EX200 Manage users and groups — Timed 10 Questions

Question 1

A company policy requires that when a user is deleted, all files owned by that user in /home should be reassigned to a 'guest' account. Which command accomplishes this?

Accepted Answer

find /home -user olduser -exec chown guest {} +. Uses `find` to locate all files owned by `olduser` under `/home` and then executes `chown guest` on them, which reassigns ownership to the `guest` account. This directly satisfies the policy requirement without affecting the user account itself or copying files.

Answer

usermod -l guest olduser

Answer

userdel -r olduser

Answer

rsync -a /home/olduser/ /home/guest/

Question 2

Given the exhibit, which statement is true about the file /project/report.txt?

Accepted Answer

Any user can read report.txt. The permissions -rw-rw-r-- mean owner has rw-, group has rw-, and others have r--. Therefore, any user (including others) can read the file (A true), and Alice as owner can write (B true). Thus both A and B are correct, making the single-answer question invalid.

Answer

The file's group is wheel

Answer

Alice cannot write to report.txt because she is not the owner

Question 3

You are managing a Red Hat Enterprise Linux 8 server that hosts a shared development environment. The server has a directory /projects owned by root:developers with permissions 2770. There are three users: dev1, dev2, and dev3, all members of the 'developers' group. Developers need to create and edit files in /projects, and any new file should be writable by all members of the developers group. However, you notice that when dev1 creates a file, the permissions are 644 instead of 664, and the group is set to dev1's primary group (dev1) instead of 'developers'. After investigating, you find that the setgid bit is set on /projects, but the directory's ACLs are not configured. What is the most efficient way to ensure that new files in /projects inherit the group 'developers' and have group-writable permissions by default?

Accepted Answer

Set a default ACL with setfacl -d -m g:developers:rwx /projects. The setgid bit on /projects would already force new files to have the group 'developers'. The actual issue described (files created with 644 permissions) is solely due to the creating user's umask, not group ownership. A default ACL can be used to enforce group-write permissions, but it cannot change the owning group to 'developers' if the setgid bit is not effective. The explanation incorrectly states that the default ACL overrides the primary group; that is not how POSIX ACLs work.

Answer

Reapply the setgid bit using chmod g+s /projects

Answer

Change dev1's umask to 0002 in /etc/bashrc

Answer

Set the sticky bit on /projects with chmod o+t /projects

Question 4

A system administrator needs to ensure that the user 'jdoe' cannot log in via SSH but can still use other services like FTP. Which approach should the administrator take?

Accepted Answer

Change the user's shell to /sbin/nologin. Changing the user's shell to /sbin/nologin prevents interactive login via SSH (which requires a valid shell listed in /etc/shells) while still allowing non-interactive services like FTP, which typically do not check the user's shell. This approach specifically blocks SSH access without locking the account or affecting other authentication methods.

Answer

Lock the user account with 'usermod -L jdoe'

Answer

Delete the user's password with 'passwd -d jdoe'

Answer

Remove the user's home directory

Question 5

Which TWO commands can be used to add the user 'alice' to the supplementary group 'developers'?

Accepted Answer

gpasswd -a alice developers. `gpasswd -a alice developers` adds the user 'alice' to the supplementary group 'developers' by appending her to the group's member list in /etc/group. Option C is correct because `usermod -aG developers alice` appends 'alice' to the supplementary group 'developers' without removing her from other supplementary groups, which is the intended behavior for adding a user to an additional group.

Answer

useradd -g developers alice

Answer

groupmod -a alice developers

Answer

usermod -g developers alice

Question 6

Refer to the exhibit. A web server runs as user 'apache'. The directory /var/www/html is owned by root:root with permissions 755. The administrator wants to allow the user 'webuser' to upload files to /var/www/html via SFTP. Which step is necessary to achieve this?

Accepted Answer

Change group ownership of /var/www/html to a group that includes webuser and add group write permission. Both options B and D are valid methods to grant write access to webuser without changing the ownership. Option B (changing group ownership and adding group write permission) works if a group including webuser is created and assigned. Option D (setting an ACL with setfacl -m u:webuser:w /var/www/html) provides the same result more flexibly, without modifying group permissions. Options A and C are incorrect because they do not directly address the permission issue.

Answer

Change webuser's shell to /bin/bash to allow SFTP login

Answer

Change the SELinux context of /var/www/html to httpd_sys_rw_content_t

Question 7

Arrange the steps to configure a network bond (mode 1) using two interfaces (eth0, eth1) in RHEL.

Accepted Answer

Create bond interface config, then configure slave interfaces, then restart network. Network bonding requires creating a bond interface and configuring slaves, then restarting network.

Answer

Configure slave interfaces, then create bond interface config, then restart network

Answer

Restart network, then create bond interface config, then configure slave interfaces

Answer

Create bond interface config, then restart network, then configure slave interfaces

Question 8

Match each firewall zone to its default trust level.

Accepted Answer

drop: No traffic is sent, and incoming packets are dropped without reply.. Correct matches: drop blocks all traffic silently, public allows only basic services, internal allows more services, trusted allows all. Common confusions include mixing drop with trusted or public with internal.

Answer

drop: All network connections are accepted.

Answer

public: Medium to high trust.

Question 9

After being added to a new supplementary group with usermod -aG, a user logs out and back in but still cannot access files owned by that group. Which command should the user run to verify current effective group membership?

Accepted Answer

id. The `id` command displays the real and effective user/group IDs and all supplementary groups for the current process, making it the correct way to confirm whether the new group is actually active in the current shell. `groups $(whoami)` is incorrect because it uses the username argument, which reads the group membership from the user database (e.g., getgrouplist) and does not necessarily reflect the groups in the current process. This can misleadingly show the new group even if the current shell has not inherited it. `newgrp -c 'groups'` is not standard and is meant for changing the real group ID, not for displaying groups. `usermod -g` modifies group settings and requires superuser privileges, so it does not verify membership.

Answer

newgrp -c 'groups'

Answer

groups $(whoami)

Answer

usermod -g

Question 10

A user reports that they can log in but cannot change their password. Which file might be misconfigured?

Accepted Answer

/etc/shadow with an expiration date in the past. The /etc/shadow field sp_expire (account expiration) being in the past causes the system to deny login. A user who can log in but cannot change their password would more likely have an expired password (sp_max exceeded), which forces a password change at login; however, none of the options correctly describe that condition. PASS_MAX_DAYS=0 in /etc/login.defs does not affect existing users, an incorrect shell prevents login, and a missing group entry does not affect password changes.

Answer

/etc/group with no user entry

Answer

/etc/login.defs with PASS_MAX_DAYS set to 0

Answer

/etc/passwd with incorrect shell