LFCS User and Group Management Practice Test 4 — 15 Questions

Question 1

You are a system administrator for a financial firm. One of your users, 'alice', has forgotten her password and is locked out of the system. The security policy requires that all passwords must be changed every 30 days. Alice's account was disabled due to inactivity; the account has been inactive for 45 days. You need to unlock the account and ensure that Alice must change her password at the next login. You have root access. Which set of commands should you run?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

usermod -U alice; chage -d 0 alice. Usermod -U unlocks the account, and chage -d 0 forces password change. Option B: passwd -u is not standard on all distros; chage -M 30 sets max days but does not force immediate change. Option C: usermod -e '' sets no account expiry but may not unlock; passwd alice sets a new password but does not force change. Option D: chage -E -1 sets no account expiry but also uses usermod -L which locks the account.

Answer

passwd -u alice; chage -M 30 alice

Answer

usermod -e '' alice; passwd alice

Answer

chage -E -1 alice; usermod -L alice

Question 2

Your company has a server that hosts a critical application. The application runs under a service account 'appuser'. Due to a security audit, it was discovered that 'appuser' has a password that never expires, which is against company policy. The policy requires that all user passwords expire after 60 days. Additionally, the application developers have requested that 'appuser' should not be allowed to change its own password via the 'passwd' command to prevent accidental lockouts. You need to enforce password expiry for 'appuser' but also ensure that only root can change its password. Which of the following approaches is the best course of action?

Accepted Answer

Run 'chage -M 60 -W 7 appuser' and then modify /etc/shadow to set the password field to '!', and configure the application to use SSH keys for authentication.. The best approach is to set the password expiry with 'chage -M 60 -W 7 appuser' and then modify /etc/shadow to set the password field to '!', which locks the password, and configure the application to use SSH keys. This enforces the 60-day expiry policy while preventing 'appuser' from changing its password via 'passwd', as the password is locked. Using SSH keys allows the application to authenticate without a password, and only root can change the password (by unlocking it).

Answer

Run 'chage -M 60 appuser' and then 'passwd -e appuser' to expire the password immediately.

Answer

Run 'chage -M 60 -d 0 appuser' and then 'usermod -r appuser' to make it a system account.

Answer

Run 'chage -M 60 -d 0 appuser' and then 'passwd -l appuser' to lock the password, ensuring that the application uses sudo to run commands as appuser.

Question 3

You are a system administrator for a company with a strict security policy: user accounts must be disabled after 90 days of inactivity. The tool used is the chage command with the -I (inactive) option. User 'bob' has been on leave and cannot log in. You run 'chage -l bob' and see: Last password change: Jan 10, 2024; Password expires: Apr 09, 2024; Account expires: never; Minimum number of days between password change: 0; Maximum number of days between password change: 90; Number of days of warning before password expires: 7; Number of days of inactivity after password expires: 90. Bob tells you he tried to log in today (date is July 15, 2024) and received 'Your account has expired; contact your system administrator'. You need to restore Bob's account access immediately while still enforcing the inactivity lock for future periods. What should you do?

Accepted Answer

Run 'chage -E -1 bob' to clear account expiration, then 'chage -I 90 bob' to set inactivity period, then instruct Bob to change his password immediately.. Chage -E -1 bob sets the account expiration to never, effectively removing any expiry that might have locked the account due to inactivity, and chage -I 90 bob re-sets the inactivity period to 90 days after password expiry. This allows Bob to log in after resetting his password (since his password has already expired), and future inactivity will be tracked. Option A is incorrect because changing the maximum password age to 99999 does not address the expired account; the account may still be locked due to inactivity. Option C only resets the password but does not clear the account expiration or inactivity counter. Option D is overkill and loses Bob's home directory, files, and group memberships.

Answer

Run 'chage -M 99999 bob' to set password to never expire, then 'passwd bob' to set a new password, and finally 'chage -d 0 bob'.

Answer

Run 'passwd bob' to reset his password, then 'chage -d 0 bob' to force password change on next login.

Answer

Delete Bob's user account with 'userdel -r bob' and recreate it with 'useradd bob', then assign him to his groups and restore his data from backup.

Question 4

A sysadmin set up a shared directory /data/project with group ownership project and permissions 2775 (rwxrwsr-x). Users in the project group can create files, but when they try to edit files created by other group members, they get permission denied. Which is the most likely cause?

Accepted Answer

The umask of users is set to 027, which prevents group write on new files.. The directory has permissions 2775, meaning the SGID bit is set (2) and group has rwx (7). New files inherit the project group ownership due to SGID, but the user's umask controls the permissions assigned to new files. A umask of 027 removes group write permission (since 777 - 027 = 750 for directories, 666 - 027 = 640 for files), resulting in files with permissions 640 (rw-r-----) which lack group write. This prevents other group members from editing the files. Option A is incorrect because while files are owned by root (the directory owner), that does not affect group permissions; the issue is the missing group write bit. Option C is incorrect because the sticky bit (1000) is not set; the directory uses SGID (2000). Option D is incorrect because the SGID bit is already set (2 in 2775) and is functioning for ownership inheritance.

Answer

The directory is owned by root, so files inherit owner root, not the user's primary group.

Answer

The sticky bit interferes with group editing.

Answer

The SGID bit is not set; the directory must be chmod g+s to enforce group ownership inheritance.

Question 5

A Linux administrator wants to restrict user 'alice' to only be able to use the system for non-interactive tasks (e.g., running cron jobs and receiving mail) but not allow her to log in via SSH or console. Which TWO actions would achieve this goal? (Choose two.)

Accepted Answer

Set alice's login shell to /sbin/nologin in /etc/passwd.. Option B is correct because setting alice's login shell to /sbin/nologin in /etc/passwd prevents interactive console or SSH logins (the shell immediately exits with a message), while still allowing non-interactive tasks such as cron jobs and mail delivery that do not invoke a login shell. Option C is correct because adding alice to the DenyUsers directive in /etc/ssh/sshd_config explicitly blocks her from authenticating via SSH, satisfying the requirement to deny SSH access while leaving cron and mail functionality intact. Option A is not appropriate because locking the password with 'passwd -l alice' would also break password-based authentication for cron or mail-related services that rely on the account's credentials, and it does not by itself block SSH if key-based authentication is used. Option D is wrong because setting UID 0 would grant alice root privileges, the opposite of restricting her. Option E is wrong because /etc/cron.deny only prevents alice from scheduling cron jobs, which contradicts the goal of allowing her to run cron jobs.

Answer

Lock alice's password with 'passwd -l alice'.

Answer

Change alice's UID to 0.

Answer

Add alice to /etc/cron.deny.

Question 6

Refer to the exhibit. User alice attempts to create a file in /data/project but receives 'Permission denied'. User bob can create files successfully. What is the most likely reason?

Accepted Answer

Alice needs to run 'newgrp project' or log out and back in for her group membership to take effect.. On Linux, supplementary group memberships are resolved at login time and cached in the process credentials. When an administrator adds alice to the project group with usermod or gpasswd, her currently running shell session does not automatically pick up the new group; she must either log out and back in or run 'newgrp project' to start a new shell with the updated group list. Until then, the kernel evaluates file permissions against her stale group set, so write access to the group-writable /data/project directory is denied.

Answer

The directory's SGID bit requires primary group membership for write access.

Answer

Alice is not a member of the project group.

Answer

The directory has an ACL that denies write to user alice.

Question 7

A Linux server uses LDAP for user authentication. A local contractor named 'bpatel' needs an account that authenticates against LDAP but also requires a local home directory and shell. Which command creates this account while ensuring the system uses the LDAP-provided UID and GID?

Accepted Answer

useradd -m -s /bin/bash -u $(id -u bpatel) -g $(id -g bpatel) bpatel. The correct approach is to create a local account that matches the LDAP-provided UID and GID. Using id retrieves the numeric IDs from the directory service, and useradd creates the local passwd entry with those IDs. This ensures that file ownership and permissions remain consistent whether the user is resolved via LDAP or locally, and it provides the required local home directory and shell.

Answer

useradd -m -s /bin/bash --system bpatel

Answer

useradd -m -s /bin/bash -u $(getent passwd bpatel | cut -d: -f3) -g $(getent passwd bpatel | cut -d: -f4) bpatel

Answer

useradd -m -s /bin/bash bpatel

Question 8

A junior administrator is asked to add a new user 'sam' to the system, ensuring that a home directory is created and populated with the default skeleton files. Which single command accomplishes this directly?

Accepted Answer

adduser sam. The adduser command is the correct choice because it is designed as a user-friendly wrapper that creates the account, the home directory, and copies default skeleton files. Plain useradd does not guarantee home directory creation or skeleton copying without extra flags, and the other commands either modify an existing user or create a group. For a junior admin needing a complete user setup with defaults, adduser is the direct and reliable tool.

Answer

useradd sam

Answer

usermod -m -d /home/sam sam

Answer

groupadd sam

Question 9

A junior administrator has just created a new user account named 'dba' with useradd. The account is intended for a database administrator who will log in interactively. When the DBA tries to log in, authentication fails. Running 'grep dba /etc/shadow' shows the password field as '!' followed by a hash. Which command will allow the DBA to set a working password?

Accepted Answer

passwd dba. A newly created account has no valid password hash, and useradd does not prompt for one. The passwd command, run by root with the username, writes a proper hash into /etc/shadow. Because the DBA must authenticate interactively, only setting a real password resolves the failed login.

Answer

chage -d 0 dba

Answer

usermod -p dba

Answer

passwd -u dba

Question 10

A server hosts a shared data directory owned by group 'analysts'. A new employee 'mira' already has an account with primary group 'staff'. The administrator runs 'usermod -aG analysts mira' and confirms with 'id mira', which shows groups=1000(staff),1010(analysts). Later, mira reports she cannot write to files in the shared directory even though the group has write permission. She has logged out and back in. What is the most likely cause?

Accepted Answer

The directory's setgid bit is not set, so new files are created with the staff group instead of analysts.. Supplementary group membership is correctly applied, as 'id mira' confirms. The failure stems from group ownership on the shared content: without the setgid bit, files created by other users belong to their primary group rather than analysts. Mira therefore lacks group write permission on those files, which setgid on the directory would fix.

Answer

Mira's primary group is still staff, so the kernel ignores all supplementary group permissions for file access.

Answer

The directory has a default ACL that denies write access to members of the analysts group.

Answer

The 'usermod -aG' command failed to apply because the group modification requires a reboot to take effect.

Question 11

A security policy requires that a user account 'mchen' be prevented from logging in via password or SSH key until further notice, but the account must remain intact with its files and group memberships. Which command best accomplishes this?

Accepted Answer

usermod -s /sbin/nologin mchen. Setting the shell to /sbin/nologin blocks all interactive logins, including those via SSH key, because the login process rejects a non-interactive shell. Locking the password with passwd -l or usermod -L only stops password authentication and leaves SSH key access open. Deleting the user removes the account entirely, which contradicts the requirement to keep the account and its memberships. The nologin shell approach preserves the account while denying access.

Answer

passwd -l mchen

Answer

usermod -L mchen

Answer

userdel mchen

Question 12

A security audit requires that all user accounts with an empty password field in /etc/shadow be locked immediately. Which command will lock only those accounts that currently have no password set?

Accepted Answer

usermod -L $(awk -F: '($2=="") {print $1}' /etc/shadow). To lock accounts with empty password fields, use usermod -L on each user identified by awk. usermod -L prepends '!' to the password field, disabling password authentication. The awk command correctly selects users with an empty second field. This approach locks only the targeted accounts without affecting others, satisfying the audit requirement.

Answer

passwd -d $(awk -F: '($2=="") {print $1}' /etc/shadow)

Answer

passwd -l $(awk -F: '($2=="") {print $1}' /etc/shadow)

Answer

chage -E 0 $(awk -F: '($2=="") {print $1}' /etc/shadow)

Question 13

A compliance audit reveals that the account 'auditor1' must have its password expire on a fixed calendar date, specifically 2025-12-31, regardless of when the password was last changed. Which command sets this exact expiration date for the account?

Accepted Answer

chage -E 2025-12-31 auditor1. Pinning a password to expire on a specific calendar date is done with chage -E, which records the date as days since the epoch in the account expiry field of /etc/shadow. The -M option sets a relative maximum age in days, usermod -e sets account rather than password expiration, and passwd -e expires the password immediately without accepting a date, so only chage -E satisfies the fixed-date requirement.

Answer

usermod -e 2025-12-31 auditor1

Answer

chage -M 2025-12-31 auditor1

Answer

passwd -e 2025-12-31 auditor1

Question 14

An administrator must ensure that all new files created by members of the group 'auditors' in the shared directory /srv/audit have group ownership 'auditors' and are readable by group members, regardless of each user's primary group. Which approach should be used?

Accepted Answer

Set the setgid bit on /srv/audit and set the group umask to 002 for all auditors.. The setgid bit on a directory forces new files to inherit the directory's group, so files created in /srv/audit will belong to 'auditors'. Setting the group umask to 002 ensures that group members have read and write permissions by default. Together, these mechanisms provide automatic, consistent group ownership and readability without relying on per-user primary groups or post-hoc corrections. The other options either use unnecessary complexity, misapply the sticky bit, or rely on inefficient cron jobs.

Answer

Set the setgid bit on /srv/audit and set the default ACL to grant rwx to group auditors.

Answer

Change the primary group of every auditor to 'auditors' and set the sticky bit on /srv/audit.

Answer

Create a cron job that runs chgrp auditors and chmod g+r on all files in /srv/audit every minute.

Question 15

An administrator needs to configure password aging for user 'rwilliams' to meet a new security policy: the password must be changed every 60 days, a warning must be issued 7 days before expiration, and the account must be locked 14 days after password expiration. Which TWO commands will achieve this? (Choose two.)

Accepted Answer

chage -M 60 -W 7 -I 14 rwilliams. Both chage and passwd can configure password aging. chage -M 60 -W 7 -I 14 sets maximum age, warning days, and inactive days. passwd -x 60 -w 7 -i 14 does the same. Either command alone meets the policy. The other options contain invalid flags or incorrect parameters that do not satisfy the requirements.

Answer

usermod -f 14 -e 60 -w 7 rwilliams

Answer

usermod -L -U rwilliams && chage -M 60 -W 7 -I 14 rwilliams

Answer

chage -m 60 -M 7 -I 14 rwilliams