EX200 Manage users and groups Practice Test 3 — 15 Questions

Question 1

Which TWO commands can list all groups a user belongs to? (Choose exactly 2)

Accepted Answer

id -nG. Option A, `id -nG`, is correct because it prints the names of all groups the specified user is a member of, including both the primary group and supplementary groups, using the `-n` flag to show names instead of numeric GIDs and `-G` to list all group memberships. Option E, `groups`, is correct because it displays the groups a user belongs to, defaulting to the current user or accepting a username argument, and it reads from the same system group database to show all memberships. Option B, `cat /etc/group | grep user`, is not reliable because it only matches the literal string 'user' in the group file and may miss memberships or match unintended entries, and it does not handle network-based group sources. Option C, `usermod -g user`, is incorrect because it modifies a user's primary group rather than listing group memberships. Option D, `getent group user`, is incorrect because it queries the group database for a group named 'user' and lists that group's members, not all groups a user belongs to.

Answer

cat /etc/group | grep user

Answer

usermod -g user

Answer

getent group user

Question 2

Refer to the exhibit. A user named 'carol' has been added to the system with the command useradd -G wheel carol. Which line in /etc/group will confirm that carol is now a member of the wheel group?

Accepted Answer

wheel:x:10:root,alice,bob,carol. The `useradd -G wheel carol` command adds 'carol' to the supplementary group 'wheel', and the `/etc/group` file lists supplementary members as a comma-separated list with no trailing comma. The line `wheel:x:10:root,alice,bob,carol` shows 'carol' appended after the existing members, which matches the expected format.

Answer

wheel:x:10:carol,root,alice,bob

Answer

wheel:x:10:root,alice,bob,carol,

Answer

wheel:x:10:root,alice,bob carol

Question 3

Refer to the exhibit. What effect does the value INACTIVE=-1 have on newly created user accounts?

Accepted Answer

The password inactivity period is disabled.. The `INACTIVE=-1` setting in the `useradd -D` or `/etc/default/useradd` configuration disables the password inactivity period. This means that after a password expires, the account will not be locked due to inactivity, effectively turning off the inactivity timer. The value -1 is a special sentinel that indicates no inactivity period is enforced.

Answer

The account expires immediately.

Answer

Passwords never expire.

Answer

Account is disabled if password expires but user does not log in within -1 days (immediately).

Question 4

A system administrator needs to ensure that a user named 'jdoe' can execute commands as root without being prompted for a password. Which configuration change should be made?

Accepted Answer

Add 'jdoe ALL=(ALL) NOPASSWD: ALL' to /etc/sudoers via visudo. The sudoers directive 'jdoe ALL=(ALL) NOPASSWD: ALL' grants user jdoe the ability to run any command as any user (including root) on any host without a password prompt. This configuration must be added using visudo to ensure syntax validation and prevent lockout. The NOPASSWD tag overrides the default password requirement for sudo.

Answer

Add jdoe to the wheel group and configure /etc/sudoers with '%wheel ALL=(ALL) ALL'

Answer

Set the UID of jdoe to 0

Answer

Add jdoe to the root group

Question 5

A user reports they cannot log in to a Linux system. Their account was recently created. The administrator checks /etc/passwd and sees the entry: jsmith:x:1001:1001::/home/jsmith:/sbin/nologin. What is the likely issue?

Accepted Answer

The user's shell is set to /sbin/nologin which prevents login. The user's shell is set to /sbin/nologin, which is a shell that displays a message and exits immediately, preventing interactive login. This is the direct cause of the login failure, as the system uses the shell field in /etc/passwd to determine the login program.

Answer

The user is locked due to expired password

Answer

The home directory does not exist

Answer

The user is not in any supplementary groups

Question 6

An administrator is migrating user accounts to a new system. They want to preserve the user's primary group name and GID. Which commands should be used in sequence?

Accepted Answer

groupadd --gid && useradd -g . To preserve the primary group name and GID during migration, you must first create the group with the desired GID using `groupadd --gid `, then create the user with that group using `useradd -g `. Option A fails because the group does not exist; Option B fails for the same reason if the group is new; Option D is not a valid shell command sequence because 'then' is not a command.

Answer

useradd -u -g

Answer

useradd -g <group> <user>

Answer

groupadd -g then useradd -g

Question 7

A helpdesk ticket states that user 'bob' cannot write to his own home directory. The directory /home/bob has permissions drwxr-xr-x and is owned by root:root. What command will fix this?

Accepted Answer

chown bob:bob /home/bob. The home directory /home/bob is owned by root:root with permissions drwxr-xr-x, meaning only root can write to it. User 'bob' cannot write because he is not the owner. Option D (chown bob:bob /home/bob) changes the owner and group to bob, granting him write access via the owner 'w' permission.

Answer

setfacl -m u:bob:rwx /home/bob

Answer

usermod -d /home/bob bob

Answer

chmod 755 /home/bob

Question 8

An administrator needs to create a user account that will be used by an application service. The account should not have a valid shell or home directory. Which command correctly creates such an account?

Accepted Answer

useradd -r -s /sbin/nologin -M appuser. It uses the `-r` flag to create a system account (no aging information), `-s /sbin/nologin` to set the shell to a program that politely refuses login, and `-M` to explicitly skip creating a home directory. This combination ensures the account has no valid shell and no home directory, meeting the requirement for an application service account.

Answer

useradd -r -M -s /bin/false appuser

Answer

useradd -r -s /sbin/nologin appuser

Answer

useradd -s /bin/false -M appuser

Question 9

An administrator wants to modify the default expiration settings for new user passwords. Which file should be modified?

Accepted Answer

/etc/login.defs. The /etc/login.defs file contains default settings for user account creation, including password aging parameters such as PASS_MAX_DAYS, PASS_MIN_DAYS, and PASS_WARN_AGE. Modifying this file changes the default expiration settings for new user passwords system-wide, as these values are applied when a user is created via useradd or similar tools.

Answer

/etc/shadow

Answer

/etc/pam.d/passwd

Answer

/etc/security/pwquality.conf

Question 10

An administrator accidentally deleted the group 'sales' which is the primary group of several users. What is the immediate effect on those users?

Accepted Answer

Their files will show a missing GID in directory listings. When a group is deleted, the system does not retroactively change the GID stored in the /etc/passwd file for users whose primary group was that group. The GID field in /etc/passwd still contains the numeric GID of the deleted group, but since the group no longer exists in /etc/group, the system cannot resolve that GID to a group name. As a result, commands like ls -l will display the numeric GID instead of the group name for files owned by those users, because the GID-to-name mapping fails.

Answer

The system will recreate the group automatically

Answer

Their primary group will be changed to their UID

Answer

They will be unable to log in

Question 11

Which TWO commands can be used to add a user to an existing supplementary group without removing them from other groups?

Accepted Answer

usermod -a -G group user. The `usermod -a -G group user` command appends the user to the specified supplementary group without affecting their membership in other groups. The `-a` (append) flag must be used with `-G` to add the user to additional groups; without `-a`, the `-G` option replaces all supplementary group memberships with the listed groups.

Answer

groupmod -a user group

Answer

usermod -g group user

Answer

usermod -G group user

Question 12

A user jdoe, who is a member of the group staff, reports they cannot access the directory /shared. The administrator runs getfacl /shared and receives the output shown. Which of the following explains the issue?

Accepted Answer

An ACL entry denies all permissions for jdoe. The getfacl output shows a user ACL entry for jdoe with permissions '---' (no read, write, or execute), which explicitly denies all access. This user-specific ACL entry overrides any group or other permissions, so jdoe cannot access /shared regardless of group staff membership.

Answer

The group staff does not have execute permission

Answer

The mask entry restricts group permissions

Answer

The directory is read-only for the owner

Question 13

Alice tries to run 'sudo less /var/log/messages' and gets 'Sorry, user alice is not allowed to execute /usr/bin/less /var/log/messages as root on this host.' Why?

Accepted Answer

The sudoers allows only specific commands with specific arguments. Sudoers rules can restrict commands to specific arguments. The error message indicates that the sudoers configuration explicitly allows 'less' only with certain arguments (or none), and the attempt to run 'less /var/log/messages' violates that restriction. Sudo matches both the command path and the argument list against the sudoers entries, and if the arguments do not match, access is denied.

Answer

The command path must exactly match, including arguments

Answer

The secure_path does not include /usr/bin

Answer

The /var/log/messages file does not exist

Question 14

A system administrator needs to ensure that the user 'jdoe' can read files in the shared directory /project/data which is owned by group 'project'. The user 'jdoe' is currently not a member of the 'project' group. Which TWO steps should the administrator take to add 'jdoe' to the 'project' group? (Choose two.)

Accepted Answer

gpasswd -a jdoe project. `gpasswd -a jdoe project` adds the user 'jdoe' to the 'project' group by appending the user to the group's member list in /etc/group. This command is specifically designed for group membership management and does not require the user to be logged out; the change takes effect on the next login.

Answer

groupmod -A jdoe project

Answer

vigr to add jdoe to project group

Answer

useradd -G project jdoe

Question 15

A Red Hat Enterprise Linux 9 system enforces a security policy that user accounts must be disabled after 90 days of inactivity. The system administrator has configured /etc/shadow accordingly with the proper fields. User 'bob' has been on leave for 95 days. When bob returns and tries to log in, he is unable to do so. The administrator checks the shadow file and sees that bob's password expiration date has passed and the account is locked due to inactivity (the inactivity period has exceeded). The administrator wants to immediately reactivate bob's account without changing the password, and also wants to set the account to expire in 30 days from now (relative to the current date). Which set of commands should the administrator run to achieve this goal?

Accepted Answer

chage -E $(date -d +30days +%Y-%m-%d) bob; chage -I -1 bob. `chage -E $(date -d +30days +%Y-%m-%d) bob` sets the account expiration date to 30 days from now, and `chage -I -1 bob` disables the inactivity period (sets it to -1, meaning no inactivity lockout), which immediately reactivates the account without changing the password. This directly addresses the requirement to unlock the account (which was locked due to exceeding the inactivity period) and set a new expiration date.

Answer

usermod -e 2024-12-31 bob; passwd -S bob

Answer

chage -d 0 bob; usermod -L bob

Answer

usermod -e $(date -d +30days +%Y-%m-%d) bob; passwd -u bob