EX200 Manage users and groups Practice Test 2 — 15 Questions

Question 1

A server has a requirement that all users in the 'finance' group must have a password aging policy that forces password change every 90 days. Which approach best achieves this for existing users?

Accepted Answer

Write a script to run 'chage -M 90' for each user in the finance group. `chage -M 90` sets the maximum password age for a specific user, and by scripting it to apply to all members of the 'finance' group, you directly enforce the 90-day policy on existing users. This approach works regardless of the default settings in `/etc/login.defs`, which only affect new users, and avoids the manual and error-prone editing of `/etc/shadow`.

Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs

Answer

Edit /etc/shadow and change the fifth field for all users

Answer

Configure pam_pwquality.so to enforce password age

Question 2

Which TWO commands can change the primary group of an existing user?

Accepted Answer

usermod -aG. None of the listed commands change the primary group of an existing user. The correct commands are `usermod -g` to change the primary group directly, or `groupmod -g` after ensuring the user is the only member of the group.

Answer

vigr

Answer

groupmems -a

Answer

useradd -G

Question 3

A system administrator needs to ensure that the user 'jdoe' cannot log in via SSH but can still use other services like FTP. Which approach should the administrator take?

Accepted Answer

Change the user's shell to /sbin/nologin. Changing the user's shell to /sbin/nologin prevents interactive login via SSH (which requires a valid shell listed in /etc/shells) while still allowing non-interactive services like FTP, which typically do not check the user's shell. This approach specifically blocks SSH access without locking the account or affecting other authentication methods.

Answer

Lock the user account with 'usermod -L jdoe'

Answer

Delete the user's password with 'passwd -d jdoe'

Answer

Remove the user's home directory

Question 4

Arrange the steps to configure a network bond (mode 1) using two interfaces (eth0, eth1) in RHEL.

Accepted Answer

Create bond interface config, then configure slave interfaces, then restart network. Network bonding requires creating a bond interface and configuring slaves, then restarting network.

Answer

Configure slave interfaces, then create bond interface config, then restart network

Answer

Restart network, then create bond interface config, then configure slave interfaces

Answer

Create bond interface config, then restart network, then configure slave interfaces

Question 5

Match each firewall zone to its default trust level.

Accepted Answer

drop: No traffic is sent, and incoming packets are dropped without reply.. Correct matches: drop blocks all traffic silently, public allows only basic services, internal allows more services, trusted allows all. Common confusions include mixing drop with trusted or public with internal.

Answer

drop: All network connections are accepted.

Answer

public: Medium to high trust.

Question 6

A company needs to create a user account for a temporary contractor who will work for exactly 90 days. The account must be automatically disabled after 90 days. Which command should the administrator use?

Accepted Answer

useradd -e $(date -d '+90 days' +%Y-%m-%d) contractor. The `-e` (expiration date) option sets the date on which the user account will be disabled. Using `$(date -d '+90 days' +%Y-%m-%d)` dynamically calculates the exact date 90 days from today in YYYY-MM-DD format, which meets the requirement for automatic disable after exactly 90 days.

Answer

useradd -f 90 contractor

Answer

useradd -e 90 contractor

Answer

useradd -f 90 -e 0 contractor

Question 7

A user named jdoe is receiving 'Permission denied' errors when trying to access a file owned by root with permissions 644. The user is a member of the root group. What is the most likely cause?

Accepted Answer

The directory containing the file lacks execute permission for the group or others.. The file has permissions 644, meaning the owner (root) has read/write, and the group (root) and others have read-only access. Since jdoe is a member of the root group, the file's group read permission should allow access. However, to traverse a directory and access any file within it, the user needs execute (x) permission on that directory. If the directory lacks execute for the group or others, jdoe will get 'Permission denied' even if the file permissions are correct.

Answer

The file's group owner is not root.

Answer

The file's read permission is not granted to the root group.

Answer

The user needs to be added to the root group again.

Question 8

After being added to a new supplementary group with usermod -aG, a user logs out and back in but still cannot access files owned by that group. Which command should the user run to verify current effective group membership?

Accepted Answer

id. The `id` command displays the real and effective user/group IDs and all supplementary groups for the current process, making it the correct way to confirm whether the new group is actually active in the current shell. `groups $(whoami)` is incorrect because it uses the username argument, which reads the group membership from the user database (e.g., getgrouplist) and does not necessarily reflect the groups in the current process. This can misleadingly show the new group even if the current shell has not inherited it. `newgrp -c 'groups'` is not standard and is meant for changing the real group ID, not for displaying groups. `usermod -g` modifies group settings and requires superuser privileges, so it does not verify membership.

Answer

newgrp -c 'groups'

Answer

groups $(whoami)

Answer

usermod -g

Question 9

A new employee named asmith needs a user account with a home directory and a specific UID of 1500. Which command accomplishes this?

Accepted Answer

useradd -m -u 1500 asmith. `useradd -m -u 1500 asmith` creates the user asmith with a home directory (via `-m`) and assigns a specific UID of 1500 (via `-u`). The `-m` flag ensures the home directory is created if it does not exist, which is required by the question.

Answer

adduser -uid 1500 asmith

Answer

useradd -h /home/asmith -u 1500 asmith

Answer

useradd -d /home/asmith -U 1500 asmith

Question 10

A system administrator needs to change the primary group of an existing user to a group that already exists. Which command should be used?

Accepted Answer

usermod -g existinggroup username. The `usermod -g` command changes the primary group of an existing user to a specified group that already exists on the system. The `-g` option sets the initial login group (GID) for the user, which must be a valid group name or GID from `/etc/group`.

Answer

groupmod -g existinggroup username

Answer

usermod -p existinggroup username

Answer

usermod -G existinggroup username

Question 11

A server has been compromised, and the administrator suspects an unauthorized user account may have been created. Which file should be examined to list all local user accounts?

Accepted Answer

/etc/passwd. The /etc/passwd file is the primary local user account database on Linux systems, listing all user accounts with fields such as username, UID, GID, GECOS, home directory, and login shell. Examining this file reveals every local user account, including any unauthorized ones that may have been created, because each account must have an entry here to be recognized by the system.

Answer

/etc/shadow

Answer

/etc/shells

Answer

/etc/login.defs

Question 12

An administrator wants to ensure that any new user accounts created on the system have a default primary group matching the username. What change is needed?

Accepted Answer

Set USERGROUPS_ENAB to yes in /etc/login.defs. Setting USERGROUPS_ENAB to yes in /etc/login.defs instructs the useradd command to automatically create a private group with the same name as the new user and assign it as the user's primary group. This is the default behavior in Red Hat Enterprise Linux and ensures that each new user has a matching primary group without manual intervention.

Answer

Set GROUP to same name in /etc/default/useradd

Answer

Set USERGROUPS_ENAB to no; then create user with -g

Answer

Set CREATE_HOME to yes in /etc/login.defs

Question 13

An administrator used the command useradd -D -f 10 to change the default inactivity period. What effect does this have on future user accounts?

Accepted Answer

New user accounts will be disabled after 10 days of inactivity if the password has expired.. The `useradd -D -f 10` command modifies the default value for the `INACTIVE` field in `/etc/default/useradd`. This field sets the number of days after a password expires that the account will be disabled if the password is not changed. Option C correctly describes this behavior: new user accounts will be disabled after 10 days of inactivity following password expiration.

Answer

The default group for new users will be changed to GID 10.

Answer

New user accounts will have a maximum password age of 10 days.

Answer

New user accounts will have a password expiration of 10 days.

Question 14

Which TWO commands can be used to add a user to a secondary group without removing existing supplementary group memberships? (Choose exactly 2)

Accepted Answer

usermod -aG group user. `usermod -aG` appends the user to the specified supplementary group(s) without affecting any existing supplementary group memberships. The `-a` flag (append) must be used with `-G` to avoid overwriting the current list of supplementary groups. This is the standard method in Red Hat Enterprise Linux for adding a user to an additional group while preserving all other group memberships.

Answer

usermod -AG group user

Answer

adduser user group

Answer

groupadd -a user group

Question 15

Which THREE statements about /etc/shadow are true? (Choose exactly 3)

Accepted Answer

Contains account expiration dates.. The /etc/shadow file stores account expiration dates in the ninth field (field 9), which is the number of days since the epoch until the account is disabled. This field is used by the system to enforce account aging policies, such as automatically locking accounts after a set period of inactivity.

Answer

Is readable by all users.

Answer

Contains user ID numbers.