010-160 Security And File Permissions Practice Test 2 — 15 Questions

Question 1

A user's account has been compromised. Which command is the most effective way to lock the user account immediately while preserving their files?

Accepted Answer

usermod -L jdoe. `usermod -L jdoe` locks the account by prepending an exclamation mark (!) to the password hash in /etc/shadow, immediately preventing password-based logins while leaving the user's home directory, files, UID, and group memberships fully intact. This is the standard, reversible administrative action for a compromised account because it disables authentication without destroying data or ownership.

Answer

userdel jdoe

Answer

killall -u jdoe

Answer

chsh -s /bin/false jdoe

Question 2

Which permission bit must be set on a directory to allow a user to enter the directory and access files within it?

Accepted Answer

Execute (x). The execute (x) bit on a directory grants the right to traverse it — that is, to access files and subdirectories by name within it. Without x, even if you have read permission, you cannot cd into the directory or open files whose paths pass through it.

Answer

Write (w)

Answer

Sticky bit

Answer

Read (r)

Question 3

You are configuring a temporary directory where multiple users save files. To ensure that users can only delete their own files and not files created by others, what must you set?

Accepted Answer

chmod +t /tmp/shared. The sticky bit (chmod +t) on a shared directory ensures that only the file's owner (or root) can delete or rename files within it, even if the directory is world-writable. This is exactly the behaviour needed for /tmp-style shared drop boxes where multiple users write files but must not remove each other's data. The kernel enforces this by checking the file owner against the deleting user before permitting unlink or rename.

Answer

chown root /tmp/shared

Answer

chmod 777 /tmp/shared

Answer

umask 077

Question 4

You need to prevent a standard user from accidentally deleting a critical configuration file owned by root. Which command ensures the file cannot be modified or deleted even by the root user?

Accepted Answer

chattr +i file.conf. The 'chattr +i' command sets the immutable attribute on a file, which prevents any modification, deletion, renaming, or even linking — even by the root user — until the attribute is removed with 'chattr -i'. This is the only option that satisfies the requirement of protecting the file from root itself.

Answer

chown root:root file.conf

Answer

chmod 400 file.conf

Answer

umask 000

Question 5

Which command-line tool is used to display the groups a specific user belongs to?

Accepted Answer

groups. The groups command prints the group memberships for a specified user (or the current user if none is given), making it the direct answer. Running 'groups alice' lists every group alice belongs to, including her primary group and any supplementary groups. It reads from /etc/group and /etc/passwd (or NSS sources like LDAP/SSSD) to resolve memberships.

Answer

id

Answer

listgroups

Answer

whoami

Question 6

You need to create a new group named 'audit'. Which command should you execute?

Accepted Answer

groupadd audit. The `groupadd` command is the standard Linux utility for creating a new group, and `groupadd audit` will create a group named 'audit' in the system's group database (/etc/group). This is part of the shadow-utils package and is the canonical way to add groups on Linux distributions.

Answer

newgroup audit

Answer

useradd -g audit

Answer

addgroup audit

Question 7

You want to set a default umask of 027 for all users. Which file should you edit to apply this globally?

Accepted Answer

/etc/profile. The /etc/profile file is a system-wide initialization script executed by login shells for all users. Placing a umask 027 command there sets the default umask globally, affecting every user who starts a login shell. This is the standard location for system-wide environment and shell settings on Linux distributions that use the Bourne-compatible shell family.

Answer

/etc/bashrc

Answer

/etc/passwd

Answer

~/.bash_profile

Question 8

You notice a file has permissions listed as '-rwsr-xr-x'. What does the 's' in the owner's position indicate?

Accepted Answer

The file is a setuid binary.. The 's' in the owner's execute position (the fourth character of the permission string) indicates the setuid bit is set. When a setuid binary is executed, the process runs with the effective UID of the file's owner rather than the invoking user, which is how tools like /usr/bin/passwd let ordinary users modify /etc/shadow. The lowercase 's' means the underlying execute bit is also set; an uppercase 'S' would mean setuid is set but execute is not.

Answer

The file is a setgid binary.

Answer

The file is immutable.

Answer

The file is a sticky directory.

Question 9

You want to change the owner of 'data.txt' from 'user1' to 'user2' AND the group from 'group1' to 'group2' in one command. Which is correct?

Accepted Answer

chown user2:group2 data.txt. The chown command accepts the syntax 'chown user:group file' to change both owner and group in a single invocation. Using the colon as a separator between user and group is the canonical POSIX form, and chown also accepts a dot (chown user.group file) on most Linux systems. Option C is the only choice that correctly combines both changes into one valid command.

Answer

chown user2 -g group2 data.txt

Answer

chown user2 group2 data.txt

Answer

chown user2 data.txt && chgrp group2 data.txt

Question 10

To add a new user named 'guest' and set their home directory to '/home/guest', which command is correct?

Accepted Answer

useradd -m -d /home/guest guest. useradd -m -d /home/guest guest creates the account 'guest', sets its home directory to /home/guest via -d, and -m ensures the directory is actually created and populated with skeleton files from /etc/skel. Without -m, useradd would record the home path but not create it.

Answer

usermod -d /home/guest guest

Answer

useradd -h /home/guest guest

Answer

addhome guest

Question 11

A file is owned by root and has permissions 600. What happens if a regular user tries to read this file?

Accepted Answer

Access is denied.. With permissions 600 (rw-------), only the file owner (root) has read and write access; group and other have no permissions at all. A regular user falls into the 'other' category, so the kernel denies the read attempt with EACCES (Permission denied). This is standard POSIX discretionary access control behavior — the owner bits apply only to UID 0 in this case, and no ACL or capability overrides the denial.

Answer

The user is prompted for a password.

Answer

The user can only read but not write.

Answer

Access is granted.

Question 12

What is the primary purpose of the /etc/shadow file?

Accepted Answer

It stores encrypted password hashes.. The /etc/shadow file stores encrypted password hashes along with password aging information for local user accounts. It is readable only by root, unlike /etc/passwd, which is world-readable and historically held the hashes.

Answer

It stores all user login shells.

Answer

It stores system-wide cron jobs.

Answer

It stores user group membership lists.

Question 13

Which command removes a group named 'tempgroup' from the system?

Accepted Answer

groupdel tempgroup. The groupdel command is the standard Linux utility used to remove a group from the system. It deletes the group entry from /etc/group and /etc/gshadow, and is the correct tool for this task.

Answer

usermod -r tempgroup

Answer

grouprm tempgroup

Answer

removegroup tempgroup

Question 14

Which file permission represents read, write, and execute for the owner, and read-only for group and others?

Accepted Answer

744. The permission 744 means the owner has read (4), write (2), and execute (1) = 7, while group and others each have read (4) only. This matches the requirement of read, write, and execute for the owner and read-only for group and others. The other options do not match this exact combination.

Answer

755

Answer

644

Answer

700

Question 15

A user complains they cannot read a file. The file has permissions 640 and is owned by root, but the user is in the group that owns the file. Why can't they read it?

Accepted Answer

The user lacks execute permission on a parent directory.. On Linux, reading a file requires execute (x) permission on every directory in the path leading to the file. Even though the file's group permissions include read (the '4' in 640), the user cannot traverse into the directory containing the file without execute permission on that parent directory. This is the classic 'permission denied' scenario where file permissions look correct but directory traversal is blocked.

Answer

The umask is set to 077.

Answer

The user is not the owner.

Answer

The file is locked by root.