EX200 Manage users and groups Practice Test 2 — 15 Questions

Question 1

A user reports they cannot log in to a Linux system. Their account was recently created. The administrator checks /etc/passwd and sees the entry: jsmith:x:1001:1001::/home/jsmith:/sbin/nologin. What is the likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user's shell is set to /sbin/nologin which prevents login. The user's shell is set to /sbin/nologin, which is a shell that displays a message and exits immediately, preventing interactive login. This is the direct cause of the login failure, as the system uses the shell field in /etc/passwd to determine the login program.

Answer

The user is locked due to expired password

Answer

The home directory does not exist

Answer

The user is not in any supplementary groups

Question 2

An administrator is migrating user accounts to a new system. They want to preserve the user's primary group name and GID. Which commands should be used in sequence?

Accepted Answer

groupadd --gid && useradd -g . To preserve the primary group name and GID during migration, you must first create the group with the desired GID using `groupadd --gid `, then create the user with that group using `useradd -g `. Option A fails because the group does not exist; Option B fails for the same reason if the group is new; Option D is not a valid shell command sequence because 'then' is not a command.

Answer

useradd -u -g

Answer

useradd -g <group> <user>

Answer

groupadd -g then useradd -g

Question 3

A helpdesk ticket states that user 'bob' cannot write to his own home directory. The directory /home/bob has permissions drwxr-xr-x and is owned by root:root. What command will fix this?

Accepted Answer

chown bob:bob /home/bob. The home directory /home/bob is owned by root:root with permissions drwxr-xr-x, meaning only root can write to it. User 'bob' cannot write because he is not the owner. Option D (chown bob:bob /home/bob) changes the owner and group to bob, granting him write access via the owner 'w' permission.

Answer

setfacl -m u:bob:rwx /home/bob

Answer

usermod -d /home/bob bob

Answer

chmod 755 /home/bob

Question 4

An administrator needs to create a user account that will be used by an application service. The account should not have a valid shell or home directory. Which command correctly creates such an account?

Accepted Answer

useradd -r -s /sbin/nologin -M appuser. It uses the `-r` flag to create a system account (no aging information), `-s /sbin/nologin` to set the shell to a program that politely refuses login, and `-M` to explicitly skip creating a home directory. This combination ensures the account has no valid shell and no home directory, meeting the requirement for an application service account.

Answer

useradd -r -M -s /bin/false appuser

Answer

useradd -r -s /sbin/nologin appuser

Answer

useradd -s /bin/false -M appuser

Question 5

During an audit, it is discovered that a critical file /etc/shadow has permissions 644 and is owned by root:shadow. The administrator needs to secure it. What is the correct action?

Accepted Answer

chmod 640 /etc/shadow. The /etc/shadow file stores password hashes and must be readable only by root and the shadow group. The correct action is to set permissions to 640 using `chmod 640 /etc/shadow`, which removes world read access while preserving group read access. Setting 600 would break programs that operate with the shadow group, such as `unix_chkpwd`, which require group read access.

Answer

chown root:root /etc/shadow && chmod 600

Answer

chmod 600 /etc/shadow

Answer

chmod 000 /etc/shadow

Question 6

An administrator wants to modify the default expiration settings for new user passwords. Which file should be modified?

Accepted Answer

/etc/login.defs. The /etc/login.defs file contains default settings for user account creation, including password aging parameters such as PASS_MAX_DAYS, PASS_MIN_DAYS, and PASS_WARN_AGE. Modifying this file changes the default expiration settings for new user passwords system-wide, as these values are applied when a user is created via useradd or similar tools.

Answer

/etc/shadow

Answer

/etc/pam.d/passwd

Answer

/etc/security/pwquality.conf

Question 7

A user 'carol' is in group 'staff'. The directory /shared has permissions drwxrwx--- and group staff. Carol can create files but cannot delete other users' files. What is missing?

Accepted Answer

Set the sticky bit with 'chmod +t /shared'. The directory /shared has permissions drwxrwx--- (770), so the group 'staff' has read, write, and execute permissions. Carol, as a member of 'staff', can create files. However, without the sticky bit, any user with write permission can delete any file in the directory, regardless of ownership. Setting the sticky bit (chmod +t /shared) restricts deletion so that only the file owner (or root) can delete their own files, which is why D is correct.

Answer

Change carol's umask

Answer

Set the setgid bit with 'chmod g+s /shared'

Answer

Change directory permissions to 770

Question 8

An administrator accidentally deleted the group 'sales' which is the primary group of several users. What is the immediate effect on those users?

Accepted Answer

Their files will show a missing GID in directory listings. When a group is deleted, the system does not retroactively change the GID stored in the /etc/passwd file for users whose primary group was that group. The GID field in /etc/passwd still contains the numeric GID of the deleted group, but since the group no longer exists in /etc/group, the system cannot resolve that GID to a group name. As a result, commands like ls -l will display the numeric GID instead of the group name for files owned by those users, because the GID-to-name mapping fails.

Answer

The system will recreate the group automatically

Answer

Their primary group will be changed to their UID

Answer

They will be unable to log in

Question 9

Which TWO of the following are valid methods to set a user's password expiration date?

Accepted Answer

chage -E 2025-12-31 username. Options C and D are correct. chage -E sets the account expiration date, and usermod -e also sets the account expiration date. passwd -e forces password change at next login, does not set expiration. chage -M sets maximum password age, not expiration date. useradd -e only works at user creation, not for existing users.

Answer

chage -M 90 username

Answer

useradd -e 2025-12-31 username

Answer

passwd -e username

Question 10

Which TWO commands can be used to add a user to an existing supplementary group without removing them from other groups?

Accepted Answer

usermod -a -G group user. The `usermod -a -G group user` command appends the user to the specified supplementary group without affecting their membership in other groups. The `-a` (append) flag must be used with `-G` to add the user to additional groups; without `-a`, the `-G` option replaces all supplementary group memberships with the listed groups.

Answer

groupmod -a user group

Answer

usermod -g group user

Answer

usermod -G group user

Question 11

Which THREE conditions must be met for a user to effectively use the 'sudo' command to execute commands with root privileges?

Accepted Answer

User must be in the wheel group. By default on Red Hat Enterprise Linux, the 'wheel' group is granted full sudo access via the sudoers directive '%wheel ALL=(ALL) ALL'. This means any user who is a member of the 'wheel' group can execute any command as root, provided they authenticate with their own password. The group membership is a standard and secure way to delegate sudo privileges without editing the sudoers file for each individual user.

Answer

The target command must be executable by root

Answer

User must have a password set

Question 12

A user jdoe, who is a member of the group staff, reports they cannot access the directory /shared. The administrator runs getfacl /shared and receives the output shown. Which of the following explains the issue?

Accepted Answer

An ACL entry denies all permissions for jdoe. The getfacl output shows a user ACL entry for jdoe with permissions '---' (no read, write, or execute), which explicitly denies all access. This user-specific ACL entry overrides any group or other permissions, so jdoe cannot access /shared regardless of group staff membership.

Answer

The group staff does not have execute permission

Answer

The mask entry restricts group permissions

Answer

The directory is read-only for the owner

Question 13

Alice tries to run 'sudo less /var/log/messages' and gets 'Sorry, user alice is not allowed to execute /usr/bin/less /var/log/messages as root on this host.' Why?

Accepted Answer

The sudoers allows only specific commands with specific arguments. Sudoers rules can restrict commands to specific arguments. The error message indicates that the sudoers configuration explicitly allows 'less' only with certain arguments (or none), and the attempt to run 'less /var/log/messages' violates that restriction. Sudo matches both the command path and the argument list against the sudoers entries, and if the arguments do not match, access is denied.

Answer

The command path must exactly match, including arguments

Answer

The secure_path does not include /usr/bin

Answer

The /var/log/messages file does not exist

Question 14

Your organization has a shared directory /data/projects with permissions 2770 owned by root:projectmanagers. The directory is used by a team of developers who are all members of the 'developers' group. However, you need to ensure that any file created inside /data/projects automatically belongs to the 'developers' group, not the user's primary group. Additionally, you need to ensure that developers can delete only their own files, not those of others. Your IT security policy also requires that all user passwords must expire every 90 days and that new users should have a warning period of 7 days before expiration. Given the following options, which one describes the correct set of actions to achieve all these requirements?

Accepted Answer

Set setgid bit on /data/projects (chmod g+s), set sticky bit using chmod +t, use chage -M 90 -W 7 for each user, and ensure useradd defaults in /etc/login.defs have PASS_MAX_DAYS 90 and PASS_WARN_AGE 7.. To make new files inherit the 'developers' group, the directory itself must have the 'developers' group as its owning group (or use a default ACL). Since /data/projects is owned by root:projectmanagers, simply setting the setgid bit causes files to inherit 'projectmanagers'. Additionally, to allow developers to access the directory, the group must be 'developers' or developers must be members of 'projectmanagers'. The sticky bit correctly prevents users from deleting others' files, and password aging via chage -M 90 -W 7 plus /etc/login.defs defaults is correct. The correct full solution would include: chgrp developers /data/projects, chmod 3770 /data/projects (setgid and sticky), and the password aging steps.

Answer

Modify the umask of all users to 002, use chage -M 90 for all users, and set the setgid bit.

Answer

Use ACLs to set default group permissions, enable password aging by editing /etc/shadow directly, and set the sticky bit on the directory.

Answer

Set the setgid bit, create a cron job to change group ownership, and enforce password policy through pam_tally2.

Question 15

A system administrator needs to ensure that the user 'jdoe' can read files in the shared directory /project/data which is owned by group 'project'. The user 'jdoe' is currently not a member of the 'project' group. Which TWO steps should the administrator take to add 'jdoe' to the 'project' group? (Choose two.)

Accepted Answer

gpasswd -a jdoe project. `gpasswd -a jdoe project` adds the user 'jdoe' to the 'project' group by appending the user to the group's member list in /etc/group. This command is specifically designed for group membership management and does not require the user to be logged out; the change takes effect on the next login.

Answer

groupmod -A jdoe project

Answer

vigr to add jdoe to project group

Answer

useradd -G project jdoe