LFCS User and Group Management Practice Test 3 — 15 Questions

Question 1

An administrator needs to create a user 'john' with a home directory in /data/home/john, a UID of 1500, and membership in the group 'developers' as a secondary group. The group 'developers' already exists. Which single command accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

useradd -u 1500 -d /data/home/john -G developers john. The correct command is 'useradd -u 1500 -d /data/home/john -G developers john'. The -u option sets the UID, -d sets the home directory, and -G specifies supplementary groups (secondary groups). The -g option sets the primary group, which is not what we want here since 'developers' should be a secondary group. The other options either use incorrect syntax, miss the -G flag, or use a non-existent 'adduser' command with wrong options.

Answer

adduser --uid 1500 --home /data/home/john --group developers john

Answer

useradd john; usermod -u 1500 -d /data/home/john -G developers john

Answer

useradd -u 1500 -d /data/home/john -g developers john

Question 2

A user 'alice' has a umask of 027 in her .bashrc, but the system administrator wants to enforce a umask of 007 for all users in the 'staff' group. Where should the administrator place the umask command to ensure it cannot be overridden by users?

Accepted Answer

In /etc/pam.d/common-session with pam_umask.so. pam_umask.so in /etc/pam.d/common-session (or the equivalent PAM session stack) enforces umask at login via PAM, which users cannot override by editing their shell rc files. Because PAM runs before the shell reads .bashrc, the umask set by pam_umask.so is applied to the session and takes precedence over user-level settings. This is the only option that provides system-enforced, non-overridable umask control.

Answer

/etc/bash.bashrc

Answer

/etc/skel/.bashrc

Answer

/etc/profile

Question 3

Which THREE of the following are valid methods to temporarily switch to a different user account without logging out entirely? (Choose three.)

Accepted Answer

sudo -u username -s. Option A (sudo -u username -s) is correct because sudo with -u runs a shell as the specified target user, and -s invokes the user's shell, effectively switching identity without ending the current login session. Option B (su - username) is correct because su starts a login shell as the target user, changing the effective UID and loading that user's environment while the original session remains active in the background. Option E (runuser -l username -c 'bash') is correct because runuser, like su, changes to the target user and -l produces a login shell, with -c 'bash' executing bash as that user, all without logging out. Option C (newgrp groupname) is not a user-account switch; it only changes the current user's effective primary group in a new shell. Option D (login username) is not a temporary switch because login replaces the current session with a fresh login process, requiring re-authentication and ending the existing session.

Answer

newgrp groupname

Answer

login username

Question 4

Which TWO commands are used to modify user account attributes such as password age, expiration, or lock status? (Choose two.)

Accepted Answer

chage. Option A, chage, is correct because it is the dedicated utility for modifying password aging parameters in /etc/shadow, such as minimum/maximum password age (-m/-M), warning days (-W), account expiration (-E), and last change date (-d). Option D, usermod, is correct because it modifies existing user account attributes, including account expiration via -e and lock/unlock status via -L/-U, as well as other account properties. Option B, useradd, is incorrect because it creates new accounts rather than modifying existing ones. Option C, chsh, is incorrect because it only changes a user's login shell. Option E, passwd, is incorrect because it primarily sets or changes passwords and can lock/unlock an account with -l/-u, but it does not manage password aging or expiration attributes like chage and usermod do.

Answer

useradd

Answer

chsh

Answer

passwd

Question 5

Refer to the exhibit. An administrator adds user 'frank' to the group 'projectx' by editing /etc/group directly and changing the line to 'projectx:x:500:carol,dave,frank'. After saving, the administrator runs 'groups frank' and sees only 'frank' in the output. Why does frank not appear in the group 'projectx'?

Accepted Answer

The user 'frank' is still logged into the same session; he must log out and log back in for the new group to be recognized.. The `groups` command shows the current effective group membership of the user's shell session, which is cached at login time. When `/etc/group` is edited directly, the change is written to disk immediately, but the running shell for user 'frank' still holds the old group membership list from the login process. The new group 'projectx' will only appear after 'frank' logs out and logs back in, or starts a new login shell (e.g., `su - frank`).

Answer

Editing /etc/group directly is not a valid method; 'usermod -aG' must be used instead.

Answer

The group 'projectx' has a GID conflict with another group.

Answer

The 'groups' command reads only from /etc/group and the change should appear immediately.

Question 6

Refer to the exhibit. The shadow entry for user 'carol' shows 18000 in the third field. What does the value 18000 represent?

Accepted Answer

The number of days since the password was last changed.. In /etc/shadow, the third field is the date of the last password change, expressed as the number of days since January 1, 1970 (Unix epoch). A value of 18000 corresponds to roughly 49 years after epoch, i.e., around 2019. This field is used with PASS_MAX_DAYS and PASS_MIN_DAYS to compute password expiration.

Answer

The number of days until the account expires.

Answer

The minimum number of days required between password changes.

Answer

The number of days before password expiration that the user is warned.

Question 7

Refer to the exhibit. What is the primary group ID of user 'charlie'?

Accepted Answer

1005 (the same as UID). The primary group ID for user 'charlie' is 1005. By default, Linux creates a private user group for each new user with a GID equal to the user's UID. Both option C, which adds explanatory context, and option D, which provides the numeric value alone, are factually correct. Therefore, both are acceptable answers.

Answer

1000

Answer

Charlie Brown

Question 8

A system administrator needs to add a new user 'alice' with UID 1050 and a home directory at /home/alice. Which command should be used?

Accepted Answer

useradd -u 1050 -d /home/alice -m alice. Options A and D are both correct. Option A uses `-u 1050` to set UID, `-d /home/alice` to specify the home directory, and `-m` to create it. Option D uses `--create-home` which creates the home directory at the default location `/home/alice`, and `--skel /etc/skel` to copy skeleton files; the home directory path defaults to `/home/alice`, satisfying the requirement. Option B uses incorrect flags `-U` and `-h`. Option C uses `--home` but does not include `--create-home` or `-m`, so the home directory is not created.

Answer

useradd -U 1050 -h /home/alice alice

Answer

useradd --uid 1050 --home /home/alice alice

Question 9

After attempting to log in as user 'alice', the system rejects the password. The admin checks /etc/passwd and sees 'alice:x:1001:1001::/home/alice:/bin/bash'. The /etc/shadow shows 'alice:!!:18200:0:99999:7:::', indicating the account is locked. Which command will unlock the account?

Accepted Answer

usermod -U alice. The `usermod -U alice` command unlocks the user account by removing the `!` from the password hash field in `/etc/shadow`. The `!!` in the shadow file indicates the account is locked (password disabled), and `-U` explicitly unlocks it, restoring the password hash to an active state.

Answer

passwd -S alice

Answer

passwd -u alice

Answer

chage -d 0 alice

Question 10

An admin needs to change the primary group of user 'alice' from 'grp1' to 'grp2', but alice should still be a member of 'grp1' as a supplementary group. Which command accomplishes this?

Accepted Answer

usermod -g grp2 -aG grp1 alice. The usermod -g grp2 changes the primary group to grp2, and -aG grp1 adds grp1 as a supplementary group without removing other supplementary groups, satisfying the requirement that alice remains a member of grp1.

Answer

usermod -s /bin/bash alice

Answer

usermod -g grp2 alice

Answer

usermod -G grp2 alice

Question 11

After running 'chage -l bob', the output shows: 'Last password change: Apr 01, 2023', 'Password expires: May 31, 2023', 'Account expires: Jul 15, 2023'. What will happen on May 31, 2023?

Accepted Answer

Bob can still log in but will be forced to change his password.. On May 31, 2023, Bob's password expires. According to the PAM (Pluggable Authentication Modules) configuration and the `chage` command's behavior, a password expiration does not lock the account or disable the password; instead, it forces the user to change their password at the next login. The user can still authenticate with their current password, but upon successful authentication, the system will prompt them to set a new password before granting access to the shell.

Answer

Bob's account will be locked.

Answer

Bob's password will be disabled.

Answer

Bob will receive a warning message only.

Question 12

Which TWO commands will correctly add the user 'john' to the 'docker' group without removing him from any existing supplementary groups?

Accepted Answer

gpasswd -a john docker. Option B, `gpasswd -a john docker`, is correct because the `-a` (add) flag appends the specified user to the named group's membership list, preserving all of john's existing supplementary group memberships. Option E, `usermod -aG docker john`, is correct because the `-a` (append) flag combined with `-G` adds john to the supplementary group `docker` without removing him from any other supplementary groups he already belongs to. Option A, `adduser john docker`, is wrong because `adduser` is for creating new users, not for adding an existing user to a group. Option C, `groupmod -a john docker`, is wrong because `groupmod` modifies group attributes (like GID or name) and has no valid `-a` option for adding users. Option D, `usermod -G docker john`, is wrong because omitting the `-a` flag causes `-G` to replace john's entire supplementary group list with only `docker`, removing him from all other supplementary groups.

Answer

adduser john docker

Answer

groupmod -a john docker

Answer

usermod -G docker john

Question 13

Which THREE of the following actions require root privileges?

Accepted Answer

Changing another user's password. Option B is correct because changing another user's password requires modifying the protected /etc/shadow file (via passwd <username>), which only root can do. Option D is correct because /etc/shadow stores hashed passwords and is readable only by root (mode 000 or 640 with root:shadow ownership), so viewing it requires root privileges. Option E is correct because creating a new group modifies /etc/group and /etc/gshadow through commands like groupadd, which are restricted to root. Option A is not correct because users may change their own login shell with chsh, provided the shell is listed in /etc/shells. Option C is not correct because users can change their own password with passwd, which is setuid root but authenticates the user's existing password rather than requiring root privileges.

Answer

Changing your own login shell

Answer

Changing your own password

Question 14

You are a systems administrator at a company that uses a centralized LDAP server for authentication, but also maintains local users for emergency access. Recently, the compliance team mandated that all service accounts must have passwords that expire every 90 days. You have a local service account 'svc_backup' with UID 2000 and GID 2000. The account is used by a backup script that runs nightly. You have updated the password aging policy but the account still shows 'Password expires : never' when you run 'chage -l svc_backup'. You suspect that the account was created without an expiry date. Which command would you use to force the password to expire 90 days from now and also ensure that the account's password is changed at the next login?

Accepted Answer

chage -M 90 -d 0 svc_backup. The command 'chage -M 90 -d 0 svc_backup' sets the maximum password age to 90 days (-M 90) and sets the last password change date to day 0 (-d 0), which forces the password to expire immediately and requires a change at next login. This directly addresses both requirements: a 90-day expiry policy and forcing a change at next login. The -d 0 effectively backdates the last change so the password is already past its maximum age.

Answer

usermod -e $(date -d '+90 days' +%Y-%m-%d) svc_backup

Answer

passwd -x 90 svc_backup

Answer

chage -W 7 -I 30 svc_backup

Question 15

You are managing a Linux server that hosts web applications. Developers often need to access the server via SSH using their personal accounts. You have been asked to create a new user 'devops' who will have sudo privileges to restart services. The user 'devops' should be a member of the 'sudo' group and also have a secondary group 'devs' for file access. The user's home directory should be /home/devops. You need to create this user with a password that is set to expire immediately so that the user must choose a new password upon first login. Which command would you use to accomplish this?

Accepted Answer

useradd -m -g devs -G sudo devops && chage -d 0 devops. Useradd -m creates the home directory /home/devops. -g devs sets the primary group to 'devs', which is the secondary group for file access mentioned in the requirement. -G sudo adds the user to the 'sudo' group for sudo privileges. chage -d 0 sets the last password change date to 0, forcing the user to change the password on first login. Option A uses -g sudo as primary group (should be devs) and -G devs (should be sudo), and passwd -e is not a valid command to force password expiration; use chage -d 0 instead. Option C does not set a primary group, so it defaults to a new group 'devops'; -p '' sets an empty password which is insecure but does not force a change on first login; passwd -d removes the password entirely. Option D sets primary group to sudo (incorrect), uses -e 0 which sets account expiry date, not password expiry; and hashing a temp password does not force a change.

Answer

useradd -m -g sudo -G devs devops && passwd -e devops

Answer

useradd -m -G sudo,devs -p '' devops && passwd -d devops

Answer

useradd -m -g sudo -G devs -p $(openssl passwd -1 temp) -e 0 devops