XK0-006 Security Practice Question
An administrator wants to force a password change for user 'alice' on next login. Which command is appropriate?
⚠ Common exam trap
Watch out — candidates often confuse account lockout (`passwd -l`) with password expiry (`passwd -e`/`--expire`) — both touch /etc/shadow, but only one forces a change on next login while the other blocks access entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
passwd --expire alice
The `passwd --expire alice` command (equivalent to `passwd -e alice`) immediately expires alice's password by setting the shadow file's last-change date to 0, forcing a password change at her next login. This is the standard Linux mechanism for administrators to force a one-time password reset without disabling the account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
passwd --expire alice
Why this is correct
`passwd --expire alice` immediately expires alice's password, forcing a change at her next login, which satisfies the stem's requirement. Unlike `chage -d 0`, it acts instantly without editing ageing fields, and it avoids locking the account outright, so alice can still authenticate and set a new password.
- ✗
passwd -l alice
Why it's wrong here
passwd -l alice locks the account by prefixing the password hash, preventing login rather than forcing a change at next authentication. It is tempting because passwd manages passwords directly, and passwd -e alice would be correct for expiring the password so alice must set a new one.
- ✗
chage -l alice
Why it's wrong here
chage -l alice only lists alice's current password ageing information, such as last change date and expiry; it makes no modification. It is tempting because chage is the correct tool family for password ageing, and chage -d 0 alice would be the right command to force a change at next login.
- ✗
usermod -f alice
Why it's wrong here
The -f flag sets the number of days before an account is disabled after a password expires, not a forced change on next login. It is tempting because usermod does manage account expiry, but forcing a reset requires chage -d 0 or passwd -e, which expire the password immediately.
Go deeper
Related to this question
Learn chapter
User and Group Administration
Key term
passwd
passwd is a command-line utility used on Linux and Unix-like systems to change a user's password, typically stored in an encrypted format in the /etc/shadow file.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.