LFCS User and Group Management Practice Test 3 — 15 Questions

Question 1

A team of developers must share files under /opt/project. All developers are members of the 'devteam' group. New files must be automatically assigned to group 'devteam' and be writable by the group. Which umask and setgid configuration should be applied?

Accepted Answer

Set setgid bit on /opt/project and set umask for developers to 002. Option A is correct: chmod g+s sets the setgid bit so new files inherit the group; umask 002 gives group write permission (files 664, dirs 775). Option B: umask 002 but no setgid means new files will inherit the creator's primary group, not necessarily 'devteam'. Option C: umask 007 removes group permissions entirely. Option D: umask 022 gives group read-only.

Answer

Set setgid bit on /opt/project and set umask to 007

Answer

Set the sticky bit on /opt/project and umask to 022

Answer

Set umask for developers to 002 only

Question 2

An administrator wants to temporarily disable a user account without deleting it. The account should be locked, expire immediately, and the user should not be able to log in. Which single command accomplishes this with minimum side effects?

Accepted Answer

usermod -L -e 1970-01-01 user1. Option C is correct because usermod -L locks the password (adds ! in shadow) and -e 1970-01-01 sets account expiration far in the past, effectively locking. Option A does not expire; chage -E also sets expiration but -L locks. Option B locks but does not expire. Option D sets expiration but does not lock password.

Answer

usermod -L user1; chage -E 0 user1

Answer

usermod -L user1

Answer

usermod -e 1970-01-01 user1

Question 3

Which TWO commands can change a user's primary group?

Accepted Answer

groupmod -g newGID groupname. Options A and D are correct. usermod -g changes the primary group for existing user. groupmod -g changes the GID of a group, but if that group is the primary group of a user, the user's primary GID changes accordingly. Option B changes supplementary groups. Option C deletes group. Option E adds a new user with specified primary group.

Answer

groupdel groupname

Answer

usermod -G groupname username

Answer

useradd -g groupname username

Question 4

Which TWO options in /etc/shadow are correctly described?

Accepted Answer

The minimum number of days between password changes is the fourth field. Options B and E are correct. The shadow file has 9 fields: login name, encrypted password, last changed, minimum, maximum, warning, inactivity, expiration, reserved. Option B: maximum days between password changes is field 5. Option E: minimum days between password changes is field 4. Option A: password expiration date is not directly stored; it's calculated from last change + max. Option C: account expiration date is field 8, not 6. Option D: days since Jan 1, 1970 when account expires is indeed in field 8 but that's the account expiration field, not password change.

Answer

The password expiration date is stored in the third field

Answer

The account expiration date is the sixth field

Answer

The number of days since Jan 1, 1970 until the account expires is stored in the seventh field

Question 5

Which THREE fields are part of a standard /etc/group entry?

Accepted Answer

Group password (often 'x'). Options A, C, and E are correct. /etc/group has four fields: group_name, password (usually 'x' or empty), GID, and comma-separated list of members. Option B: user's primary GID is in /etc/passwd, not /etc/group. Option D: home directory is in /etc/passwd.

Answer

Primary GID of user

Answer

Home directory of group

Question 6

Refer to the exhibit. User 'alice' cannot log in. What is the most likely problem?

Accepted Answer

The home directory ownership is incorrect. Option B is correct because the home directory is owned by root, not alice. Many systems use PAM modules like pam_umask that require the home directory to be owned by the user. Option A: shadow entry seems valid (x indicates password in shadow). Option C: shell is /bin/bash which is valid. Option D: UID exists and matches; GID is 1001, group may exist but missing group entry affects group permissions, not login directly.

Answer

The shadow file is missing alice's entry

Answer

The user's UID or GID is not unique

Answer

The login shell /bin/bash does not exist

Question 7

Refer to the exhibit. User 'alice' is a member of groups 'users' and 'projectx'? She needs to be a member of 'staff' as well. Which of the following statements is true?

Accepted Answer

To become a member of 'staff', alice must either log out and log in, or use newgrp command. Option C is correct. The groups command shows only 'users', meaning her secondary groups are not updated; she is not actually a member of 'projectx' yet because new group memberships require re-login. Option A: /etc/group lists her in projectx but groups command hasn't updated because she hasn't re-logged in. Option B: She is in users as primary? Actually users is likely her primary group? Not necessarily, but the groups command shows users as the only group. Option D: The primary group is determined by /etc/passwd, not shown here.

Answer

Alice is a member of 'projectx' but the groups command is outdated

Answer

Alice's primary group is 'users' and she cannot have supplementary groups

Answer

The entry in /etc/group for 'projectx' is incorrect because alice is not a member

Question 8

Refer to the exhibit. Assuming today is Feb 20, 2025, what happens when 'bob' attempts to log in today?

Accepted Answer

Login is successful without warnings. Option D is correct. Account expiration is Mar 01, 2025, which is in the future, so account is not yet expired. Password expires on Apr 15, also future. Warning period started after Jan 15+81 days? Actually warning starts 7 days before expiration, which would be around Apr 8, not yet. So login should succeed. Option A: Account expires Mar 01, not yet. Option B and C are incorrect because conditions are not met.

Answer

Login is denied because the password has expired

Answer

Login is successful, but a warning message is displayed that password will expire soon

Answer

Login is denied because the account expired on Mar 01

Question 9

An administrator created a new user 'john' with the default settings, but 'john' cannot log in. The error message indicates an invalid shell. Which command should the administrator use to fix this issue?

Accepted Answer

usermod -s /bin/bash john. The user's shell is likely set to /sbin/nologin or a non-existent shell. usermod -s /bin/bash changes the shell to a valid one.

Answer

passwd -s john

Answer

useradd -s /bin/bash john

Answer

chsh -s /bin/bash john

Question 10

A system administrator needs to create a new group named 'developers' with GID 1500 and add the user 'alice' to this group. Which set of commands accomplishes this?

Accepted Answer

groupadd -g 1500 developers; usermod -aG developers alice. First create the group with the specific GID using groupadd -g, then add the user to the group using usermod -aG.

Answer

newgrp -g 1500 developers; adduser alice developers

Answer

create group developers gid=1500; useradd -G developers alice

Answer

groupadd developers -g 1500; usermod -G developers alice

Question 11

A security policy requires that a user account 'temp_audit' be locked immediately without changing the password. Which command locks the account and prevents login?

Accepted Answer

usermod -L temp_audit. usermod -L locks the account by placing an '!' in the password field of /etc/shadow, preventing password authentication.

Answer

userdel temp_audit

Answer

chage -E 0 temp_audit

Answer

passwd -u temp_audit

Question 12

An administrator wants to force a user to change their password at next login. Which command should be used?

Accepted Answer

passwd -e user. chage -d 0 sets the last password change date to the epoch (1970-01-01), forcing a password change on next login.

Answer

passwd -l user

Answer

chage -m 0 user

Answer

usermod -p '!' user

Question 13

A large company needs to create 100 user accounts from a list of names in a CSV file. Which tool is most efficient for batch user creation?

Accepted Answer

newusers. The newusers command reads a file with specific format (username:password:UID:GID:... ) and creates multiple users at once.

Answer

vipw

Answer

for loop with useradd

Answer

pwconv

Question 14

A user reports that they cannot execute a file even though they are in the file's group. The file has permissions 644 and group ownership 'staff'. The user is a member of 'staff'. What is the likely issue?

Accepted Answer

The file lacks execute permission for the group. The file permissions 644 (rw-r--r--) do not include execute for group, so the user cannot execute it.

Answer

The file does not have the setgid bit

Answer

The user's primary group is not 'staff'

Answer

The user is not the owner of the file

Question 15

An administrator needs to grant a user 'bob' the ability to run all commands as root without a password prompt. Which configuration in /etc/sudoers accomplishes this?

Accepted Answer

bob ALL=(ALL) NOPASSWD: ALL. The line 'bob ALL=(ALL) NOPASSWD: ALL' in /etc/sudoers gives bob full passwordless sudo access.

Answer

bob ALL=(ALL) PASSWD: ALL

Answer

bob ALL=(root) NOPASSWD: ALL

Answer

bob ALL=(ALL) ALL