EX200 Manage users and groups Practice Test 3 — 15 Questions

Question 1

You are a junior administrator at a company that uses Red Hat Enterprise Linux 8. The HR department has a shared directory /hr/data that should be accessible to all members of the 'hr' group. The directory is currently owned by root:root with permissions 755. You need to configure the system so that new files created in /hr/data are automatically owned by the group 'hr' and the group has read-write permissions. Additionally, you need to ensure that user 'jane' (who is a member of 'hr') can create files in the directory. However, after adding 'jane' to the 'hr' group, she still cannot create files, receiving 'Permission denied'. Which of the following is the best course of action to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the directory permissions to 2775 and set the SGID bit using chmod 2775 /hr/data. The directory needs to have the SGID bit set (chmod g+s) so that new files inherit the group ownership, and group write permission must be granted (chmod g+w). Setting permissions to 2775 sets both the SGID bit and group write permissions. Option B is incorrect because changing ownership to jane:hr would give Jane full ownership but would not enforce group inheritance for new files and would break other group members' access since the directory would be owned by her, not the group. Option C is incorrect because using sudo to grant access is a temporary workaround that does not solve the underlying permission issue; it bypasses proper group permission configuration, does not enforce group inheritance, and is not a scalable or proper solution for shared directories. Option D is incorrect; the sticky bit (chmod +t) is used to prevent users from deleting others' files, not to manage group permissions or inheritance.

Answer

Change the directory ownership to jane:hr

Answer

Use sudo to grant 'jane' full access to the directory

Answer

Set the sticky bit on the directory using chmod +t /hr/data

Question 2

Which TWO commands can be used to create a new user account in Red Hat Enterprise Linux 8?

Accepted Answer

adduser. Both `adduser` and `useradd` are commands that create a new user account in Red Hat Enterprise Linux 8. `adduser` is a symbolic link to `useradd` in RHEL 8, so they perform the same function. The `useradd` command creates a new user with default settings from `/etc/default/useradd` and `/etc/login.defs`, while `adduser` behaves identically.

Answer

groupadd

Answer

usermod

Answer

passwd

Question 3

A system administrator needs to ensure that a user named 'bob' can access a shared directory '/data' owned by group 'developers'. The directory has permissions 2775 and is owned by root:developers. Bob is a member of the 'developers' group. However, when Bob tries to create a file in '/data', it fails with 'Permission denied'. What is the most likely cause?

Accepted Answer

The directory has incorrect SELinux context. The directory '/data' has permissions 2775, which grants read, write, and execute to the group 'developers'. Bob is a member of 'developers', so standard Unix permissions should allow him to create files. However, the failure with 'Permission denied' despite correct group membership and permissions strongly indicates that SELinux is enforcing a policy that denies Bob write access. The most likely cause is that the directory lacks the correct SELinux context (e.g., `default_t` instead of a type like `public_content_rw_t` or a context that allows write operations).

Answer

Bob's umask is set to 0077

Answer

The setgid bit is not set

Answer

Bob's primary group is not developers

Question 4

An administrator wants to add the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from other groups. Which command should be used?

Accepted Answer

usermod -aG wheel,docker jane. Both `usermod -aG wheel,docker jane` and `usermod -a -G wheel,docker jane` are valid commands to append the user to the specified supplementary groups without removing her from other groups. The `-a` (append) flag can be combined with `-G` as `-aG` or provided separately (`-a -G`); both forms work identically. Option D (`usermod -G`) without `-a` would overwrite all supplementary groups, which is incorrect. Option A uses `groupmems`, which is not the standard command for this task and has incorrect syntax.

Answer

groupmems -a jane -g wheel,docker

Answer

usermod -G wheel,docker jane

Question 5

A server has a requirement that all users in the 'finance' group must have a password aging policy that forces password change every 90 days. Which approach best achieves this for existing users?

Accepted Answer

Write a script to run 'chage -M 90' for each user in the finance group. `chage -M 90` sets the maximum password age for a specific user, and by scripting it to apply to all members of the 'finance' group, you directly enforce the 90-day policy on existing users. This approach works regardless of the default settings in `/etc/login.defs`, which only affect new users, and avoids the manual and error-prone editing of `/etc/shadow`.

Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs

Answer

Edit /etc/shadow and change the fifth field for all users

Answer

Configure pam_pwquality.so to enforce password age

Question 6

Which TWO commands can change the primary group of an existing user?

Accepted Answer

usermod -aG. None of the listed commands change the primary group of an existing user. The correct commands are `usermod -g` to change the primary group directly, or `groupmod -g` after ensuring the user is the only member of the group.

Answer

vigr

Answer

groupmems -a

Answer

useradd -G

Question 7

A company needs to create a user account for a temporary contractor who will work for exactly 90 days. The account must be automatically disabled after 90 days. Which command should the administrator use?

Accepted Answer

useradd -e $(date -d '+90 days' +%Y-%m-%d) contractor. The `-e` (expiration date) option sets the date on which the user account will be disabled. Using `$(date -d '+90 days' +%Y-%m-%d)` dynamically calculates the exact date 90 days from today in YYYY-MM-DD format, which meets the requirement for automatic disable after exactly 90 days.

Answer

useradd -f 90 contractor

Answer

useradd -e 90 contractor

Answer

useradd -f 90 -e 0 contractor

Question 8

A user named jdoe is receiving 'Permission denied' errors when trying to access a file owned by root with permissions 644. The user is a member of the root group. What is the most likely cause?

Accepted Answer

The directory containing the file lacks execute permission for the group or others.. The file has permissions 644, meaning the owner (root) has read/write, and the group (root) and others have read-only access. Since jdoe is a member of the root group, the file's group read permission should allow access. However, to traverse a directory and access any file within it, the user needs execute (x) permission on that directory. If the directory lacks execute for the group or others, jdoe will get 'Permission denied' even if the file permissions are correct.

Answer

The file's group owner is not root.

Answer

The file's read permission is not granted to the root group.

Answer

The user needs to be added to the root group again.

Question 9

A new employee named asmith needs a user account with a home directory and a specific UID of 1500. Which command accomplishes this?

Accepted Answer

useradd -m -u 1500 asmith. `useradd -m -u 1500 asmith` creates the user asmith with a home directory (via `-m`) and assigns a specific UID of 1500 (via `-u`). The `-m` flag ensures the home directory is created if it does not exist, which is required by the question.

Answer

adduser -uid 1500 asmith

Answer

useradd -h /home/asmith -u 1500 asmith

Answer

useradd -d /home/asmith -U 1500 asmith

Question 10

A system administrator needs to change the primary group of an existing user to a group that already exists. Which command should be used?

Accepted Answer

usermod -g existinggroup username. The `usermod -g` command changes the primary group of an existing user to a specified group that already exists on the system. The `-g` option sets the initial login group (GID) for the user, which must be a valid group name or GID from `/etc/group`.

Answer

groupmod -g existinggroup username

Answer

usermod -p existinggroup username

Answer

usermod -G existinggroup username

Question 11

A server has been compromised, and the administrator suspects an unauthorized user account may have been created. Which file should be examined to list all local user accounts?

Accepted Answer

/etc/passwd. The /etc/passwd file is the primary local user account database on Linux systems, listing all user accounts with fields such as username, UID, GID, GECOS, home directory, and login shell. Examining this file reveals every local user account, including any unauthorized ones that may have been created, because each account must have an entry here to be recognized by the system.

Answer

/etc/shadow

Answer

/etc/shells

Answer

/etc/login.defs

Question 12

An administrator wants to ensure that any new user accounts created on the system have a default primary group matching the username. What change is needed?

Accepted Answer

Set USERGROUPS_ENAB to yes in /etc/login.defs. Setting USERGROUPS_ENAB to yes in /etc/login.defs instructs the useradd command to automatically create a private group with the same name as the new user and assign it as the user's primary group. This is the default behavior in Red Hat Enterprise Linux and ensures that each new user has a matching primary group without manual intervention.

Answer

Set GROUP to same name in /etc/default/useradd

Answer

Set USERGROUPS_ENAB to no; then create user with -g

Answer

Set CREATE_HOME to yes in /etc/login.defs

Question 13

Which TWO commands can be used to add a user to a secondary group without removing existing supplementary group memberships? (Choose exactly 2)

Accepted Answer

usermod -aG group user. `usermod -aG` appends the user to the specified supplementary group(s) without affecting any existing supplementary group memberships. The `-a` flag (append) must be used with `-G` to avoid overwriting the current list of supplementary groups. This is the standard method in Red Hat Enterprise Linux for adding a user to an additional group while preserving all other group memberships.

Answer

usermod -AG group user

Answer

adduser user group

Answer

groupadd -a user group

Question 14

Refer to the exhibit. A user named 'carol' has been added to the system with the command useradd -G wheel carol. Which line in /etc/group will confirm that carol is now a member of the wheel group?

Accepted Answer

wheel:x:10:root,alice,bob,carol. The `useradd -G wheel carol` command adds 'carol' to the supplementary group 'wheel', and the `/etc/group` file lists supplementary members as a comma-separated list with no trailing comma. The line `wheel:x:10:root,alice,bob,carol` shows 'carol' appended after the existing members, which matches the expected format.

Answer

wheel:x:10:carol,root,alice,bob

Answer

wheel:x:10:root,alice,bob,carol,

Answer

wheel:x:10:root,alice,bob carol

Question 15

Refer to the exhibit. What effect does the value INACTIVE=-1 have on newly created user accounts?

Accepted Answer

The password inactivity period is disabled.. The `INACTIVE=-1` setting in the `useradd -D` or `/etc/default/useradd` configuration disables the password inactivity period. This means that after a password expires, the account will not be locked due to inactivity, effectively turning off the inactivity timer. The value -1 is a special sentinel that indicates no inactivity period is enforced.

Answer

The account expires immediately.

Answer

Passwords never expire.

Answer

Account is disabled if password expires but user does not log in within -1 days (immediately).