mediumMultiple ChoiceObjective-mapped
Extract Usernames from /etc/passwd: Linux Enumeration
A penetration tester is writing a Bash script to automate enumeration of a Linux system after gaining a shell. The script needs to extract user information from the /etc/passwd file. Which command would be most efficient for listing only the usernames?
Quick Answer
The answer is `cat /etc/passwd | cut -d: -f1`. This command is the most efficient for extracting usernames because `/etc/passwd` uses a colon (`:`) as its field delimiter, and `cut` is specifically designed to parse such structured text by splitting each line into fields and selecting the first one (`-f1`), which contains the username. On the CompTIA PenTest+ PT0-002 exam, this tests your ability to perform Linux enumeration efficiently during post-exploitation, where you must quickly identify user accounts without unnecessary overhead. A common trap is using `awk -F: '{print $1}'` which works but is heavier, or `grep -o '^[^:]*'` which is less direct; the exam favors the simplest, most purpose-built tool. Memory tip: think of `cut` as a "colon cutter"—it slices the line at each colon and hands you the first piece, the username.
⚠ Common exam trap
Test-takers frequently assume `awk` with default field splitting works for colon-delimited files, but they forget to specify the `-F:` flag, leading to incorrect output that includes the entire line or unexpected fields.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
cat /etc/passwd | cut -d: -f1
The `cut` command with `-d: -f1` splits each line of /etc/passwd on the colon delimiter and extracts the first field, which is the username. This is the most efficient and purpose-built approach for parsing colon-delimited files in Linux, avoiding unnecessary overhead from other tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
cat /etc/passwd | cut -d: -f1
Why this is correct
This correctly splits each line by colon and outputs the first field (username).
- ✗
cat /etc/passwd | awk '{print $1}'
Why it's wrong here
AWK without specifying the field separator uses whitespace by default, not colon, so it would print the entire line or an incorrect field.
- ✗
cat /etc/passwd | head
Why it's wrong here
head displays the first few lines, not usernames from all lines.
- ✗
grep 'user' /etc/passwd
Why it's wrong here
This would only match lines containing the word 'user', not list all usernames.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Bash script
A Bash script is a text file containing a sequence of commands for the Unix shell Bash, allowing users to automate repetitive tasks and streamline system administration on Linux and macOS.
Key term
Enumeration
Enumeration is the systematic process of extracting detailed information about a target system, such as user accounts, network shares, services, and configurations, used during the reconnaissance phase of a security assessment.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PT0-003
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester is writing a Bash script to enumerate users from the /etc/passwd file on a compromised Linux system. Which command will efficiently print only the usernames?
medium- ✓ A.cut -d: -f1 /etc/passwd
- ✓ B.awk -F: '{print $1}' /etc/passwd
- ✓ C.grep -o '^[^:]*' /etc/passwd
- ✓ D.sed 's/:.*//' /etc/passwd
Why A: All four commands correctly extract the first colon-delimited field from /etc/passwd, which is the username. cut -d: -f1, awk -F: '{print $1}', grep -o '^[^:]*', and sed 's/:.*//' all produce the same list of usernames. The question as written has multiple valid answers, making it invalid for single-answer format.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.