LFCS User and Group Management — Timed 40 Questions

Question 1

A system administrator needs to add a new user 'alice' with UID 1050 and a home directory at /home/alice. Which command should be used?

Accepted Answer

useradd -u 1050 -d /home/alice -m alice. Options A and D are both correct. Option A uses `-u 1050` to set UID, `-d /home/alice` to specify the home directory, and `-m` to create it. Option D uses `--create-home` which creates the home directory at the default location `/home/alice`, and `--skel /etc/skel` to copy skeleton files; the home directory path defaults to `/home/alice`, satisfying the requirement. Option B uses incorrect flags `-U` and `-h`. Option C uses `--home` but does not include `--create-home` or `-m`, so the home directory is not created.

Answer

useradd -U 1050 -h /home/alice alice

Answer

useradd --uid 1050 --home /home/alice alice

Question 2

A developer was removed from the 'developers' group but still needs to run commands that require membership in that group. The user has logged out and back in, but the issue persists. What is the most likely cause?

Accepted Answer

The user did not explicitly start a new login shell after group removal.. When a user is removed from a supplementary group, the group membership is cached in the user's current login session. Even after logging out and back in, if the user does not explicitly start a new login shell (e.g., by using `su -` or `login`), the old group membership persists because the session's group list is inherited from the parent process. The `newgrp` command or a fresh login shell is required to re-read the group database and update the group list.

Answer

The user's primary group is different from the 'developers' group.

Answer

The user is using 'newgrp developers' but is no longer a member.

Answer

The 'id' command shows the old group because the user's shell is still running.

Question 3

A system administrator needs to create a user 'john' with a home directory in /data/users and an expiry date of 2025-12-31. Which command accomplishes this?

Accepted Answer

useradd -d /data/users -e 2025-12-31 john. The `useradd` command with `-d /data/users` sets the home directory to the specified path, and `-e 2025-12-31` sets the account expiry date in YYYY-MM-DD format. The `-e` flag directly corresponds to the `EXPIRE_DATE` field in `/etc/shadow`, which controls when the account becomes locked.

Answer

useradd -d /data/users -c 2025-12-31 john

Answer

adduser --home /data/users --expiredate 2025-12-31 john

Answer

useradd -m -e 2025-12-31 john

Question 4

An administrator needs to set up a shared directory /project for the group 'projectteam' (GID 5000). All members of the group should be able to create and delete files, but only the file owner can modify their own files. The directory should also ensure that new files inherit the group ownership. Which set of commands achieves this?

Accepted Answer

chown root:projectteam /project; chmod 2770 /project; setfacl -d -m o::--- /project. Option B correctly achieves all requirements. 'chown root:projectteam /project' sets the owner and group. 'chmod 2770 /project' sets the SGID bit (2) so new files inherit the group 'projectteam', and gives the owner and group full rwx on the directory (allowing group members to create and delete files), while granting no permissions to others. 'setfacl -d -m o::---' adds a default ACL that denies all access to others for new items. Since no default group ACL is defined, new files inherit group permissions from the process umask (typically 022, giving group read-only). Thus, group members have read-only access to files owned by others, so only the file owner can modify their files. All requirements are met without unnecessary ACLs for the group.

Answer

chown root:projectteam /project; chmod 2775 /project; setfacl -m g:projectteam:rwx /project

Answer

chown root:projectteam /project; chmod 2775 /project

Answer

chown root:projectteam /project; chmod 1770 /project; setfacl -m m::rwx /project

Question 5

A user 'alice' is unable to log in via SSH. The administrator checks /etc/shadow and sees 'alice:!:19234:0:99999:7:::'. What does the '!' in the password field indicate?

Accepted Answer

The account is locked.. The '!' in the password field of /etc/shadow indicates that the account is locked. This is a standard convention in Linux shadow password files: an exclamation mark placed before the hashed password (or replacing it entirely) disables password-based authentication, effectively locking the account. SSH login fails because the system refuses to authenticate any password attempt against a locked entry.

Answer

The password must be changed at next login.

Answer

The account is disabled.

Answer

The password is expired.

Question 6

An administrator wants to enforce that users in the 'contractors' group must change their password every 30 days, with a warning 7 days before expiry. Which command should be used?

Accepted Answer

chage -M 30 -W 7 contractors. None of the provided commands can be directly applied to a group. The `chage` command is the appropriate tool for password aging, but it requires a username as an argument. To enforce password aging on all users in the 'contractors' group, an administrator would need to iterate over each user in the group and run `chage -M 30 -W 7 <username>` for each.

Answer

groupmod -p 30 contractors

Answer

passwd -x 30 -w 7 contractors

Answer

usermod -e 30 contractors

Question 7

Which THREE commands can be used to list all users currently logged into the system?

Accepted Answer

w. The `w` command displays detailed information about currently logged-in users, including login time, idle time, and current process. The `users` command lists the usernames of all users currently logged in. The `who` command shows a list of users currently logged in, typically with login time and session details. All three commands read from /var/run/utmp or similar system files to present active sessions, making them valid for listing current users.

Answer

last

Answer

id

Question 8

Which THREE files are directly related to user and group management in a Linux system? (Select three.)

Accepted Answer

/etc/group. The files /etc/passwd, /etc/group, and /etc/shadow are the core local databases for user and group management. /etc/passwd stores user account information (username, UID, GID, home directory, shell), /etc/group stores group definitions (group name, GID, member list), and /etc/shadow stores encrypted password hashes and password aging data. These three files are directly consulted by commands like useradd, usermod, groupadd, and login for authentication and identity management.

Answer

/etc/sudoers

Answer

/etc/login.defs

Question 9

You are the Linux administrator for a medium-sized company that uses a centralized authentication system (LDAP) for user accounts, but local files (/etc/passwd, /etc/shadow, /etc/group) are also used for a few service accounts. The server is running RHEL 8. A new employee, 'jane', needs to be added to the local system for a temporary project. You create the user with 'useradd jane' and set a password with 'passwd jane'. However, when jane tries to log in via SSH using her password, she receives 'Permission denied, please try again.' The SSH server is configured to allow password authentication. Other users (both LDAP and local) can log in successfully. You verify that the password was set correctly and that the account is not locked. What is the most likely cause and solution?

Accepted Answer

Change jane's login shell to /bin/bash using usermod -s /bin/bash jane. SSH login may fail if the user's login shell is not a valid interactive shell listed in /etc/shells. While the default shell for new users on RHEL 8 is /bin/bash, the 'useradd' command can be configured with different defaults. In this case, jane's shell might be set to /sbin/nologin, preventing SSH session establishment after successful authentication. Changing it to /bin/bash with 'usermod -s /bin/bash jane' resolves the issue.

Answer

Configure the SSH daemon to allow password authentication for local users

Answer

Unlock the account using passwd -u jane

Answer

Remove the password expiry for jane using chage -E -1 jane

Question 10

A system administrator needs to ensure that all users in the 'developers' group have read and write access to a shared project directory /project/data, but new files created in that directory should belong to the 'developers' group automatically. Which command sequence achieves this goal?

Accepted Answer

chown :developers /project/data && chmod g+s /project/data. `chown :developers /project/data` changes the group ownership of the directory to 'developers', and `chmod g+s /project/data` sets the setgid bit on the directory. The setgid bit ensures that new files created inside inherit the directory's group ('developers') instead of the creator's primary group, and the group ownership gives all members of 'developers' read and write access based on the directory's permissions (e.g., 775).

Answer

setfacl -m g:developers:rwx /project/data && chmod 2775 /project/data

Answer

chown root:developers /project/data && chmod u+s /project/data

Answer

chmod g+s /project/data && chown root:developers /project/data

Question 11

A user 'alice' cannot log in via SSH. The administrator checks /etc/passwd and sees: alice:x:1002:1002::/home/alice:/sbin/nologin. Which command should be used to allow alice to log in with a bash shell?

Accepted Answer

usermod -s /bin/bash alice. The /sbin/nologin shell in the /etc/passwd entry prevents alice from logging in via SSH. The usermod -s /bin/bash alice command changes alice's login shell to /bin/bash, allowing interactive SSH sessions. This directly addresses the shell restriction without altering other account properties.

Answer

usermod -d /home/alice alice

Answer

usermod -u 1002 alice

Answer

useradd -m -s /bin/bash alice

Question 12

An administrator wants to add user 'bob' to the supplementary group 'docker' without removing bob from any existing groups. Which command accomplishes this?

Accepted Answer

usermod -aG docker bob. The `-a` (append) flag combined with `-G` (supplementary groups) ensures user 'bob' is added to the 'docker' group without removing him from any existing supplementary groups. Without `-a`, the `-G` flag replaces the user's current supplementary group list with the specified groups.

Answer

usermod -g docker bob

Answer

usermod -G docker bob

Answer

usermod -G docker bob

Question 13

A security policy requires that user 'svc_backup' have a password that never expires. Additionally, the account should be locked after 90 days of inactivity. Which set of commands achieves this?

Accepted Answer

chage -M 99999 -I 90 svc_backup. `chage -M 99999` sets the maximum password age to 99999 days, effectively preventing the password from ever expiring (since 99999 days far exceeds any practical lifespan). The `-I 90` flag sets the inactivity period to 90 days, meaning the account will be locked after 90 days of no login activity. This combination satisfies both security policy requirements: a non-expiring password and automatic lockout after 90 days of inactivity.

Answer

chage -W 7 -I 90 svc_backup

Answer

chage -E 2025-01-01 -I 90 svc_backup

Answer

chage -M 90 -I 90 svc_backup

Question 14

Which TWO commands can be used to display the groups to which the current user belongs? (Select exactly two.)

Accepted Answer

id. The `id` command (option C) displays the current user's UID, GID, and all supplementary group memberships. When run without arguments, it shows the effective user and group IDs along with all groups the user belongs to, making it a direct and reliable way to list group membership.

Answer

cat /etc/group

Answer

groupmems -l

Answer

getent group

Question 15

You are managing a multi-user Linux server used by a development team. The server has a shared directory /data/projects where each project has a subdirectory owned by a project lead. The requirement is that all members of the 'devteam' group need to be able to create files in any project subdirectory, but only the project lead (owner) should be able to delete files. Currently, members of devteam are unable to create files in /data/projects. You check permissions: /data/projects has drwxrwxr-x root:devteam. Each project subdirectory, e.g., /data/projects/proj1, has drwx------ lead1:devteam. The lead1 user is in devteam. What is the most likely reason that devteam members cannot create files in proj1, and what is the correct solution?

Accepted Answer

The proj1 directory lacks group write and execute permissions; use chmod g+rwx proj1 and chmod g+s proj1 to allow group members to create files and ensure new files inherit group.. The project subdirectory /data/projects/proj1 has permissions drwx------ (700), which means only the owner (lead1) has read, write, and execute access. The devteam group lacks both write and execute permissions, preventing group members from creating files. The solution is to add group write and execute permissions (chmod g+rwx proj1) and set the setgid bit (chmod g+s proj1) so that new files inherit the group ownership, ensuring all devteam members can create files while only the owner can delete them.

Answer

The devteam group does not include all members; add each user to the devteam group.

Answer

The parent directory /data/projects lacks execute permission for devteam; add execute permission to /data/projects.

Answer

The sticky bit is not set; set the sticky bit on proj1 to allow only owners to delete files.

Question 16

An administrator needs to grant a user named 'john' the ability to switch to any other user without a password. Which TWO of the following steps are required to achieve this?

Accepted Answer

Add 'john' to the 'wheel' group and configure /etc/pam.d/su to use pam_wheel.so with the 'trust' option.. Adding 'john' to the 'wheel' group and configuring /etc/pam.d/su with pam_wheel.so and the 'trust' option allows members of the 'wheel' group to switch to any user via su without being prompted for a password. The 'trust' modifier in PAM bypasses the password authentication for users in the specified group, effectively granting passwordless su access.

Answer

Set the suid bit on /bin/su.

Answer

Run 'usermod -L john'.

Answer

Add 'john' to the 'root' group.

Question 17

A user named 'charlie' has just been added to the 'devops' group. However, when 'charlie' runs 'sudo -l', no sudo entries are shown. What is the most likely cause?

Accepted Answer

'charlie' must log out and log back in for the group change to take effect.. When a user is added to a new group, the group membership is only applied to new login sessions. The `sudo -l` command checks the user's current group memberships, which are cached at login time. Since 'charlie' was added to the 'devops' group while already logged in, the new group membership is not reflected until 'charlie' logs out and logs back in, or uses `newgrp` or `sg` to start a new session with the updated groups.

Answer

'charlie' is not listed by name in the sudoers file.

Answer

'charlie' is also a member of another group that restricts sudo.

Answer

The systemctl command is not executable by 'charlie'.

Answer

The sudoers file has a syntax error.

Question 18

Scenario: You are managing a Linux server that hosts a web application. The application runs under the user 'webapp' and the group 'webgroup'. Recently, a new intern 'john' (username 'john') needs to be able to view and modify files in /var/www/html, which is owned by root:webgroup with permissions 775. John is currently a member of the group 'staff', but not 'webgroup'. The security policy requires that John must be able to edit files without using sudo, and his primary group must remain 'staff'. Which of the following actions should you take to meet the requirements?

Accepted Answer

Add John to the 'webgroup' supplementary group with 'usermod -a -G webgroup john'.. Adding John to the 'webgroup' supplementary group with `usermod -a -G webgroup john` grants him group-level access to /var/www/html (owned by root:webgroup with permissions 775) without changing his primary group 'staff'. This allows him to view and modify files as a member of 'webgroup', satisfying the security policy that he must not use sudo and his primary group must remain unchanged.

Answer

Change the group ownership of /var/www/html to 'staff' and set the setgid bit.

Answer

Change John's primary group to 'webgroup' with 'usermod -g webgroup john'.

Answer

Set the setgid bit on /var/www/html with 'chmod g+s /var/www/html'.

Question 19

Arrange the steps to configure a new user account with sudo privileges on a Linux system.

Accepted Answer

Step 1: Create the user account with useradd. Step 2: Set a password with passwd. Step 3: Add the user to the sudo group (e.g., wheel) with usermod -aG. Step 4: Verify sudo access by running a command like 'sudo -l' or 'sudo whoami'.. After creating the user and setting a password, adding to the wheel group grants sudo access. Verification and testing confirm it works.

Answer

Step 1: Create the user account. Step 2: Set a password. Step 3: Test sudo access. Step 4: Add the user to the sudo group.

Answer

Step 1: Create the user account. Step 2: Add the user to the sudo group. Step 3: Test sudo access. Step 4: Set a password.

Answer

Step 1: Add the user to the sudo group. Step 2: Create the user account. Step 3: Set a password. Step 4: Test sudo access.

Question 20

Order the steps to create a systemd service unit that runs a script at boot.

Accepted Answer

Create the unit file, then enable the service for boot, then start the service, then check the status.. Creating the unit file, enabling for boot, starting, and checking status are standard steps.

Answer

Start the service, then create the unit file, then enable for boot, then check status.

Answer

Enable the service for boot, then create the unit file, then start, then check status.

Answer

Create the unit file, then start the service, then enable for boot, then check status.