EX200 Manage users and groups — Timed 25 Questions

Question 1

A company policy requires that when a user is deleted, all files owned by that user in /home should be reassigned to a 'guest' account. Which command accomplishes this?

Accepted Answer

find /home -user olduser -exec chown guest {} +. Uses `find` to locate all files owned by `olduser` under `/home` and then executes `chown guest` on them, which reassigns ownership to the `guest` account. This directly satisfies the policy requirement without affecting the user account itself or copying files.

Answer

usermod -l guest olduser

Answer

userdel -r olduser

Answer

rsync -a /home/olduser/ /home/guest/

Question 2

Given the exhibit, which statement is true about the file /project/report.txt?

Accepted Answer

Any user can read report.txt. The permissions -rw-rw-r-- mean owner has rw-, group has rw-, and others have r--. Therefore, any user (including others) can read the file (A true), and Alice as owner can write (B true). Thus both A and B are correct, making the single-answer question invalid.

Answer

The file's group is wheel

Answer

Alice cannot write to report.txt because she is not the owner

Question 3

You are managing a Red Hat Enterprise Linux 8 server that hosts a shared development environment. The server has a directory /projects owned by root:developers with permissions 2770. There are three users: dev1, dev2, and dev3, all members of the 'developers' group. Developers need to create and edit files in /projects, and any new file should be writable by all members of the developers group. However, you notice that when dev1 creates a file, the permissions are 644 instead of 664, and the group is set to dev1's primary group (dev1) instead of 'developers'. After investigating, you find that the setgid bit is set on /projects, but the directory's ACLs are not configured. What is the most efficient way to ensure that new files in /projects inherit the group 'developers' and have group-writable permissions by default?

Accepted Answer

Set a default ACL with setfacl -d -m g:developers:rwx /projects. The setgid bit on /projects would already force new files to have the group 'developers'. The actual issue described (files created with 644 permissions) is solely due to the creating user's umask, not group ownership. A default ACL can be used to enforce group-write permissions, but it cannot change the owning group to 'developers' if the setgid bit is not effective. The explanation incorrectly states that the default ACL overrides the primary group; that is not how POSIX ACLs work.

Answer

Reapply the setgid bit using chmod g+s /projects

Answer

Change dev1's umask to 0002 in /etc/bashrc

Answer

Set the sticky bit on /projects with chmod o+t /projects

Question 4

A system administrator needs to ensure that the user 'jdoe' cannot log in via SSH but can still use other services like FTP. Which approach should the administrator take?

Accepted Answer

Change the user's shell to /sbin/nologin. Changing the user's shell to /sbin/nologin prevents interactive login via SSH (which requires a valid shell listed in /etc/shells) while still allowing non-interactive services like FTP, which typically do not check the user's shell. This approach specifically blocks SSH access without locking the account or affecting other authentication methods.

Answer

Lock the user account with 'usermod -L jdoe'

Answer

Delete the user's password with 'passwd -d jdoe'

Answer

Remove the user's home directory

Question 5

Which TWO commands can be used to add the user 'alice' to the supplementary group 'developers'?

Accepted Answer

gpasswd -a alice developers. `gpasswd -a alice developers` adds the user 'alice' to the supplementary group 'developers' by appending her to the group's member list in /etc/group. Option C is correct because `usermod -aG developers alice` appends 'alice' to the supplementary group 'developers' without removing her from other supplementary groups, which is the intended behavior for adding a user to an additional group.

Answer

useradd -g developers alice

Answer

groupmod -a alice developers

Answer

usermod -g developers alice

Question 6

Refer to the exhibit. A web server runs as user 'apache'. The directory /var/www/html is owned by root:root with permissions 755. The administrator wants to allow the user 'webuser' to upload files to /var/www/html via SFTP. Which step is necessary to achieve this?

Accepted Answer

Change group ownership of /var/www/html to a group that includes webuser and add group write permission. Both options B and D are valid methods to grant write access to webuser without changing the ownership. Option B (changing group ownership and adding group write permission) works if a group including webuser is created and assigned. Option D (setting an ACL with setfacl -m u:webuser:w /var/www/html) provides the same result more flexibly, without modifying group permissions. Options A and C are incorrect because they do not directly address the permission issue.

Answer

Change webuser's shell to /bin/bash to allow SFTP login

Answer

Change the SELinux context of /var/www/html to httpd_sys_rw_content_t

Question 7

Arrange the steps to configure a network bond (mode 1) using two interfaces (eth0, eth1) in RHEL.

Accepted Answer

Create bond interface config, then configure slave interfaces, then restart network. Network bonding requires creating a bond interface and configuring slaves, then restarting network.

Answer

Configure slave interfaces, then create bond interface config, then restart network

Answer

Restart network, then create bond interface config, then configure slave interfaces

Answer

Create bond interface config, then restart network, then configure slave interfaces

Question 8

Match each firewall zone to its default trust level.

Accepted Answer

drop: No traffic is sent, and incoming packets are dropped without reply.. Correct matches: drop blocks all traffic silently, public allows only basic services, internal allows more services, trusted allows all. Common confusions include mixing drop with trusted or public with internal.

Answer

drop: All network connections are accepted.

Answer

public: Medium to high trust.

Question 9

After being added to a new supplementary group with usermod -aG, a user logs out and back in but still cannot access files owned by that group. Which command should the user run to verify current effective group membership?

Accepted Answer

id. The `id` command displays the real and effective user/group IDs and all supplementary groups for the current process, making it the correct way to confirm whether the new group is actually active in the current shell. `groups $(whoami)` is incorrect because it uses the username argument, which reads the group membership from the user database (e.g., getgrouplist) and does not necessarily reflect the groups in the current process. This can misleadingly show the new group even if the current shell has not inherited it. `newgrp -c 'groups'` is not standard and is meant for changing the real group ID, not for displaying groups. `usermod -g` modifies group settings and requires superuser privileges, so it does not verify membership.

Answer

newgrp -c 'groups'

Answer

groups $(whoami)

Answer

usermod -g

Question 10

A user reports that they can log in but cannot change their password. Which file might be misconfigured?

Accepted Answer

/etc/shadow with an expiration date in the past. The /etc/shadow field sp_expire (account expiration) being in the past causes the system to deny login. A user who can log in but cannot change their password would more likely have an expired password (sp_max exceeded), which forces a password change at login; however, none of the options correctly describe that condition. PASS_MAX_DAYS=0 in /etc/login.defs does not affect existing users, an incorrect shell prevents login, and a missing group entry does not affect password changes.

Answer

/etc/group with no user entry

Answer

/etc/login.defs with PASS_MAX_DAYS set to 0

Answer

/etc/passwd with incorrect shell

Question 11

An administrator used the command useradd -D -f 10 to change the default inactivity period. What effect does this have on future user accounts?

Accepted Answer

New user accounts will be disabled after 10 days of inactivity if the password has expired.. The `useradd -D -f 10` command modifies the default value for the `INACTIVE` field in `/etc/default/useradd`. This field sets the number of days after a password expires that the account will be disabled if the password is not changed. Option C correctly describes this behavior: new user accounts will be disabled after 10 days of inactivity following password expiration.

Answer

The default group for new users will be changed to GID 10.

Answer

New user accounts will have a maximum password age of 10 days.

Answer

New user accounts will have a password expiration of 10 days.

Question 12

Which THREE statements about /etc/shadow are true? (Choose exactly 3)

Accepted Answer

Contains account expiration dates.. The /etc/shadow file stores account expiration dates in the ninth field (field 9), which is the number of days since the epoch until the account is disabled. This field is used by the system to enforce account aging policies, such as automatically locking accounts after a set period of inactivity.

Answer

Is readable by all users.

Answer

Contains user ID numbers.

Question 13

Which TWO commands can list all groups a user belongs to? (Choose exactly 2)

Accepted Answer

id -nG. Both `id -nG` and `groups` display a user's group memberships. `id -nG` shows names of all groups (primary and supplementary) via `-n` and `-G`. The `groups` command prints the groups the invoking user (or a specified user) belongs to. Options B and D only look up groups by name, not the user's memberships, and C modifies the primary group.

Answer

cat /etc/group | grep user

Answer

usermod -g user

Answer

getent group user

Question 14

Refer to the exhibit. A user bob exists with UID 1002 and GID 1002. The /etc/group shows a group bob with GID 1002 but no members listed. Bob tries to access a file owned by group 'bob' with permissions 640 and owner root. What will happen?

Accepted Answer

Bob will be able to read the file because he is a member of the group bob.. Bob's primary GID is 1002, which matches the file's group owner. This makes him a member of the group bob for access control, even though /etc/group lists no members. Thus both B and C are correct statements. The question should be revised to have a single unambiguous answer.

Answer

Bob will not be able to read the file because the group bob has no members.

Answer

Bob will be able to read the file only if he is explicitly listed in /etc/group.

Question 15

A system administrator needs to ensure that a user named 'jdoe' can execute commands as root without being prompted for a password. Which configuration change should be made?

Accepted Answer

Add 'jdoe ALL=(ALL) NOPASSWD: ALL' to /etc/sudoers via visudo. The sudoers directive 'jdoe ALL=(ALL) NOPASSWD: ALL' grants user jdoe the ability to run any command as any user (including root) on any host without a password prompt. This configuration must be added using visudo to ensure syntax validation and prevent lockout. The NOPASSWD tag overrides the default password requirement for sudo.

Answer

Add jdoe to the wheel group and configure /etc/sudoers with '%wheel ALL=(ALL) ALL'

Answer

Set the UID of jdoe to 0

Answer

Add jdoe to the root group

Question 16

A user reports they cannot log in to a Linux system. Their account was recently created. The administrator checks /etc/passwd and sees the entry: jsmith:x:1001:1001::/home/jsmith:/sbin/nologin. What is the likely issue?

Accepted Answer

The user's shell is set to /sbin/nologin which prevents login. The user's shell is set to /sbin/nologin, which is a shell that displays a message and exits immediately, preventing interactive login. This is the direct cause of the login failure, as the system uses the shell field in /etc/passwd to determine the login program.

Answer

The user is locked due to expired password

Answer

The home directory does not exist

Answer

The user is not in any supplementary groups

Question 17

An administrator is migrating user accounts to a new system. They want to preserve the user's primary group name and GID. Which commands should be used in sequence?

Accepted Answer

groupadd --gid && useradd -g . To preserve the primary group name and GID during migration, you must first create the group with the desired GID using `groupadd --gid `, then create the user with that group using `useradd -g `. Option A fails because the group does not exist; Option B fails for the same reason if the group is new; Option D is not a valid shell command sequence because 'then' is not a command.

Answer

useradd -u -g

Answer

useradd -g <group> <user>

Answer

groupadd -g then useradd -g

Question 18

A helpdesk ticket states that user 'bob' cannot write to his own home directory. The directory /home/bob has permissions drwxr-xr-x and is owned by root:root. What command will fix this?

Accepted Answer

chown bob:bob /home/bob. The home directory /home/bob is owned by root:root with permissions drwxr-xr-x, meaning only root can write to it. User 'bob' cannot write because he is not the owner. Option D (chown bob:bob /home/bob) changes the owner and group to bob, granting him write access via the owner 'w' permission.

Answer

setfacl -m u:bob:rwx /home/bob

Answer

usermod -d /home/bob bob

Answer

chmod 755 /home/bob

Question 19

An administrator needs to create a user account that will be used by an application service. The account should not have a valid shell or home directory. Which command correctly creates such an account?

Accepted Answer

useradd -r -s /sbin/nologin -M appuser. It uses the `-r` flag to create a system account (no aging information), `-s /sbin/nologin` to set the shell to a program that politely refuses login, and `-M` to explicitly skip creating a home directory. This combination ensures the account has no valid shell and no home directory, meeting the requirement for an application service account.

Answer

useradd -r -M -s /bin/false appuser

Answer

useradd -r -s /sbin/nologin appuser

Answer

useradd -s /bin/false -M appuser

Question 20

During an audit, it is discovered that a critical file /etc/shadow has permissions 644 and is owned by root:shadow. The administrator needs to secure it. What is the correct action?

Accepted Answer

chmod 640 /etc/shadow. The /etc/shadow file stores password hashes and must be readable only by root and the shadow group. The correct action is to set permissions to 640 using `chmod 640 /etc/shadow`, which removes world read access while preserving group read access. Setting 600 would break programs that operate with the shadow group, such as `unix_chkpwd`, which require group read access.

Answer

chown root:root /etc/shadow && chmod 600

Answer

chmod 600 /etc/shadow

Answer

chmod 000 /etc/shadow