LFCS User and Group Management Practice Test 6 — 15 Questions

Question 1

A security policy requires that a user's password must expire 90 days after last change, and the user must change it immediately on next login. The last password change was 30 days ago. Which set of commands achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

chage -M 90 user1; chage -d 0 user1. `chage -M 90 user1` sets the maximum password age to 90 days, and `chage -d 0 user1` forces the password to expire immediately (setting the last change date to epoch 0), which requires the user to change the password on the next login. This satisfies both requirements: the password will expire 90 days after the forced change, and the user must change it immediately.

Answer

chage -M 90 user1; chage -m 1 user1

Answer

chage -M 90 user1; chage -W 7 user1

Answer

chage -M 90 user1; chage -I 5 user1

Question 2

Existing user 'jdoe' is a member of groups 'users' (primary) and 'staff'. The administrator needs to add 'jdoe' to group 'projectx' while preserving existing supplementary group memberships. Which command achieves this?

Accepted Answer

usermod -a -G projectx jdoe. The `-a` (append) flag combined with `-G` (supplementary groups) adds the user to the specified group without removing existing supplementary group memberships. Without `-a`, the `-G` flag replaces all supplementary groups with the listed ones, which would remove the 'staff' group membership.

Answer

usermod -g projectx -G projectx jdoe

Answer

usermod -g projectx jdoe

Answer

usermod -G projectx jdoe

Question 3

An administrator needs to delete user 'obsolete' and remove its home directory and mail spool. Which command should be used?

Accepted Answer

userdel -r obsolete. The correct command is `userdel -r obsolete` because the `-r` flag removes the user's home directory and mail spool in addition to deleting the user account. This matches the requirement to delete the user 'obsolete' along with its home directory and mail spool, as specified in the question.

Answer

userdel -f obsolete

Answer

userdel obsolete

Answer

groupdel obsolete

Question 4

A company follows the principle of least privilege. Several developers need sudo access to run specific commands like systemctl and journalctl. What is the best practice for granting this access?

Accepted Answer

Create a new group 'devops', add developers to it, and create a sudoers drop-in file with rules for specific commands. It follows the principle of least privilege by creating a dedicated 'devops' group and using a sudoers drop-in file (e.g., /etc/sudoers.d/devops) to grant only specific commands like systemctl and journalctl. This avoids modifying the main /etc/sudoers file directly, which is error-prone, and ensures that developers have no more privileges than necessary. The drop-in file approach is the recommended best practice for maintainability and security.

Answer

Use 'usermod -a -G sudo' for each developer and edit /etc/sudoers manually with visudo

Answer

Add all developers to the 'wheel' group and configure %wheel ALL=(ALL) ALL

Answer

Edit /etc/sudoers directly to add each developer username with command restrictions

Question 5

Which THREE fields are part of a standard /etc/group entry?

Accepted Answer

Group password (often 'x'). A standard /etc/group entry has four colon-separated fields: group name, group password, group ID (GID), and group members list. Option C (group name) is correct because the first field of each /etc/group line is the group's name, such as 'sudo' or 'developers'. Option A (group password, often 'x') is correct because the second field holds the group password placeholder, typically 'x' when shadow group passwords are used via /etc/gshadow. Option E (group members list) is correct because the fourth field is a comma-separated list of supplementary members of the group. Option B (primary GID of user) is not part of /etc/group; a user's primary GID is stored in the fourth field of /etc/passwd. Option D (home directory of group) does not exist in /etc/group; home directories are per-user fields in /etc/passwd, not per-group fields.

Answer

Primary GID of user

Answer

Home directory of group

Question 6

A security policy requires that a user account 'temp_audit' be locked immediately without changing the password. Which command locks the account and prevents login?

Accepted Answer

usermod -L temp_audit. The `usermod -L` command locks a user account by placing an exclamation mark (!) at the beginning of the password hash in /etc/shadow, effectively disabling password-based authentication without altering the existing password. This satisfies the security policy requirement to immediately prevent login without changing the password.

Answer

userdel temp_audit

Answer

chage -E 0 temp_audit

Answer

passwd -u temp_audit

Question 7

An administrator wants to force a user to change their password at next login. Which command should be used?

Accepted Answer

passwd -e user. The `passwd -e user` command immediately expires the user's password, forcing them to change it at the next login. This is the standard method to achieve this requirement on Linux systems.

Answer

passwd -l user

Answer

chage -m 0 user

Answer

usermod -p '!' user

Question 8

A large company needs to create 100 user accounts from a list of names in a CSV file. Which tool is most efficient for batch user creation?

Accepted Answer

newusers. The `newusers` command is the most efficient tool for batch user creation because it reads a file in a specific format (username:password:UID:GID:comment:home_directory:shell) and can create multiple user accounts in a single pass, automatically handling password hashing and home directory creation. This avoids the overhead of scripting loops and multiple `useradd` invocations, making it ideal for bulk operations like creating 100 accounts from a CSV list.

Answer

vipw

Answer

for loop with useradd

Answer

pwconv

Question 9

A user reports that they cannot execute a file even though they are in the file's group. The file has permissions 644 and group ownership 'staff'. The user is a member of 'staff'. What is the likely issue?

Accepted Answer

The file lacks execute permission for the group. The file has permissions 644, which means the owner has read/write (6), the group has read-only (4), and others have read-only (4). Since the user is a member of the group 'staff' but not the owner, they fall under the group permission class. The group lacks execute permission (the 'x' bit), so the user cannot execute the file. Execute permission is required to run a file as a command or script, regardless of group membership.

Answer

The file does not have the setgid bit

Answer

The user's primary group is not 'staff'

Answer

The user is not the owner of the file

Question 10

A temporary contractor 'contractor1' has left the company. The administrator needs to remove the user account and all associated files in the home directory. Which command accomplishes this?

Accepted Answer

userdel -r contractor1. The `userdel -r contractor1` command removes the user account and, with the `-r` flag, also deletes the user's home directory and mail spool. This is the standard Linux command to completely remove a user and their associated files, as required by the scenario.

Answer

userdel contractor1

Answer

passwd -d contractor1

Answer

deluser --remove-home contractor1

Question 11

An administrator needs to view a list of users who have logged in recently. Which command provides this information?

Accepted Answer

last. The `last` command reads the `/var/log/wtmp` file to display a list of all users who have logged in and out, including recent login sessions. This makes it the correct choice for viewing a history of recent logins, as it provides timestamps, duration, and originating host information.

Answer

users

Answer

who

Answer

finger

Question 12

Which two commands can be used to set password expiration policies for a user?

Accepted Answer

passwd. The `passwd` command (option B) can set password expiration policies for a user via options such as `-e` (expire immediately), `-n` (minimum days), `-x` (maximum days), `-w` (warning days), and `-i` (inactive days), e.g., `passwd -x 90 -n 7 -w 14 user`. The `chage` command (option C) is specifically designed to modify password aging information in `/etc/shadow`, using flags like `-M` (max days), `-m` (min days), `-W` (warn days), `-I` (inactive days), and `-E` (account expiration date), e.g., `chage -M 90 -W 14 user`. The other options do not belong: `usermod` (A) manages account properties like groups, shell, and home directory but does not set password aging fields; `expiry` (D) is not a standard Linux command for this purpose; and `pwconv` (E) creates or updates `/etc/shadow` from `/etc/passwd` rather than setting expiration policies.

Answer

usermod

Answer

expiry

Answer

pwconv

Question 13

Which two commands can add an existing user to a supplementary group?

Accepted Answer

gpasswd -a. Option B, gpasswd -a, is correct because gpasswd with the -a (add) flag adds an existing user to a named supplementary group, e.g. `gpasswd -a alice developers`, modifying /etc/group without altering the user's primary group. Option E, usermod -aG, is correct because usermod with -G specifies supplementary groups and the -a (append) flag ensures the listed group is added to the user's existing supplementary group set rather than replacing it, e.g. `usermod -aG developers alice`. Option A, useradd -G, is wrong here because useradd creates new accounts and its -G flag sets supplementary groups only at account-creation time, so it cannot add an already-existing user. Option C, addgroup, is wrong because it is a Debian/Ubuntu convenience script for creating a new group (and optionally adding a user at creation), not the standard command for adding an existing user to an existing supplementary group. Option D, groupmod, is wrong because it modifies a group's attributes such as its name (-n) or GID (-g), and does not manage user membership.

Answer

useradd -G

Answer

addgroup

Answer

groupmod

Question 14

Refer to the exhibit. The administrator attempted to create a user 'newuser' but received an error. Which command should be used to check if the user already exists?

Accepted Answer

cat /etc/passwd | grep newuser. The /etc/passwd file stores all user account information, and using cat to pipe its contents through grep allows the administrator to search for the specific username 'newuser'. If the user exists, grep will output the matching line; if not, no output is returned. This is a standard, quick method to verify user existence without modifying system state.

Answer

passwd -S newuser

Answer

usermod -c newuser

Answer

userdel -v newuser

Question 15

A junior administrator issued the command 'usermod -L alice' to lock the account of user alice. However, alice is still able to log in via SSH using a public key. What is the most likely reason?

Accepted Answer

The usermod -L command only locks the password but does not prevent SSH key-based authentication.. The `usermod -L` command locks the user's password by placing an exclamation mark (!) in the second field of the /etc/shadow file, which prevents password-based authentication. However, SSH public key authentication does not rely on the password field; it uses the authorized_keys file and the SSH daemon's public key challenge-response mechanism. Therefore, even with a locked password, the user can still log in via SSH if their public key is present in ~/.ssh/authorized_keys.

Answer

The usermod -L command only changes the user's shell to /sbin/nologin.

Answer

The usermod -L command requires a restart of the SSH service to take effect.

Answer

The usermod -L command is not effective on accounts with a UID less than 1000.