Question 8

Refer to the exhibit. User 'alice' is a member of groups 'users' and 'projectx'? She needs to be a member of 'staff' as well. Which of the following statements is true?

Accepted Answer

To become a member of 'staff', alice must either log out and log in, or use newgrp command. When a user is added to a new supplementary group (e.g., 'staff'), the group membership is only applied to new login sessions. The current shell session retains the old group set. To pick up the new group without logging out, the user can run `newgrp staff` to start a new shell with the updated group membership, or log out and log back in. This behavior is governed by how the `initgroups()` function and the `groups` command read the current session's cached group list.

Answer

Alice is a member of 'projectx' but the groups command is outdated

Answer

Alice's primary group is 'users' and she cannot have supplementary groups

Answer

The entry in /etc/group for 'projectx' is incorrect because alice is not a member

Question 9

Refer to the exhibit. Assuming today is Feb 20, 2025, what happens when 'bob' attempts to log in today?

Accepted Answer

Login is successful without warnings. The exhibit shows that 'bob's account has an expiration date of Mar 01, 2025, and today is Feb 20, 2025, so the account is still active. Additionally, the password last changed on Feb 01, 2025, with a maximum password age (PASS_MAX_DAYS) of 30 days, meaning the password will not expire until Mar 03, 2025. Therefore, both the account and password are valid, and no warnings are triggered because the password is not within the typical 7-day warning period (PASS_WARN_AGE) before expiration.

Answer

Login is denied because the password has expired

Answer

Login is successful, but a warning message is displayed that password will expire soon

Answer

Login is denied because the account expired on Mar 01

Question 10

An administrator created a new user 'john' with the default settings, but 'john' cannot log in. The error message indicates an invalid shell. Which command should the administrator use to fix this issue?

Accepted Answer

usermod -s /bin/bash john. The correct command is `usermod -s /bin/bash john` because it modifies an existing user's login shell in the `/etc/passwd` file. The error 'invalid shell' indicates the user's current shell is either missing or not listed in `/etc/shells`, and `usermod` is the proper tool to change a user's attributes after account creation.

Answer

passwd -s john

Answer

useradd -s /bin/bash john

Answer

chsh -s /bin/bash john

Question 11

A system administrator needs to create a new group named 'developers' with GID 1500 and add the user 'alice' to this group. Which set of commands accomplishes this?

Accepted Answer

groupadd -g 1500 developers; usermod -aG developers alice. `groupadd -g 1500 developers` creates the group with the specified GID, and `usermod -aG developers alice` adds the user 'alice' to the supplementary group 'developers' while preserving her existing group memberships (the `-a` flag is essential with `-G` to avoid overwriting them). This matches the requirement exactly.

Answer

newgrp -g 1500 developers; adduser alice developers

Answer

create group developers gid=1500; useradd -G developers alice

Answer

groupadd developers -g 1500; usermod -G developers alice

Question 12

A security policy requires that a user account 'temp_audit' be locked immediately without changing the password. Which command locks the account and prevents login?

Accepted Answer

usermod -L temp_audit. The `usermod -L` command locks a user account by placing an exclamation mark (!) at the beginning of the password hash in /etc/shadow, effectively disabling password-based authentication without altering the existing password. This satisfies the security policy requirement to immediately prevent login without changing the password.

Answer

userdel temp_audit

Answer

chage -E 0 temp_audit

Answer

passwd -u temp_audit

Question 13

An administrator wants to force a user to change their password at next login. Which command should be used?

Accepted Answer

passwd -e user. The `passwd -e user` command immediately expires the user's password, forcing them to change it at the next login. This is the standard method to achieve this requirement on Linux systems.

Answer

passwd -l user

Answer

chage -m 0 user

Answer

usermod -p '!' user

Question 14

A large company needs to create 100 user accounts from a list of names in a CSV file. Which tool is most efficient for batch user creation?

Accepted Answer

newusers. The `newusers` command is the most efficient tool for batch user creation because it reads a file in a specific format (username:password:UID:GID:comment:home_directory:shell) and can create multiple user accounts in a single pass, automatically handling password hashing and home directory creation. This avoids the overhead of scripting loops and multiple `useradd` invocations, making it ideal for bulk operations like creating 100 accounts from a CSV list.

Answer

vipw

Answer

for loop with useradd

Answer

pwconv

Question 15

A user reports that they cannot execute a file even though they are in the file's group. The file has permissions 644 and group ownership 'staff'. The user is a member of 'staff'. What is the likely issue?

Accepted Answer

The file lacks execute permission for the group. The file has permissions 644, which means the owner has read/write (6), the group has read-only (4), and others have read-only (4). Since the user is a member of the group 'staff' but not the owner, they fall under the group permission class. The group lacks execute permission (the 'x' bit), so the user cannot execute the file. Execute permission is required to run a file as a command or script, regardless of group membership.

Answer

The file does not have the setgid bit

Answer

The user's primary group is not 'staff'

Answer

The user is not the owner of the file