010-160 Security And File Permissions — Timed 10 Questions

Question 1

A user reports they cannot execute a script named 'deploy.sh' even though the file permissions are set to 644. What must you change to enable execution for the owner?

Accepted Answer

chmod 744 deploy.sh. Permissions 644 give the owner read and write (6) but no execute, so the script cannot run. To enable execution for the owner while keeping read/write, you need 7 (rwx) for the owner, giving 744 — read and execute for group and others.

Answer

chmod 655 deploy.sh

Answer

chown u+x deploy.sh

Answer

chmod +w deploy.sh

Question 2

Which TWO of the following files are essential for basic user and group management?

Accepted Answer

/etc/group. /etc/passwd (option D) is essential because it stores the basic user account database, mapping usernames to UIDs, primary GIDs, home directories, and login shells, which is fundamental to user management. /etc/group (option B) is equally essential because it defines group entries, mapping group names to GIDs and listing their member users, which is required for group management. Together these two files provide the core identity and membership data used by tools like useradd, usermod, groupadd, and groupmod. The other options do not belong: /etc/hosts (A) is for static hostname-to-IP resolution, /etc/fstab (C) defines filesystem mount configuration, and /etc/shadow (E) stores password hashes and aging data—important for authentication but not part of the basic user/group identity database.

Answer

/etc/hosts

Answer

/etc/fstab

Answer

/etc/shadow

Question 3

Which command would you use to change the expiration date of a user's password?

Accepted Answer

chage. chage (change age) is the dedicated tool for viewing and modifying password-aging parameters, including expiration dates, minimum/maximum days between changes, and warning periods. Running 'chage -E 2025-12-31 user' sets the account expiration, and 'chage -l user' lists current aging settings.

Answer

passwd -e

Answer

usermod -e

Answer

userdel -p

Question 4

Which TWO of the following characterize the 'root' user in Linux?

Accepted Answer

Cannot be restricted by file permissions.. Option A is correct because the root user bypasses the normal discretionary access control checks on files and directories — the kernel grants root (UID 0) access regardless of the read/write/execute permission bits, so file permissions cannot restrict it. Option B is correct because the superuser account is defined by having UID 0 in /etc/passwd; the kernel identifies root by this numeric UID, not by the account name. Option C is wrong because root can be locked (e.g., with 'passwd -l root' or by prefixing the password hash in /etc/shadow with '!' or '*'), which blocks password-based logins. Option D is wrong because root's login shell is configurable in /etc/passwd and can be /bin/sh, /bin/zsh, /sbin/nologin, or anything else. Option E is wrong because root's group membership is defined by its primary GID (typically 0/root) and supplementary groups in /etc/group, and it is not inherently a member of the 'users' group.

Answer

Cannot be locked.

Answer

Must have a shell set to /bin/bash.

Answer

Is always member of the 'users' group.

Question 5

A junior administrator runs `ls -l /srv/payroll` and sees the permissions string `drwxrwx---` with owner `hr` and group `finance`. A member of the group `audit` needs read access to files inside this directory, and you must accomplish this without altering the permissions of any files already inside. Which approach meets the requirement?

Accepted Answer

Add the audit user to the finance group with usermod, then have the user log in again.. Directory group permissions are evaluated against the accessing account's group memberships, so bringing the audit user into the finance group gives them exactly the rwx access the group already holds on /srv/payroll. Because supplementary groups are assigned at session start, the user must obtain a new login session. No existing file's permission bits or ACLs are modified, which is what the constraint demands.

Answer

Run chmod g+rwx /srv/payroll and tell the audit user to access the path directly.

Answer

Run setfacl -R -m u:audit:rx /srv/payroll to propagate access to every child object.

Answer

Run chmod o+rx on the directory so the audit user is covered by the others category.

Question 6

You are reviewing the security posture of a Linux server. You want to identify which files have the SUID or SGID permission bits set, because these can pose privilege-escalation risks. Which TWO commands will list such files? (Choose two.)

Accepted Answer

find / -perm -u+s -o -perm -g+s. Both find commands use -perm with the SUID and SGID masks (numeric -4000/-2000 or symbolic u+s/g+s) and the -o operator to list files matching either condition. They are the standard, reliable methods for auditing setuid and setgid files across a filesystem.

Answer

getfacl -R / | grep -i suid

Answer

ls -lR / | grep '^...s'

Answer

stat --format='%A %n' / | grep 's'

Question 7

A junior administrator needs to grant read and write access to a file named report.txt for the user alice, while ensuring that the file's group (finance) can read it and no one else has any access. The file currently has mode 640 and is owned by alice:finance. Which TWO commands will achieve the required permissions? (Choose two.)

Accepted Answer

chmod 640 report.txt. The required permissions are read and write for the owner (alice), read only for the group (finance), and no access for others. This corresponds exactly to mode 640. Both the symbolic form u=rw,g=r,o= and the octal form 640 set these bits unambiguously, assuming the existing ownership is correct.

Answer

chmod u+rw,g+r,o-rwx report.txt

Answer

chmod 660 report.txt

Answer

chmod a=rw report.txt

Question 8

An administrator is reviewing how Linux decides whether a process may open a file, and wants to confirm which statements about the permission-checking model are accurate. (Choose two.)

Accepted Answer

The kernel checks the file owner match first, then the group match, then others, and stops at the first applicable category.. The kernel evaluates permissions in a strict order: owner, then group, then others, stopping at the first matching category. Group matching considers the full supplementary group set, not just the primary GID. Because the first match wins, permissions are never combined across categories, and root is exempt from the ordinary checks for regular file access.

Answer

Read permission on a file is sufficient to modify its contents, provided the user also owns the file.

Answer

The root user is subject to the same first-match-wins rule as ordinary users and can be denied by a mode of 000.

Answer

If a process's effective UID matches the file owner, the group and others bits are also combined to grant the widest possible access.

Question 9

A developer stores a script at /home/dev/deploy.sh and wants to prevent other users on the system from reading, writing, or executing it. The file is currently owned by dev with permissions 644. Which command should the developer run?

Accepted Answer

chmod 600 /home/dev/deploy.sh. Mode 600 removes all group and other permissions while preserving owner read and write. This ensures only the owner can access the file, satisfying the requirement to prevent other users from reading, writing, or executing it. Mode 700 would also block others but unnecessarily adds owner execute.

Answer

chmod 700 /home/dev/deploy.sh

Answer

chmod 640 /home/dev/deploy.sh

Answer

chmod 444 /home/dev/deploy.sh

Question 10

A security administrator notices that a script located at /usr/local/bin/backup.sh has permissions -rwsr-xr-x and is owned by root:root. The administrator wants to prevent the script from running with root privileges while still allowing all users to execute it. Which command should be executed?

Accepted Answer

chmod u-s /usr/local/bin/backup.sh. The setuid bit on a file owned by root causes it to execute with root's effective user ID. To prevent that while keeping the script executable by everyone, the setuid bit must be removed without altering the execute permissions. The command chmod u-s does exactly that, leaving the mode as rwxr-xr-x and eliminating the privilege escalation.

Answer

chmod 755 /usr/local/bin/backup.sh

Answer

chmod g-s /usr/local/bin/backup.sh

Answer

chmod o-x /usr/local/bin/backup.sh