mediumMultiple Choice
Extract Usernames from /etc/passwd: Linux Enumeration
A penetration tester is writing a Bash script to automate enumeration of a Linux system after gaining a shell. The script needs to extract user information from the /etc/passwd file. Which command would be most efficient for listing only the usernames?
Quick Answer
The answer is `cat /etc/passwd | cut -d: -f1`. This command is the most efficient for extracting usernames because `/etc/passwd` uses a colon (`:`) as its field delimiter, and `cut` is specifically designed to parse such structured text by splitting each line into fields and selecting the first one (`-f1`), which contains the username. On the CompTIA PenTest+ PT0-002 exam, this tests your ability to perform Linux enumeration efficiently during post-exploitation, where you must quickly identify user accounts without unnecessary overhead. A common trap is using `awk -F: '{print $1}'` which works but is heavier, or `grep -o '^[^:]*'` which is less direct; the exam favors the simplest, most purpose-built tool. Memory tip: think of `cut` as a "colon cutter"—it slices the line at each colon and hands you the first piece, the username.
⚠ Common exam trap
Test-takers frequently assume `awk` with default field splitting works for colon-delimited files, but they forget to specify the `-F:` flag, leading to incorrect output that includes the entire line or unexpected fields.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
cat /etc/passwd | cut -d: -f1
The `cut` command with `-d: -f1` splits each line of /etc/passwd on the colon delimiter and extracts the first field, which is the username. This is the most efficient and purpose-built approach for parsing colon-delimited files in Linux, avoiding unnecessary overhead from other tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
cat /etc/passwd | cut -d: -f1
Why this is correct
Piping /etc/passwd into cut with the colon delimiter and field 1 extracts only the username column, the first field of each record. This avoids parsing overhead and returns a clean list, directly satisfying the requirement to enumerate usernames efficiently.
- ✗
cat /etc/passwd | awk '{print $1}'
Why it's wrong here
awk with default field splitting prints the whole first field, which in /etc/passwd is the username, but piping cat adds a needless process. The efficient form reads the file directly, e.g. awk -F: '{print $1}' /etc/passwd, or cut -d: -f1. cat|awk would suit arbitrary whitespace-delimited text.
- ✗
cat /etc/passwd | head
Why it's wrong here
head prints the first ten complete lines of /etc/passwd, including UID, GID, home and shell fields, so usernames are not isolated. Extracting field one requires cut -d: -f1 or awk. head suits previewing a file's opening lines, not column extraction.
- ✗
grep 'user' /etc/passwd
Why it's wrong here
grep 'user' matches any line containing that substring, returning full lines and missing usernames that lack it, so it does not isolate field one. Field extraction needs a delimiter-aware tool such as cut -d: -f1. grep is correct when searching for a pattern across lines, not extracting a column.
Go deeper
Related to this question
Learn chapter
SMB Enumeration with enum4linux and CrackMapExec
Key term
Bash script
A Bash script is a text file containing a sequence of commands for the Unix shell Bash, allowing users to automate repetitive tasks and streamline system administration on Linux and macOS.
Key term
Enumeration
Enumeration is the systematic process of extracting detailed information about a target system, such as user accounts, network shares, services, and configurations, used during the reconnaissance phase of a security assessment.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PT0-003
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester is writing a Bash script to enumerate users from the /etc/passwd file on a compromised Linux system. Which command will efficiently print only the usernames?
medium- ✓ A.cut -d: -f1 /etc/passwd
- ✓ B.awk -F: '{print $1}' /etc/passwd
- ✓ C.grep -o '^[^:]*' /etc/passwd
- ✓ D.sed 's/:.*//' /etc/passwd
Why A: All four commands correctly extract the first colon-delimited field from /etc/passwd, which is the username. cut -d: -f1, awk -F: '{print $1}', grep -o '^[^:]*', and sed 's/:.*//' all produce the same list of usernames. The question as written has multiple valid answers, making it invalid for single-answer format.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.