LFCS User and Group Management Practice Test 4 — 15 Questions

Question 1

An administrator needs to grant a user 'bob' the ability to run all commands as root without a password prompt. Which configuration in /etc/sudoers accomplishes this?

Accepted Answer

bob ALL=(ALL) NOPASSWD: ALL. Both options A and C grant user bob the ability to run all commands as root without a password. Option A uses `(ALL)` as the runas list, which includes root and any other user, while option C uses `(root)` to restrict to root only. Since the requirement is specifically to run commands as root, both entries satisfy it. Options B and D are incorrect because they require a password (PASSWD is explicit in B, and D omits NOPASSWD, defaulting to requiring a password).

Answer

bob ALL=(ALL) PASSWD: ALL

Answer

bob ALL=(ALL) ALL

Question 2

A temporary contractor 'contractor1' has left the company. The administrator needs to remove the user account and all associated files in the home directory. Which command accomplishes this?

Accepted Answer

userdel -r contractor1. The `userdel -r contractor1` command removes the user account and, with the `-r` flag, also deletes the user's home directory and mail spool. This is the standard Linux command to completely remove a user and their associated files, as required by the scenario.

Answer

userdel contractor1

Answer

passwd -d contractor1

Answer

deluser --remove-home contractor1

Question 3

An administrator needs to view a list of users who have logged in recently. Which command provides this information?

Accepted Answer

last. The `last` command reads the `/var/log/wtmp` file to display a list of all users who have logged in and out, including recent login sessions. This makes it the correct choice for viewing a history of recent logins, as it provides timestamps, duration, and originating host information.

Answer

users

Answer

who

Answer

finger

Question 4

Which two commands can be used to set password expiration policies for a user?

Accepted Answer

passwd. The `passwd` command can set password expiration policies using options like `-x` (maximum days), `-n` (minimum days), `-w` (warning days), and `-i` (inactive days). The `chage` command is the dedicated tool for managing password aging, allowing you to set all expiration parameters interactively or via command-line options. Both commands modify the `/etc/shadow` file to enforce password aging policies.

Answer

usermod

Answer

expiry

Answer

pwconv

Question 5

Which three files contain user account information?

Accepted Answer

/etc/passwd. The /etc/passwd file stores essential user account information, including username, UID, GID, GECOS field, home directory, and default shell. It is world-readable and contains the user's password hash only as a placeholder (typically 'x') to indicate that the actual hash is stored in /etc/shadow. This file is required for user authentication and identification on Linux systems.

Answer

/etc/gshadow

Answer

/etc/login.defs

Question 6

Which two commands can add an existing user to a supplementary group?

Accepted Answer

gpasswd -a. The `gpasswd -a` command adds a user to a specified group, and `usermod -aG` appends a user to a supplementary group without removing them from other groups. Both commands modify the `/etc/group` file to include the user in the group's member list, making them correct for adding an existing user to a supplementary group.

Answer

useradd -G

Answer

addgroup

Answer

groupmod

Question 7

Refer to the exhibit. What is the most likely security issue with this configuration?

Accepted Answer

There are multiple users with UID 0.. The user 'admin' has UID 0 (root UID), giving it root privileges. This is a backdoor or misconfiguration.

Answer

The 'daemon' user has a login shell of /usr/sbin/nologin, which is not secure.

Answer

The 'user1' home directory does not match the username.

Answer

The 'admin' user has no password set (x in place of password).

Question 8

Refer to the exhibit. The 'developers' group has members alice, bob, and charlie. User 'charlie' is not in the 'developers' group. Which statement is true?

Accepted Answer

alice can write to file.txt because she is in the developers group and the file has group write.. Alice is a member of the 'developers' group, which has group ownership of 'file.txt'. Since the file has group write permissions, Alice can write to it. Bob's statement about deleting /shared/project is incorrect because directory permissions (specifically write on the directory) determine deletion, not ownership alone. Charlie cannot access /shared because permissions are 770 (wx for owner and group, no permissions for others), and he is not in the developers group. Therefore, option A is correct.

Answer

bob can delete /shared/project because he is the owner? No, directory permissions apply.

Answer

charlie can read /shared because the directory has world read? No, it's --- for others.

Answer

charlie can list the contents of /shared if he knows the path.

Question 9

Refer to the exhibit. The administrator attempted to create a user 'newuser' but received an error. Which command should be used to check if the user already exists?

Accepted Answer

cat /etc/passwd | grep newuser. The /etc/passwd file stores all user account information, and using cat to pipe its contents through grep allows the administrator to search for the specific username 'newuser'. If the user exists, grep will output the matching line; if not, no output is returned. This is a standard, quick method to verify user existence without modifying system state.

Answer

passwd -S newuser

Answer

usermod -c newuser

Answer

userdel -v newuser

Question 10

A junior administrator issued the command 'usermod -L alice' to lock the account of user alice. However, alice is still able to log in via SSH using a public key. What is the most likely reason?

Accepted Answer

The usermod -L command only locks the password but does not prevent SSH key-based authentication.. The `usermod -L` command locks the user's password by placing an exclamation mark (!) in the second field of the /etc/shadow file, which prevents password-based authentication. However, SSH public key authentication does not rely on the password field; it uses the authorized_keys file and the SSH daemon's public key challenge-response mechanism. Therefore, even with a locked password, the user can still log in via SSH if their public key is present in ~/.ssh/authorized_keys.

Answer

The usermod -L command only changes the user's shell to /sbin/nologin.

Answer

The usermod -L command requires a restart of the SSH service to take effect.

Answer

The usermod -L command is not effective on accounts with a UID less than 1000.

Question 11

A system administrator needs to create a shared group 'projectx' and add existing users 'bob' and 'carol' to it. The users need to collaborate on files in a directory /projectx. What is the correct sequence of commands to set up the group and ensure new files created in /projectx are automatically owned by the group 'projectx'?

Accepted Answer

groupadd projectx; usermod -aG projectx bob; usermod -aG projectx carol; chmod g+s /projectx. It uses `groupadd` to create the group, `usermod -aG` to append users to the group without removing them from other groups, and `chmod g+s` to set the setgid bit on the directory. The setgid bit ensures that new files created in /projectx inherit the group ownership of the directory (projectx), enabling collaboration.

Answer

groupadd projectx; usermod -G projectx bob carol; chmod 2770 /projectx

Answer

addgroup projectx; adduser bob projectx; adduser carol projectx; chmod u+s /projectx

Answer

groupadd projectx; usermod -G projectx bob; usermod -G projectx carol; chmod g+s /projectx

Question 12

A security policy requires that all users in the 'admin' group must have a umask of 027 set automatically upon login. An administrator adds 'umask 027' to /etc/profile. However, users report that the umask is still 022. What is a likely cause?

Accepted Answer

The umask in /etc/profile is overridden by user-specific .bash_profile or .bashrc files.. User-specific shell configuration files (like ~/.bash_profile, ~/.bash_login, or ~/.profile for login shells, and ~/.bashrc for interactive non-login shells) are sourced after /etc/profile. These files can override the system-wide umask setting with a user-defined value, such as the default 022. Since the administrator only modified /etc/profile, any existing user-specific umask command in their personal dotfiles will take precedence.

Answer

The umask command in /etc/profile has a syntax error that is silently ignored.

Answer

The admin placed the umask command after the call to /etc/bash.bashrc which resets it.

Answer

The admin forgot to run 'source /etc/profile' on each user's session.

Question 13

An administrator wants to change the primary group of user 'jane' from 'staff' to 'developers'. Which command accomplishes this?

Accepted Answer

usermod -g developers jane. The `usermod -g` command changes the primary group of a user. The `-g` option specifies the new primary group (by name or GID), and the user's existing primary group is replaced. This directly accomplishes the administrator's goal of changing jane's primary group from 'staff' to 'developers'.

Answer

usermod -G developers jane

Answer

groupmod -g developers jane

Answer

chgrp developers jane

Question 14

A user's account needs to be set to expire on a specific date. Which command should the administrator use?

Accepted Answer

chage -E 2025-01-01 username. The `chage -E` command sets the account expiration date for a user, which is the standard Linux method for specifying when a user account should become disabled. The `-E` flag accepts a date in YYYY-MM-DD format and updates the `/etc/shadow` file's eighth field (account expiration). This is the precise tool for the task described.

Answer

usermod -e 2025-01-01 username

Answer

usermod -c 'expire=2025-01-01' username

Answer

passwd -x 90 username

Question 15

An administrator runs 'pwck' and receives an error indicating a user in /etc/passwd has no matching group in /etc/group. What is the most likely cause and the appropriate corrective action?

Accepted Answer

The user's GID in /etc/passwd is invalid; use usermod -g to set a valid group.. The `pwck` command validates the integrity of the /etc/passwd file. When it reports that a user has no matching group in /etc/group, it means the user's primary group ID (GID) specified in /etc/passwd does not correspond to any existing group entry in /etc/group. The correct action is to use `usermod -g` to assign the user to a valid existing group, which updates the GID field in /etc/passwd.

Answer

The user's secondary group in /etc/group is missing; add the user back to the group.

Answer

The group was deleted with groupdel but the user's primary group in /etc/passwd was not updated; recreate the group.

Answer

The user's password hash is corrupted; run 'pwconv' to synchronize.