EX200 Manage users and groups — 20 Questions

Question 1

A system administrator needs to ensure that a user named 'bob' can access a shared directory '/data' owned by group 'developers'. The directory has permissions 2775 and is owned by root:developers. Bob is a member of the 'developers' group. However, when Bob tries to create a file in '/data', it fails with 'Permission denied'. What is the most likely cause?

Accepted Answer

The directory has incorrect SELinux context. The directory '/data' has permissions 2775, which grants read, write, and execute to the group 'developers'. Bob is a member of 'developers', so standard Unix permissions should allow him to create files. However, the failure with 'Permission denied' despite correct group membership and permissions strongly indicates that SELinux is enforcing a policy that denies Bob write access. The most likely cause is that the directory lacks the correct SELinux context (e.g., `default_t` instead of a type like `public_content_rw_t` or a context that allows write operations).

Answer

Bob's umask is set to 0077

Answer

The setgid bit is not set

Answer

Bob's primary group is not developers

Question 2

A company policy requires that when a user is deleted, all files owned by that user in /home should be reassigned to a 'guest' account. Which command accomplishes this?

Accepted Answer

find /home -user olduser -exec chown guest {} +. Option B uses `find` to locate all files owned by `olduser` under `/home` and then executes `chown guest` on them, which reassigns ownership to the `guest` account. This directly satisfies the policy requirement without affecting the user account itself or copying files.

Answer

usermod -l guest olduser

Answer

userdel -r olduser

Answer

rsync -a /home/olduser/ /home/guest/

Question 3

An administrator wants to add the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from other groups. Which command should be used?

Accepted Answer

usermod -aG wheel,docker jane. Option B is correct because the `usermod -aG` command appends the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from any existing supplementary groups. The `-a` (append) flag must be used with `-G` to avoid overwriting the current group membership list, which is the default behavior of `-G` alone.

Answer

groupmems -a jane -g wheel,docker

Answer

usermod -a -G wheel,docker jane

Answer

usermod -G wheel,docker jane

Question 4

A server has a requirement that all users in the 'finance' group must have a password aging policy that forces password change every 90 days. Which approach best achieves this for existing users?

Accepted Answer

Write a script to run 'chage -M 90' for each user in the finance group. Option D is correct because `chage -M 90` sets the maximum password age for a specific user, and by scripting it to apply to all members of the 'finance' group, you directly enforce the 90-day policy on existing users. This approach works regardless of the default settings in `/etc/login.defs`, which only affect new users, and avoids the manual and error-prone editing of `/etc/shadow`.

Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs

Answer

Edit /etc/shadow and change the fifth field for all users

Answer

Configure pam_pwquality.so to enforce password age

Question 5

Which TWO commands can change the primary group of an existing user?

Accepted Answer

usermod -aG. The `usermod -g` command (not `-aG`, which adds supplementary groups) changes the primary group of an existing user. The `gpasswd -a` command adds a user to a group, but it does not change the primary group; it only affects supplementary group membership. Therefore, neither option A nor B is correct for changing the primary group. The correct commands are `usermod -g` (to set the primary group) and `usermod -G` (to set supplementary groups, but not the primary).

Answer

vigr

Answer

groupmems -a

Answer

useradd -G

Question 6

Given the exhibit, which statement is true about the file /project/report.txt?

Accepted Answer

Alice can write to report.txt. The exhibit shows that the file /project/report.txt has permissions -rw-rw-r--, owner alice, and group project. Alice is the owner, so she has the owner permissions (rw-), which include write access. Therefore, option B is correct because Alice can write to the file.

Answer

Any user can read report.txt

Answer

The file's group is wheel

Answer

Alice cannot write to report.txt because she is not the owner

Question 7

You are managing a Red Hat Enterprise Linux 8 server that hosts a shared development environment. The server has a directory /projects owned by root:developers with permissions 2770. There are three users: dev1, dev2, and dev3, all members of the 'developers' group. Developers need to create and edit files in /projects, and any new file should be writable by all members of the developers group. However, you notice that when dev1 creates a file, the permissions are 644 instead of 664, and the group is set to dev1's primary group (dev1) instead of 'developers'. After investigating, you find that the setgid bit is set on /projects, but the directory's ACLs are not configured. What is the most efficient way to ensure that new files in /projects inherit the group 'developers' and have group-writable permissions by default?

Accepted Answer

Set a default ACL with setfacl -d -m g:developers:rwx /projects. Option A is correct because setting a default ACL on the /projects directory with `setfacl -d -m g:developers:rwx /projects` ensures that any new file or subdirectory created inside /projects automatically inherits the 'developers' group with rwx permissions. This overrides the creating user's umask and primary group, guaranteeing group-writable files (664) and the correct group ownership, which the setgid bit alone cannot achieve for group permissions when the user's umask is restrictive.

Answer

Reapply the setgid bit using chmod g+s /projects

Answer

Change dev1's umask to 0002 in /etc/bashrc

Answer

Set the sticky bit on /projects with chmod o+t /projects

Question 8

A system administrator needs to ensure that the user 'jdoe' cannot log in via SSH but can still use other services like FTP. Which approach should the administrator take?

Accepted Answer

Change the user's shell to /sbin/nologin. Option D is correct because changing the user's shell to /sbin/nologin prevents interactive login via SSH (which requires a valid shell listed in /etc/shells) while still allowing non-interactive services like FTP, which typically do not check the user's shell. This approach specifically blocks SSH access without locking the account or affecting other authentication methods.

Answer

Lock the user account with 'usermod -L jdoe'

Answer

Delete the user's password with 'passwd -d jdoe'

Answer

Remove the user's home directory

Question 9

Which TWO commands can be used to add the user 'alice' to the supplementary group 'developers'?

Accepted Answer

gpasswd -a alice developers. Option A is correct because `gpasswd -a alice developers` adds the user 'alice' to the supplementary group 'developers' by appending her to the group's member list in /etc/group. Option C is correct because `usermod -aG developers alice` appends 'alice' to the supplementary group 'developers' without removing her from other supplementary groups, which is the intended behavior for adding a user to an additional group.

Answer

useradd -g developers alice

Answer

groupmod -a alice developers

Answer

usermod -g developers alice

Question 10

Refer to the exhibit. A web server runs as user 'apache'. The directory /var/www/html is owned by root:root with permissions 755. The administrator wants to allow the user 'webuser' to upload files to /var/www/html via SFTP. Which step is necessary to achieve this?

Accepted Answer

Change group ownership of /var/www/html to a group that includes webuser and add group write permission. Option B is correct because the directory /var/www/html is owned by root:root with permissions 755, meaning only root can write. To allow webuser to upload files via SFTP, the directory needs group write permission. Changing the group ownership to a group that includes webuser and adding group write permission (e.g., chgrp webgroup /var/www/html && chmod g+w /var/www/html) grants the necessary write access without altering ownership or security contexts.

Answer

Change webuser's shell to /bin/bash to allow SFTP login

Answer

Change the SELinux context of /var/www/html to httpd_sys_rw_content_t

Answer

Set an ACL on /var/www/html to grant webuser write access

Question 11

Arrange the steps to configure a network bond (mode 1) using two interfaces (eth0, eth1) in RHEL.

Question 12

Match each firewall zone to its default trust level.

Question 13

A company needs to create a user account for a temporary contractor who will work for exactly 90 days. The account must be automatically disabled after 90 days. Which command should the administrator use?

Accepted Answer

useradd -e $(date -d '+90 days' +%Y-%m-%d) contractor. Option B is correct because the `-e` (expiration date) option sets the date on which the user account will be disabled. Using `$(date -d '+90 days' +%Y-%m-%d)` dynamically calculates the exact date 90 days from today in YYYY-MM-DD format, which meets the requirement for automatic disable after exactly 90 days.

Answer

useradd -f 90 contractor

Answer

useradd -e 90 contractor

Answer

useradd -f 90 -e 0 contractor

Question 14

A user named jdoe is receiving 'Permission denied' errors when trying to access a file owned by root with permissions 644. The user is a member of the root group. What is the most likely cause?

Accepted Answer

The directory containing the file lacks execute permission for the group or others.. The file has permissions 644, meaning the owner (root) has read/write, and the group (root) and others have read-only access. Since jdoe is a member of the root group, the file's group read permission should allow access. However, to traverse a directory and access any file within it, the user needs execute (x) permission on that directory. If the directory lacks execute for the group or others, jdoe will get 'Permission denied' even if the file permissions are correct.

Answer

The file's group owner is not root.

Answer

The file's read permission is not granted to the root group.

Answer

The user needs to be added to the root group again.

Question 15

After being added to a new supplementary group with usermod -aG, a user logs out and back in but still cannot access files owned by that group. Which command should the user run to verify current effective group membership?

Accepted Answer

id. The `id` command without arguments displays the real and effective user and group IDs, including all supplementary group memberships. After a user is added to a new group with `usermod -aG`, the change takes effect only in new login sessions; running `id` confirms whether the current shell has actually inherited the new group. Option B is correct because it directly shows the effective group membership for the current process.

Answer

newgrp -c 'groups'

Answer

groups $(whoami)

Answer

usermod -g

Question 16

A new employee named asmith needs a user account with a home directory and a specific UID of 1500. Which command accomplishes this?

Accepted Answer

useradd -m -u 1500 asmith. Option A is correct because `useradd -m -u 1500 asmith` creates the user asmith with a home directory (via `-m`) and assigns a specific UID of 1500 (via `-u`). The `-m` flag ensures the home directory is created if it does not exist, which is required by the question.

Answer

adduser -uid 1500 asmith

Answer

useradd -h /home/asmith -u 1500 asmith

Answer

useradd -d /home/asmith -U 1500 asmith

Question 17

A system administrator needs to change the primary group of an existing user to a group that already exists. Which command should be used?

Accepted Answer

usermod -g existinggroup username. Option B is correct because the `usermod -g` command changes the primary group of an existing user to a specified group that already exists on the system. The `-g` option sets the initial login group (GID) for the user, which must be a valid group name or GID from `/etc/group`.

Answer

groupmod -g existinggroup username

Answer

usermod -p existinggroup username

Answer

usermod -G existinggroup username

Question 18

A server has been compromised, and the administrator suspects an unauthorized user account may have been created. Which file should be examined to list all local user accounts?

Accepted Answer

/etc/passwd. The /etc/passwd file is the primary local user account database on Linux systems, listing all user accounts with fields such as username, UID, GID, GECOS, home directory, and login shell. Examining this file reveals every local user account, including any unauthorized ones that may have been created, because each account must have an entry here to be recognized by the system.

Answer

/etc/shadow

Answer

/etc/shells

Answer

/etc/login.defs

Question 19

An administrator wants to ensure that any new user accounts created on the system have a default primary group matching the username. What change is needed?

Accepted Answer

Set USERGROUPS_ENAB to yes in /etc/login.defs. Option C is correct because setting USERGROUPS_ENAB to yes in /etc/login.defs instructs the useradd command to automatically create a private group with the same name as the new user and assign it as the user's primary group. This is the default behavior in Red Hat Enterprise Linux and ensures that each new user has a matching primary group without manual intervention.

Answer

Set GROUP to same name in /etc/default/useradd

Answer

Set USERGROUPS_ENAB to no; then create user with -g

Answer

Set CREATE_HOME to yes in /etc/login.defs

Question 20

A user reports that they can log in but cannot change their password. Which file might be misconfigured?

Accepted Answer

/etc/shadow with an expiration date in the past. The /etc/shadow file stores password aging information, including the date of the last password change and the expiration date. If the account's expiration date is set in the past, the system will allow login (if the account is not locked) but will prevent the user from changing their password because the account is considered expired. This matches the symptom where the user can authenticate but cannot update their password.

Answer

/etc/group with no user entry

Answer

/etc/login.defs with PASS_MAX_DAYS set to 0

Answer

/etc/passwd with incorrect shell