EX200 Manage users and groups — Timed 10 Questions

Question 1

A system administrator needs to ensure that a user named 'bob' can access a shared directory '/data' owned by group 'developers'. The directory has permissions 2775 and is owned by root:developers. Bob is a member of the 'developers' group. However, when Bob tries to create a file in '/data', it fails with 'Permission denied'. What is the most likely cause?

Accepted Answer

The directory has incorrect SELinux context. The directory '/data' has permissions 2775, which grants read, write, and execute to the group 'developers'. Bob is a member of 'developers', so standard Unix permissions should allow him to create files. However, the failure with 'Permission denied' despite correct group membership and permissions strongly indicates that SELinux is enforcing a policy that denies Bob write access. The most likely cause is that the directory lacks the correct SELinux context (e.g., `default_t` instead of a type like `public_content_rw_t` or a context that allows write operations).

Answer

Bob's umask is set to 0077

Answer

The setgid bit is not set

Answer

Bob's primary group is not developers

Question 2

A company policy requires that when a user is deleted, all files owned by that user in /home should be reassigned to a 'guest' account. Which command accomplishes this?

Accepted Answer

find /home -user olduser -exec chown guest {} +. Option B uses `find` to locate all files owned by `olduser` under `/home` and then executes `chown guest` on them, which reassigns ownership to the `guest` account. This directly satisfies the policy requirement without affecting the user account itself or copying files.

Answer

usermod -l guest olduser

Answer

userdel -r olduser

Answer

rsync -a /home/olduser/ /home/guest/

Question 3

An administrator wants to add the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from other groups. Which command should be used?

Accepted Answer

usermod -aG wheel,docker jane. Option B is correct because the `usermod -aG` command appends the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from any existing supplementary groups. The `-a` (append) flag must be used with `-G` to avoid overwriting the current group membership list, which is the default behavior of `-G` alone.

Answer

groupmems -a jane -g wheel,docker

Answer

usermod -a -G wheel,docker jane

Answer

usermod -G wheel,docker jane

Question 4

A server has a requirement that all users in the 'finance' group must have a password aging policy that forces password change every 90 days. Which approach best achieves this for existing users?

Accepted Answer

Write a script to run 'chage -M 90' for each user in the finance group. Option D is correct because `chage -M 90` sets the maximum password age for a specific user, and by scripting it to apply to all members of the 'finance' group, you directly enforce the 90-day policy on existing users. This approach works regardless of the default settings in `/etc/login.defs`, which only affect new users, and avoids the manual and error-prone editing of `/etc/shadow`.

Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs

Answer

Edit /etc/shadow and change the fifth field for all users

Answer

Configure pam_pwquality.so to enforce password age

Question 5

Which TWO commands can change the primary group of an existing user?

Accepted Answer

usermod -aG. The `usermod -g` command (not `-aG`, which adds supplementary groups) changes the primary group of an existing user. The `gpasswd -a` command adds a user to a group, but it does not change the primary group; it only affects supplementary group membership. Therefore, neither option A nor B is correct for changing the primary group. The correct commands are `usermod -g` (to set the primary group) and `usermod -G` (to set supplementary groups, but not the primary).

Answer

vigr

Answer

groupmems -a

Answer

useradd -G

Question 6

Given the exhibit, which statement is true about the file /project/report.txt?

Accepted Answer

Alice can write to report.txt. The exhibit shows that the file /project/report.txt has permissions -rw-rw-r--, owner alice, and group project. Alice is the owner, so she has the owner permissions (rw-), which include write access. Therefore, option B is correct because Alice can write to the file.

Answer

Any user can read report.txt

Answer

The file's group is wheel

Answer

Alice cannot write to report.txt because she is not the owner

Question 7

You are managing a Red Hat Enterprise Linux 8 server that hosts a shared development environment. The server has a directory /projects owned by root:developers with permissions 2770. There are three users: dev1, dev2, and dev3, all members of the 'developers' group. Developers need to create and edit files in /projects, and any new file should be writable by all members of the developers group. However, you notice that when dev1 creates a file, the permissions are 644 instead of 664, and the group is set to dev1's primary group (dev1) instead of 'developers'. After investigating, you find that the setgid bit is set on /projects, but the directory's ACLs are not configured. What is the most efficient way to ensure that new files in /projects inherit the group 'developers' and have group-writable permissions by default?

Accepted Answer

Set a default ACL with setfacl -d -m g:developers:rwx /projects. Option A is correct because setting a default ACL on the /projects directory with `setfacl -d -m g:developers:rwx /projects` ensures that any new file or subdirectory created inside /projects automatically inherits the 'developers' group with rwx permissions. This overrides the creating user's umask and primary group, guaranteeing group-writable files (664) and the correct group ownership, which the setgid bit alone cannot achieve for group permissions when the user's umask is restrictive.

Answer

Reapply the setgid bit using chmod g+s /projects

Answer

Change dev1's umask to 0002 in /etc/bashrc

Answer

Set the sticky bit on /projects with chmod o+t /projects

Question 8

A system administrator needs to ensure that the user 'jdoe' cannot log in via SSH but can still use other services like FTP. Which approach should the administrator take?

Accepted Answer

Change the user's shell to /sbin/nologin. Option D is correct because changing the user's shell to /sbin/nologin prevents interactive login via SSH (which requires a valid shell listed in /etc/shells) while still allowing non-interactive services like FTP, which typically do not check the user's shell. This approach specifically blocks SSH access without locking the account or affecting other authentication methods.

Answer

Lock the user account with 'usermod -L jdoe'

Answer

Delete the user's password with 'passwd -d jdoe'

Answer

Remove the user's home directory

Question 9

Which TWO commands can be used to add the user 'alice' to the supplementary group 'developers'?

Accepted Answer

gpasswd -a alice developers. Option A is correct because `gpasswd -a alice developers` adds the user 'alice' to the supplementary group 'developers' by appending her to the group's member list in /etc/group. Option C is correct because `usermod -aG developers alice` appends 'alice' to the supplementary group 'developers' without removing her from other supplementary groups, which is the intended behavior for adding a user to an additional group.

Answer

useradd -g developers alice

Answer

groupmod -a alice developers

Answer

usermod -g developers alice

Question 10

Refer to the exhibit. A web server runs as user 'apache'. The directory /var/www/html is owned by root:root with permissions 755. The administrator wants to allow the user 'webuser' to upload files to /var/www/html via SFTP. Which step is necessary to achieve this?

Accepted Answer

Change group ownership of /var/www/html to a group that includes webuser and add group write permission. Option B is correct because the directory /var/www/html is owned by root:root with permissions 755, meaning only root can write. To allow webuser to upload files via SFTP, the directory needs group write permission. Changing the group ownership to a group that includes webuser and adding group write permission (e.g., chgrp webgroup /var/www/html && chmod g+w /var/www/html) grants the necessary write access without altering ownership or security contexts.

Answer

Change webuser's shell to /bin/bash to allow SFTP login

Answer

Change the SELinux context of /var/www/html to httpd_sys_rw_content_t

Answer

Set an ACL on /var/www/html to grant webuser write access