010-160 Security And File Permissions — 40 Questions

Question 1

A user reports they cannot execute a script named 'deploy.sh' even though the file permissions are set to 644. What must you change to enable execution for the owner?

Accepted Answer

chmod 744 deploy.sh. Permissions 644 give the owner read and write (6) but no execute, so the script cannot run. To enable execution for the owner while keeping read/write, you need 7 (rwx) for the owner, giving 744 — read and execute for group and others.

Answer

chmod 655 deploy.sh

Answer

chown u+x deploy.sh

Answer

chmod +w deploy.sh

Question 2

Which TWO of the following files are essential for basic user and group management?

Accepted Answer

/etc/group. /etc/passwd (option D) is essential because it stores the basic user account database, mapping usernames to UIDs, primary GIDs, home directories, and login shells, which is fundamental to user management. /etc/group (option B) is equally essential because it defines group entries, mapping group names to GIDs and listing their member users, which is required for group management. Together these two files provide the core identity and membership data used by tools like useradd, usermod, groupadd, and groupmod. The other options do not belong: /etc/hosts (A) is for static hostname-to-IP resolution, /etc/fstab (C) defines filesystem mount configuration, and /etc/shadow (E) stores password hashes and aging data—important for authentication but not part of the basic user/group identity database.

Answer

/etc/hosts

Answer

/etc/fstab

Answer

/etc/shadow

Question 3

Which command would you use to change the expiration date of a user's password?

Accepted Answer

chage. chage (change age) is the dedicated tool for viewing and modifying password-aging parameters, including expiration dates, minimum/maximum days between changes, and warning periods. Running 'chage -E 2025-12-31 user' sets the account expiration, and 'chage -l user' lists current aging settings.

Answer

passwd -e

Answer

usermod -e

Answer

userdel -p

Question 4

Which TWO of the following characterize the 'root' user in Linux?

Accepted Answer

Cannot be restricted by file permissions.. Option A is correct because the root user bypasses the normal discretionary access control checks on files and directories — the kernel grants root (UID 0) access regardless of the read/write/execute permission bits, so file permissions cannot restrict it. Option B is correct because the superuser account is defined by having UID 0 in /etc/passwd; the kernel identifies root by this numeric UID, not by the account name. Option C is wrong because root can be locked (e.g., with 'passwd -l root' or by prefixing the password hash in /etc/shadow with '!' or '*'), which blocks password-based logins. Option D is wrong because root's login shell is configurable in /etc/passwd and can be /bin/sh, /bin/zsh, /sbin/nologin, or anything else. Option E is wrong because root's group membership is defined by its primary GID (typically 0/root) and supplementary groups in /etc/group, and it is not inherently a member of the 'users' group.

Answer

Cannot be locked.

Answer

Must have a shell set to /bin/bash.

Answer

Is always member of the 'users' group.

Question 5

A junior administrator runs `ls -l /srv/payroll` and sees the permissions string `drwxrwx---` with owner `hr` and group `finance`. A member of the group `audit` needs read access to files inside this directory, and you must accomplish this without altering the permissions of any files already inside. Which approach meets the requirement?

Accepted Answer

Add the audit user to the finance group with usermod, then have the user log in again.. Directory group permissions are evaluated against the accessing account's group memberships, so bringing the audit user into the finance group gives them exactly the rwx access the group already holds on /srv/payroll. Because supplementary groups are assigned at session start, the user must obtain a new login session. No existing file's permission bits or ACLs are modified, which is what the constraint demands.

Answer

Run chmod g+rwx /srv/payroll and tell the audit user to access the path directly.

Answer

Run setfacl -R -m u:audit:rx /srv/payroll to propagate access to every child object.

Answer

Run chmod o+rx on the directory so the audit user is covered by the others category.

Question 6

You are reviewing the security posture of a Linux server. You want to identify which files have the SUID or SGID permission bits set, because these can pose privilege-escalation risks. Which TWO commands will list such files? (Choose two.)

Accepted Answer

find / -perm -u+s -o -perm -g+s. Both find commands use -perm with the SUID and SGID masks (numeric -4000/-2000 or symbolic u+s/g+s) and the -o operator to list files matching either condition. They are the standard, reliable methods for auditing setuid and setgid files across a filesystem.

Answer

getfacl -R / | grep -i suid

Answer

ls -lR / | grep '^...s'

Answer

stat --format='%A %n' / | grep 's'

Question 7

A junior administrator needs to grant read and write access to a file named report.txt for the user alice, while ensuring that the file's group (finance) can read it and no one else has any access. The file currently has mode 640 and is owned by alice:finance. Which TWO commands will achieve the required permissions? (Choose two.)

Accepted Answer

chmod 640 report.txt. The required permissions are read and write for the owner (alice), read only for the group (finance), and no access for others. This corresponds exactly to mode 640. Both the symbolic form u=rw,g=r,o= and the octal form 640 set these bits unambiguously, assuming the existing ownership is correct.

Answer

chmod u+rw,g+r,o-rwx report.txt

Answer

chmod 660 report.txt

Answer

chmod a=rw report.txt

Question 8

An administrator is reviewing how Linux decides whether a process may open a file, and wants to confirm which statements about the permission-checking model are accurate. (Choose two.)

Accepted Answer

The kernel checks the file owner match first, then the group match, then others, and stops at the first applicable category.. The kernel evaluates permissions in a strict order: owner, then group, then others, stopping at the first matching category. Group matching considers the full supplementary group set, not just the primary GID. Because the first match wins, permissions are never combined across categories, and root is exempt from the ordinary checks for regular file access.

Answer

Read permission on a file is sufficient to modify its contents, provided the user also owns the file.

Answer

The root user is subject to the same first-match-wins rule as ordinary users and can be denied by a mode of 000.

Answer

If a process's effective UID matches the file owner, the group and others bits are also combined to grant the widest possible access.

Question 9

A developer stores a script at /home/dev/deploy.sh and wants to prevent other users on the system from reading, writing, or executing it. The file is currently owned by dev with permissions 644. Which command should the developer run?

Accepted Answer

chmod 600 /home/dev/deploy.sh. Mode 600 removes all group and other permissions while preserving owner read and write. This ensures only the owner can access the file, satisfying the requirement to prevent other users from reading, writing, or executing it. Mode 700 would also block others but unnecessarily adds owner execute.

Answer

chmod 700 /home/dev/deploy.sh

Answer

chmod 640 /home/dev/deploy.sh

Answer

chmod 444 /home/dev/deploy.sh

Question 10

A security administrator notices that a script located at /usr/local/bin/backup.sh has permissions -rwsr-xr-x and is owned by root:root. The administrator wants to prevent the script from running with root privileges while still allowing all users to execute it. Which command should be executed?

Accepted Answer

chmod u-s /usr/local/bin/backup.sh. The setuid bit on a file owned by root causes it to execute with root's effective user ID. To prevent that while keeping the script executable by everyone, the setuid bit must be removed without altering the execute permissions. The command chmod u-s does exactly that, leaving the mode as rwxr-xr-x and eliminating the privilege escalation.

Answer

chmod 755 /usr/local/bin/backup.sh

Answer

chmod g-s /usr/local/bin/backup.sh

Answer

chmod o-x /usr/local/bin/backup.sh

Question 11

A security policy requires that new files created by any user on a shared project directory automatically belong to the group 'projectteam' instead of the user's primary group. Which command should the administrator run on the directory /srv/project to achieve this?

Accepted Answer

chmod g+s /srv/project. On a directory, the SGID bit makes new entries inherit the directory's group ownership, which is exactly what the policy demands. The directory must already be owned by the desired group, and setting the bit with chmod g+s ensures that every file created inside belongs to projectteam regardless of the creator's primary group.

Answer

chgrp projectteam /srv/project

Answer

setfacl -m d:g:projectteam:rwx /srv/project

Answer

chmod u+s /srv/project

Question 12

A user named dave complains that he cannot change into the directory /data/reports even though he has read permission on it. Which TWO of the following could be the reason? (Choose two.)

Accepted Answer

The directory's execute permission is set but dave is not the owner and not in the owning group, and others have no execute permission.. Entering a directory requires execute permission for the user's applicable category. Missing execute for the user/group or for others (if dave is not owner or in group) will block cd. The sticky bit and SGID do not affect traversal, and 777 would allow it. Thus, the two plausible reasons are missing execute for the relevant category.

Answer

The directory's permissions are set to 777, which confuses the system.

Answer

The directory has the SGID bit set, which overrides execute permissions.

Answer

The directory lacks the sticky bit, preventing dave from entering.

Question 13

You are managing a directory shared by a project team. You want all files created in this directory to automatically belong to the 'developers' group, regardless of the user's primary group. Which command achieves this?

Accepted Answer

chmod g+s /data. `chmod g+s /data` sets the setgid (SGID) bit on the directory. When SGID is set on a directory, any file or subdirectory created inside inherits the directory's group ownership instead of the creating user's primary group. This is exactly the behavior needed for a shared 'developers' group directory.

Answer

usermod -aG developers

Answer

chgrp developers /data

Answer

chmod 1777 /data

Question 14

You want to change the primary group of an existing user named 'bob' to 'staff'. Which command should you use?

Accepted Answer

usermod -g staff bob. The usermod command modifies existing user account attributes, and the -g flag specifically sets the user's primary group (the GID stored in /etc/passwd). Running 'usermod -g staff bob' changes bob's primary group to staff while leaving his supplementary group memberships intact. This is the standard, correct way to reassign a primary group on a Linux system.

Answer

groupmod -n staff bob

Answer

chgrp staff bob

Answer

usermod -G staff bob

Question 15

A system administrator needs to identify the numerical ID (UID) of the user 'jdoe'. Which file should be checked?

Accepted Answer

/etc/passwd. The /etc/passwd file stores one line per user account, with colon-separated fields where the third field is the numerical UID. Checking this file (or running getent passwd jdoe) reveals the UID assigned to 'jdoe'. It is world-readable, unlike /etc/shadow, so it is the standard place to look up account identifiers.

Answer

/etc/shadow

Answer

/etc/profile

Answer

/etc/group

Question 16

A user's account has been compromised. Which command is the most effective way to lock the user account immediately while preserving their files?

Accepted Answer

usermod -L jdoe. `usermod -L jdoe` locks the account by prepending an exclamation mark (!) to the password hash in /etc/shadow, immediately preventing password-based logins while leaving the user's home directory, files, UID, and group memberships fully intact. This is the standard, reversible administrative action for a compromised account because it disables authentication without destroying data or ownership.

Answer

userdel jdoe

Answer

killall -u jdoe

Answer

chsh -s /bin/false jdoe

Question 17

Which permission bit must be set on a directory to allow a user to enter the directory and access files within it?

Accepted Answer

Execute (x). The execute (x) bit on a directory grants the right to traverse it — that is, to access files and subdirectories by name within it. Without x, even if you have read permission, you cannot cd into the directory or open files whose paths pass through it.

Answer

Write (w)

Answer

Sticky bit

Answer

Read (r)

Question 18

You are configuring a temporary directory where multiple users save files. To ensure that users can only delete their own files and not files created by others, what must you set?

Accepted Answer

chmod +t /tmp/shared. The sticky bit (chmod +t) on a shared directory ensures that only the file's owner (or root) can delete or rename files within it, even if the directory is world-writable. This is exactly the behaviour needed for /tmp-style shared drop boxes where multiple users write files but must not remove each other's data. The kernel enforces this by checking the file owner against the deleting user before permitting unlink or rename.

Answer

chown root /tmp/shared

Answer

chmod 777 /tmp/shared

Answer

umask 077

Question 19

You need to prevent a standard user from accidentally deleting a critical configuration file owned by root. Which command ensures the file cannot be modified or deleted even by the root user?

Accepted Answer

chattr +i file.conf. The 'chattr +i' command sets the immutable attribute on a file, which prevents any modification, deletion, renaming, or even linking — even by the root user — until the attribute is removed with 'chattr -i'. This is the only option that satisfies the requirement of protecting the file from root itself.

Answer

chown root:root file.conf

Answer

chmod 400 file.conf

Answer

umask 000

Question 20

Which command-line tool is used to display the groups a specific user belongs to?

Accepted Answer

groups. The groups command prints the group memberships for a specified user (or the current user if none is given), making it the direct answer. Running 'groups alice' lists every group alice belongs to, including her primary group and any supplementary groups. It reads from /etc/group and /etc/passwd (or NSS sources like LDAP/SSSD) to resolve memberships.

Answer

id

Answer

listgroups

Answer

whoami