EX200 Manage users and groups — Timed 25 Questions

Question 1

Given the exhibit, which statement is true about the file /project/report.txt?

Accepted Answer

Any user can read report.txt. The permissions -rw-rw-r-- mean owner has rw-, group has rw-, and others have r--. Therefore, any user (including others) can read the file (A true), and Alice as owner can write (B true). Thus both A and B are correct, making the single-answer question invalid.

Answer

The file's group is wheel

Answer

Alice cannot write to report.txt because she is not the owner

Question 2

You are managing a Red Hat Enterprise Linux 8 server that hosts a shared development environment. The server has a directory /projects owned by root:developers with permissions 2770. There are three users: dev1, dev2, and dev3, all members of the 'developers' group. Developers need to create and edit files in /projects, and any new file should be writable by all members of the developers group. However, you notice that when dev1 creates a file, the permissions are 644 instead of 664, and the group is set to dev1's primary group (dev1) instead of 'developers'. After investigating, you find that the setgid bit is set on /projects, but the directory's ACLs are not configured. What is the most efficient way to ensure that new files in /projects inherit the group 'developers' and have group-writable permissions by default?

Accepted Answer

Set a default ACL with setfacl -d -m g:developers:rwx /projects. The setgid bit on /projects would already force new files to have the group 'developers'. The actual issue described (files created with 644 permissions) is solely due to the creating user's umask, not group ownership. A default ACL can be used to enforce group-write permissions, but it cannot change the owning group to 'developers' if the setgid bit is not effective. The explanation incorrectly states that the default ACL overrides the primary group; that is not how POSIX ACLs work.

Answer

Reapply the setgid bit using chmod g+s /projects

Answer

Change dev1's umask to 0002 in /etc/bashrc

Answer

Set the sticky bit on /projects with chmod o+t /projects

Question 3

Which TWO commands can be used to add the user 'alice' to the supplementary group 'developers'?

Accepted Answer

gpasswd -a alice developers. `gpasswd -a alice developers` adds the user 'alice' to the supplementary group 'developers' by appending her to the group's member list in /etc/group. Option C is correct because `usermod -aG developers alice` appends 'alice' to the supplementary group 'developers' without removing her from other supplementary groups, which is the intended behavior for adding a user to an additional group.

Answer

useradd -g developers alice

Answer

groupmod -a alice developers

Answer

usermod -g developers alice

Question 4

Refer to the exhibit. A web server runs as user 'apache'. The directory /var/www/html is owned by root:root with permissions 755. The administrator wants to allow the user 'webuser' to upload files to /var/www/html via SFTP. Which step is necessary to achieve this?

Accepted Answer

Change group ownership of /var/www/html to a group that includes webuser and add group write permission. Both options B and D are valid methods to grant write access to webuser without changing the ownership. Option B (changing group ownership and adding group write permission) works if a group including webuser is created and assigned. Option D (setting an ACL with setfacl -m u:webuser:w /var/www/html) provides the same result more flexibly, without modifying group permissions. Options A and C are incorrect because they do not directly address the permission issue.

Answer

Change webuser's shell to /bin/bash to allow SFTP login

Answer

Change the SELinux context of /var/www/html to httpd_sys_rw_content_t

Question 5

A user reports that they can log in but cannot change their password. Which file might be misconfigured?

Accepted Answer

/etc/shadow with an expiration date in the past. The /etc/shadow field sp_expire (account expiration) being in the past causes the system to deny login. A user who can log in but cannot change their password would more likely have an expired password (sp_max exceeded), which forces a password change at login; however, none of the options correctly describe that condition. PASS_MAX_DAYS=0 in /etc/login.defs does not affect existing users, an incorrect shell prevents login, and a missing group entry does not affect password changes.

Answer

/etc/group with no user entry

Answer

/etc/login.defs with PASS_MAX_DAYS set to 0

Answer

/etc/passwd with incorrect shell

Question 6

Refer to the exhibit. A user bob exists with UID 1002 and GID 1002. The /etc/group shows a group bob with GID 1002 but no members listed. Bob tries to access a file owned by group 'bob' with permissions 640 and owner root. What will happen?

Accepted Answer

Bob will be able to read the file because he is a member of the group bob.. Bob's primary GID is 1002, which matches the file's group owner. This makes him a member of the group bob for access control, even though /etc/group lists no members. Thus both B and C are correct statements. The question should be revised to have a single unambiguous answer.

Answer

Bob will not be able to read the file because the group bob has no members.

Answer

Bob will be able to read the file only if he is explicitly listed in /etc/group.

Question 7

During an audit, it is discovered that a critical file /etc/shadow has permissions 644 and is owned by root:shadow. The administrator needs to secure it. What is the correct action?

Accepted Answer

chmod 640 /etc/shadow. The /etc/shadow file stores password hashes and must be readable only by root and the shadow group. The correct action is to set permissions to 640 using `chmod 640 /etc/shadow`, which removes world read access while preserving group read access. Setting 600 would break programs that operate with the shadow group, such as `unix_chkpwd`, which require group read access.

Answer

chown root:root /etc/shadow && chmod 600

Answer

chmod 600 /etc/shadow

Answer

chmod 000 /etc/shadow

Question 8

A user 'carol' is in group 'staff'. The directory /shared has permissions drwxrwx--- and group staff. Carol can create files but cannot delete other users' files. What is missing?

Accepted Answer

Set the sticky bit with 'chmod +t /shared'. The directory /shared has permissions drwxrwx--- (770), so the group 'staff' has read, write, and execute permissions. Carol, as a member of 'staff', can create files. However, without the sticky bit, any user with write permission can delete any file in the directory, regardless of ownership. Setting the sticky bit (chmod +t /shared) restricts deletion so that only the file owner (or root) can delete their own files, which is why D is correct.

Answer

Change carol's umask

Answer

Set the setgid bit with 'chmod g+s /shared'

Answer

Change directory permissions to 770

Question 9

Which TWO of the following are valid methods to set a user's password expiration date?

Accepted Answer

chage -E 2025-12-31 username. Options C and D are correct. chage -E sets the account expiration date, and usermod -e also sets the account expiration date. passwd -e forces password change at next login, does not set expiration. chage -M sets maximum password age, not expiration date. useradd -e only works at user creation, not for existing users.

Answer

chage -M 90 username

Answer

useradd -e 2025-12-31 username

Answer

passwd -e username

Question 10

Which THREE conditions must be met for a user to effectively use the 'sudo' command to execute commands with root privileges?

Accepted Answer

User must be in the wheel group. Option B is correct because on many distributions (notably RHEL/CentOS/Fedora) membership in the wheel group is the standard way sudoers grants sudo rights, typically via the line '%wheel ALL=(ALL) ALL'. Option D is correct because sudo consults /etc/sudoers (and included files in /etc/sudoers.d) to determine whether the invoking user is authorized to run commands as root; without an entry there, sudo denies the request. Option E is correct because the sudoers file must be edited with visudo (or visudo -f for drop-in files), which locks the file and runs syntax checks so a malformed policy does not break sudo for all users. Option A is not a requirement because sudo only needs the target binary to be executable by the invoking user's effective context, not specifically by root. Option C is not required because sudo authenticates the user's own password (or uses NOPASSWD), and an account can be configured to run sudo without a password at all.

Answer

The target command must be executable by root

Answer

User must have a password set

Question 11

Your organization has a shared directory /data/projects with permissions 2770 owned by root:projectmanagers. The directory is used by a team of developers who are all members of the 'developers' group. However, you need to ensure that any file created inside /data/projects automatically belongs to the 'developers' group, not the user's primary group. Additionally, you need to ensure that developers can delete only their own files, not those of others. Your IT security policy also requires that all user passwords must expire every 90 days and that new users should have a warning period of 7 days before expiration. Given the following options, which one describes the correct set of actions to achieve all these requirements?

Accepted Answer

Set setgid bit on /data/projects (chmod g+s), set sticky bit using chmod +t, use chage -M 90 -W 7 for each user, and ensure useradd defaults in /etc/login.defs have PASS_MAX_DAYS 90 and PASS_WARN_AGE 7.. To make new files inherit the 'developers' group, the directory itself must have the 'developers' group as its owning group (or use a default ACL). Since /data/projects is owned by root:projectmanagers, simply setting the setgid bit causes files to inherit 'projectmanagers'. Additionally, to allow developers to access the directory, the group must be 'developers' or developers must be members of 'projectmanagers'. The sticky bit correctly prevents users from deleting others' files, and password aging via chage -M 90 -W 7 plus /etc/login.defs defaults is correct. The correct full solution would include: chgrp developers /data/projects, chmod 3770 /data/projects (setgid and sticky), and the password aging steps.

Answer

Modify the umask of all users to 002, use chage -M 90 for all users, and set the setgid bit.

Answer

Use ACLs to set default group permissions, enable password aging by editing /etc/shadow directly, and set the sticky bit on the directory.

Answer

Set the setgid bit, create a cron job to change group ownership, and enforce password policy through pam_tally2.

Question 12

You are a junior administrator at a company that uses Red Hat Enterprise Linux 8. The HR department has a shared directory /hr/data that should be accessible to all members of the 'hr' group. The directory is currently owned by root:root with permissions 755. You need to configure the system so that new files created in /hr/data are automatically owned by the group 'hr' and the group has read-write permissions. Additionally, you need to ensure that user 'jane' (who is a member of 'hr') can create files in the directory. However, after adding 'jane' to the 'hr' group, she still cannot create files, receiving 'Permission denied'. Which of the following is the best course of action to resolve this issue?

Accepted Answer

Change the directory permissions to 2775 and set the SGID bit using chmod 2775 /hr/data. The directory needs to have the SGID bit set (chmod g+s) so that new files inherit the group ownership, and group write permission must be granted (chmod g+w). Setting permissions to 2775 sets both the SGID bit and group write permissions. Option B is incorrect because changing ownership to jane:hr would give Jane full ownership but would not enforce group inheritance for new files and would break other group members' access since the directory would be owned by her, not the group. Option C is incorrect because using sudo to grant access is a temporary workaround that does not solve the underlying permission issue; it bypasses proper group permission configuration, does not enforce group inheritance, and is not a scalable or proper solution for shared directories. Option D is incorrect; the sticky bit (chmod +t) is used to prevent users from deleting others' files, not to manage group permissions or inheritance.

Answer

Change the directory ownership to jane:hr

Answer

Use sudo to grant 'jane' full access to the directory

Answer

Set the sticky bit on the directory using chmod +t /hr/data

Question 13

A system administrator needs to ensure that a user named 'bob' can access a shared directory '/data' owned by group 'developers'. The directory has permissions 2775 and is owned by root:developers. Bob is a member of the 'developers' group. However, when Bob tries to create a file in '/data', it fails with 'Permission denied'. What is the most likely cause?

Accepted Answer

The directory has incorrect SELinux context. The directory '/data' has permissions 2775, which grants read, write, and execute to the group 'developers'. Bob is a member of 'developers', so standard Unix permissions should allow him to create files. However, the failure with 'Permission denied' despite correct group membership and permissions strongly indicates that SELinux is enforcing a policy that denies Bob write access. The most likely cause is that the directory lacks the correct SELinux context (e.g., `default_t` instead of a type like `public_content_rw_t` or a context that allows write operations).

Answer

Bob's umask is set to 0077

Answer

The setgid bit is not set

Answer

Bob's primary group is not developers

Question 14

A company policy requires that when a user is deleted, all files owned by that user in /home should be reassigned to a 'guest' account. Which command accomplishes this?

Accepted Answer

find /home -user olduser -exec chown guest {} +. Uses `find` to locate all files owned by `olduser` under `/home` and then executes `chown guest` on them, which reassigns ownership to the `guest` account. This directly satisfies the policy requirement without affecting the user account itself or copying files.

Answer

usermod -l guest olduser

Answer

userdel -r olduser

Answer

rsync -a /home/olduser/ /home/guest/

Question 15

An administrator wants to add the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from other groups. Which command should be used?

Accepted Answer

usermod -aG wheel,docker jane. Both `usermod -aG wheel,docker jane` and `usermod -a -G wheel,docker jane` are valid commands to append the user to the specified supplementary groups without removing her from other groups. The `-a` (append) flag can be combined with `-G` as `-aG` or provided separately (`-a -G`); both forms work identically. Option D (`usermod -G`) without `-a` would overwrite all supplementary groups, which is incorrect. Option A uses `groupmems`, which is not the standard command for this task and has incorrect syntax.

Answer

groupmems -a jane -g wheel,docker

Answer

usermod -G wheel,docker jane

Question 16

A server has a requirement that all users in the 'finance' group must have a password aging policy that forces password change every 90 days. Which approach best achieves this for existing users?

Accepted Answer

Write a script to run 'chage -M 90' for each user in the finance group. `chage -M 90` sets the maximum password age for a specific user, and by scripting it to apply to all members of the 'finance' group, you directly enforce the 90-day policy on existing users. This approach works regardless of the default settings in `/etc/login.defs`, which only affect new users, and avoids the manual and error-prone editing of `/etc/shadow`.

Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs

Answer

Edit /etc/shadow and change the fifth field for all users

Answer

Configure pam_pwquality.so to enforce password age

Question 17

Which TWO commands can change the primary group of an existing user?

Accepted Answer

usermod -aG. None of the listed commands change the primary group of an existing user. The correct commands are `usermod -g` to change the primary group directly, or `groupmod -g` after ensuring the user is the only member of the group.

Answer

vigr

Answer

groupmems -a

Answer

useradd -G

Question 18

A system administrator needs to ensure that the user 'jdoe' cannot log in via SSH but can still use other services like FTP. Which approach should the administrator take?

Accepted Answer

Change the user's shell to /sbin/nologin. Changing the user's shell to /sbin/nologin prevents interactive login via SSH (which requires a valid shell listed in /etc/shells) while still allowing non-interactive services like FTP, which typically do not check the user's shell. This approach specifically blocks SSH access without locking the account or affecting other authentication methods.

Answer

Lock the user account with 'usermod -L jdoe'

Answer

Delete the user's password with 'passwd -d jdoe'

Answer

Remove the user's home directory

Question 19

Arrange the steps to configure a network bond (mode 1) using two interfaces (eth0, eth1) in RHEL.

Accepted Answer

Create bond interface config, then configure slave interfaces, then restart network. Network bonding requires creating a bond interface and configuring slaves, then restarting network.

Answer

Configure slave interfaces, then create bond interface config, then restart network

Answer

Restart network, then create bond interface config, then configure slave interfaces

Answer

Create bond interface config, then restart network, then configure slave interfaces

Question 20

Match each firewall zone to its default trust level.

Accepted Answer

drop: No traffic is sent, and incoming packets are dropped without reply.. Correct matches: drop blocks all traffic silently, public allows only basic services, internal allows more services, trusted allows all. Common confusions include mixing drop with trusted or public with internal.

Answer

drop: All network connections are accepted.

Answer

public: Medium to high trust.