010-160 Security And File Permissions Practice Test 3 — 15 Questions

Question 1

What is the result of running 'chmod 000 secret.txt'?

Accepted Answer

No user can access it (except root).. chmod 000 removes all permission bits (read, write, execute) for owner, group, and others, so no regular user can read, write, or execute the file. Root bypasses discretionary permission checks on most filesystems, so root can still access it. This is why the correct answer is that no user can access it except root.

Answer

The file becomes read-only for root.

Answer

Only the owner can access it.

Answer

The file is deleted.

Question 2

Which directory contains the user accounts' password hashes and aging data on most modern Linux systems?

Accepted Answer

/etc/shadow. On modern Linux systems, /etc/shadow is the file that stores encrypted password hashes along with password aging information such as the last change date, minimum and maximum password age, and expiration warnings. It is readable only by root, which protects the hashes from unauthorized access. The /etc/passwd file historically held password hashes but now contains only user account information, with the password field replaced by an 'x' that points to /etc/shadow.

Answer

/etc/passwd

Answer

/var/spool/mail

Answer

/etc/group

Question 3

You have a file 'notes.txt' and you want to ensure the group owner can read and write it, but nobody else can access it. Which chmod command works?

Accepted Answer

chmod 660 notes.txt. chmod 660 notes.txt sets the permissions to rw-rw----, meaning the owner and group both have read and write access, while others have no permissions at all. This matches the requirement that the group owner can read and write and nobody else can access the file. The leading 6 (rw-) applies to owner, the second 6 (rw-) to group, and the 0 (---) to others.

Answer

chmod 060 notes.txt

Answer

chmod 666 notes.txt

Answer

chmod 770 notes.txt

Question 4

You want to delete a user account named 'baduser' and also remove their home directory. Which command is correct?

Accepted Answer

userdel -r baduser. The userdel -r command removes the user account from /etc/passwd and /etc/shadow and also deletes the user's home directory and mail spool in one step. This is the standard, atomic way to fully decommission an account on Linux. Using -r ensures no orphaned home directory remains, which is important for security and disk hygiene.

Answer

deluser --remove baduser

Answer

userdel -f baduser

Answer

rm -rf /home/baduser && userdel baduser

Question 5

Which THREE commands can be used to check user information or current session identity?

Accepted Answer

whoami. Option C, whoami, is correct because it prints the effective username of the current session, directly answering the question of current session identity. Option D, id, is correct because it displays the current user's UID, GID, and all supplementary group memberships, giving a complete picture of the session's identity. Option E, groups, is correct because it lists the groups the current user (or a specified user) belongs to, which is user information relevant to session identity. Option A, userdel, is not correct because it is an administrative command that deletes a user account and does not report identity. Option B, chage, is not correct because it manages password aging information for a user account rather than reporting current session identity.

Answer

userdel

Answer

chage

Question 6

Which THREE of these are valid types of permissions in Linux file systems?

Accepted Answer

Read. In Linux file systems, the standard permission model defines exactly three basic permission types: read (r), write (w), and execute (x), so options A (Read), B (Execute), and C (Write) are all correct. Read allows viewing file contents or listing a directory, write allows modifying file contents or creating/deleting entries within a directory, and execute allows running a file as a program or traversing a directory. These three permissions are represented in the rwx notation and in octal values (4, 2, 1) used by chmod. Option D (Delete) is not a distinct permission type; deletion is governed by write and execute permissions on the containing directory. Option E (Append) is also not a separate permission type in the standard Linux model; append-only behavior is enforced through file attributes such as chattr +a, not through the rwx permission bits.

Answer

Delete

Answer

Append

Question 7

Which TWO of these tools can modify file ownership or permissions?

Accepted Answer

chown. chown (C) is correct because it directly changes the owner and/or group of files and directories, e.g. chown user:group file. chmod (E) is correct because it modifies file permission bits (read/write/execute for user, group, and others) using symbolic or octal modes. groupdel (A) only removes a group from the system and does not alter file ownership or permissions. useradd (B) creates new user accounts and does not touch existing files' ownership or permissions. usermod (D) modifies user account attributes such as group membership or shell, but it does not change file ownership or permissions.

Answer

groupdel

Answer

useradd

Answer

usermod

Question 8

Which THREE of the following are special permission bits in Linux?

Accepted Answer

Sticky bit. The sticky bit (B) is a special permission bit, historically used on directories so that only a file's owner (or root) can delete or rename files within it, and it appears as a 't' in the other-execute position of ls -l output. Setgid (D) is a special permission bit that, when set on an executable, runs it with the file's group identity, and when set on a directory causes new files to inherit the directory's group; it is shown as 's' in the group-execute position. Setuid (E) is a special permission bit that makes an executable run with the file owner's effective UID, displayed as 's' in the user-execute position. By contrast, the immutable bit (A) and append-only bit (C) are file attributes managed by chattr and viewed with lsattr (e.g., chattr +i and chattr +a), not permission bits set via chmod, so they are not among the three special permission bits.

Answer

Immutable bit

Answer

Append-only bit

Question 9

Which THREE commands are used to manage user account lifecycle?

Accepted Answer

useradd. The three commands that manage the user account lifecycle are useradd (C), userdel (D), and usermod (E). useradd creates a new user account, including its entry in /etc/passwd, /etc/shadow, and /etc/group, and optionally provisions a home directory and default shell, which is the creation phase of the lifecycle. userdel removes a user account and, with options like -r, also deletes the home directory and mail spool, covering the deletion phase. usermod modifies an existing account's attributes such as login name (-l), UID (-u), shell (-s), groups (-aG), and account expiry, covering the maintenance/modification phase. passwd (A) only changes or manages a user's password and password aging, and groupadd (B) only creates groups, so neither manages the full user account lifecycle of create, modify, and delete.

Answer

passwd

Answer

groupadd

Question 10

Which THREE commands are related to viewing or changing group memberships?

Accepted Answer

groups. Option A, `groups`, is correct because it displays the groups a specified user (or the current user) belongs to, directly showing group memberships. Option C, `id`, is correct because it prints the user's UID, primary GID, and the list of supplementary groups the user is a member of, which is exactly membership information. Option E, `usermod -aG`, is correct because the `-aG` combination appends the user to one or more supplementary groups, thereby changing group memberships without removing existing ones. Option B, `chgrp`, is not correct here because it changes the group ownership of files or directories, not a user's group membership. Option D, `groupmod`, is not correct because it modifies a group's attributes such as its name or GID, rather than viewing or changing which users belong to groups.

Answer

chgrp

Answer

groupmod

Question 11

Which TWO of the following are true about the 'others' category of file permissions?

Accepted Answer

Is the last set of characters in the 'ls -l' output.. Option B is correct because in the ten-character permission string produced by 'ls -l' (e.g., -rwxr-xr-x), the final three characters represent the permissions for the 'others' category, following the owner and group triplets. Option E is correct because 'others' is defined as every user account that is neither the file's owner nor a member of the file's owning group, so those users are governed by this third permission set. Option A is wrong because any user who falls into the 'others' category is affected by these bits, and the owner or root can change them via chmod; it is not restricted to root. Option C is wrong because 'others' permissions are set independently and do not inherit from group permissions. Option D is wrong because owner permissions take precedence in the kernel's permission-checking order (owner, then group, then others), so 'others' can never override the owner's bits.

Answer

Only root can modify this category.

Answer

Automatically inherits group permissions.

Answer

Can override owner permissions.

Question 12

Which TWO of the following locations or methods are commonly used to define where a user's home directory is located?

Accepted Answer

The useradd -d flag. Option A (the useradd -d flag) is correct because useradd -d /path/to/home explicitly sets the home directory field (field 6) for the new account when the user is created, writing that value into the account database. Option B (/etc/passwd file) is correct because the passwd file stores the home directory as the sixth colon-separated field of each user entry, and this is the authoritative location from which login programs read the user's home directory. Option C (/etc/profile) is not correct because it is a shell startup script that sets environment variables and login behavior, not the home directory definition. Option D (/etc/group) is not correct because it defines group membership, not user home directories. Option E (/etc/shadow) is not correct because it stores password hashes and aging information, not the home directory path.

Answer

The /etc/profile file

Answer

The /etc/group file

Answer

The /etc/shadow file

Question 13

Which TWO statements regarding the 'umask' command are correct?

Accepted Answer

It sets default permissions for new files.. Option B is correct because umask defines the default permission bits that are removed when a new file or directory is created, so it directly sets the default permissions for new files (e.g., a umask of 022 yields 644 for files and 755 for directories). Option E is correct because umask works by masking, or clearing, permission bits from the base creation mode (666 for files, 777 for directories) so those bits are not set on newly created files. Option A is wrong because any user can set their own umask, not just root. Option C is wrong because umask is a shell/process attribute typically set in shell profiles like /etc/profile or ~/.bashrc, not stored in /etc/shadow, which holds password hashes. Option D is wrong because umask only affects files created after it is set; it does not retroactively change permissions on existing files.

Answer

It can only be set by root.

Answer

It is stored in /etc/shadow.

Answer

It applies to existing files immediately.

Question 14

A junior administrator runs `chmod g+s /srv/reports` on a directory that is owned by root:finance and then creates a file inside it as the user `alice`, who is a member of the finance group. Which ownership will the newly created file have?

Accepted Answer

alice:finance, because SGID on a directory forces group inheritance from the directory. The SGID bit on a directory changes group inheritance: files and subdirectories created within it receive the directory's group rather than the creator's primary group. Because /srv/reports is owned by root:finance, alice's new file is recorded as alice:finance. This is the standard mechanism for keeping shared project directories consistently group-owned so that all members of finance retain access.

Answer

root:finance, because the directory owner's group is inherited and the owner is root

Answer

alice:root, because the file inherits the group of the parent process's effective user

Answer

alice:alice, because the creating user's primary group is always used

Question 15

A developer runs `ls -l report.txt` and sees `-rw-r----- 1 alice devs 2048 May 10 09:15 report.txt`. The file must be readable by all members of the `devs` group, but currently only alice can read it. The file's group ownership is already correct. Which command will grant read access to the `devs` group without changing any other permission bits?

Accepted Answer

chmod g+r report.txt. Symbolic chmod lets you manipulate one permission category at a time. Because group ownership is already correct and only the group read bit is missing, selecting the group category and adding read yields exactly the intended access. The other forms either target the wrong category or widen access to all users, which the scenario explicitly does not want.

Answer

chmod +r report.txt

Answer

chmod o+r report.txt

Answer

chmod u+r report.txt