CCNA User and Group Management Questions — Page 2 of 2

MCQhard

After deleting user 'alice', the system administrator wants to also remove the home directory and mail spool. Which command should be used?

A.userdel -Z alice

B.userdel -r alice

C.userdel -f alice

D.userdel --remove alice

AnswerB

-r removes home directory and mail spool.

Why this answer

The correct option is B, userdel -r alice. The -r flag removes the user's home directory and mail spool, along with the user account. This is the standard flag for removing user data along with the account.

Practice this question →

Matchingmedium

Match each Linux boot component to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Boot loader that loads the kernel

Initial RAM filesystem used before root is mounted

Init system and service manager

Core of the operating system

Program that loads the OS into memory

Why these pairings

The correct matches are: BIOS/UEFI initializes hardware and loads the bootloader; Initramfs is the temporary root filesystem; Systemd is the init system. Common confusions occur between kernel and bootloader roles.

Practice this question →

MCQhard

After attempting to log in as user 'alice', the system rejects the password. The admin checks /etc/passwd and sees 'alice:x:1001:1001::/home/alice:/bin/bash'. The /etc/shadow shows 'alice:!!:18200:0:99999:7:::', indicating the account is locked. Which command will unlock the account?

A.passwd -S alice

B.passwd -u alice

C.usermod -U alice

D.chage -d 0 alice

AnswerC

Correctly unlocks the user account password.

Why this answer

The `usermod -U alice` command unlocks the user account by removing the `!` from the password hash field in `/etc/shadow`. The `!!` in the shadow file indicates the account is locked (password disabled), and `-U` explicitly unlocks it, restoring the password hash to an active state.

Exam trap

The trap here is that candidates confuse `passwd -u` (which only unlocks accounts locked with `passwd -l`) with `usermod -U` (which handles all lock states, including those set via shadow file manipulation), leading them to choose option B incorrectly.

How to eliminate wrong answers

Option A is wrong because `passwd -S alice` displays the password status (locked/unlocked) but does not change it; it only shows whether the account is locked. Option B is wrong because `passwd -u alice` attempts to unlock the account, but it only works if the password is not set to 'expire' or if the account was locked via `passwd -l`; it may fail or not fully unlock an account locked with `!!` in shadow. Option D is wrong because `chage -d 0 alice` forces password change on next login by setting the last password change date to epoch (0), but it does not unlock the account; the account remains locked with `!!`.

Practice this question →

MCQeasy

An administrator wants to add user 'bob' to the supplementary group 'docker' without removing bob from any existing groups. Which command accomplishes this?

A.usermod -g docker bob

B.usermod -aG docker bob

C.usermod -G docker bob

D.usermod -G docker bob

AnswerB

-aG appends docker to the list of supplementary groups.

Why this answer

The `-a` (append) flag combined with `-G` (supplementary groups) ensures user 'bob' is added to the 'docker' group without removing him from any existing supplementary groups. Without `-a`, the `-G` flag replaces the user's current supplementary group list with the specified groups.

Exam trap

The trap here is that candidates often confuse `-g` (primary group) with `-G` (supplementary groups) and overlook the necessity of the `-a` flag to append rather than replace supplementary group memberships.

How to eliminate wrong answers

Option A is wrong because `-g` sets the primary group (GID) for the user, not a supplementary group; this would change bob's primary group to 'docker' and remove him from his current primary group. Option C is wrong because `-G` without `-a` replaces all supplementary groups with the specified group(s), effectively removing bob from any other supplementary groups he belongs to. Option D is wrong for the same reason as C — it is identical to C and lacks the `-a` flag, causing group replacement.

Practice this question →

MCQmedium

Existing user 'jdoe' is a member of groups 'users' (primary) and 'staff'. The administrator needs to add 'jdoe' to group 'projectx' while preserving existing supplementary group memberships. Which command achieves this?

A.usermod -g projectx -G projectx jdoe

B.usermod -g projectx jdoe

C.usermod -G projectx jdoe

D.usermod -a -G projectx jdoe

AnswerD

-a appends to current supplementary groups; -G specifies group(s).

Why this answer

The `-a` (append) flag combined with `-G` (supplementary groups) adds the user to the specified group without removing existing supplementary group memberships. Without `-a`, the `-G` flag replaces all supplementary groups with the listed ones, which would remove the 'staff' group membership.

Exam trap

The trap here is that candidates forget the `-a` flag is required with `-G` to append groups, assuming `-G` alone adds groups instead of replacing them.

How to eliminate wrong answers

Option A is wrong because it sets the primary group to 'projectx' with `-g` and also sets supplementary groups to only 'projectx' with `-G`, which would remove 'staff' and change the primary group from 'users'. Option B is wrong because `-g` changes only the primary group to 'projectx', leaving supplementary groups unchanged but incorrectly altering the primary group. Option C is wrong because `-G projectx` without `-a` replaces all supplementary group memberships with only 'projectx', removing 'staff'.

Practice this question →

MCQeasy

A system administrator needs to create a user account for a temporary contractor. The account should have a home directory under /home/contractors, the login shell should be /bin/bash, and the user should be a member of the 'contractors' group. Which command accomplishes this?

A.useradd -m -d /home/contractors/tempuser -s /bin/bash -G contractors tempuser

B.useradd -m -h /home/contractors/tempuser -s /bin/bash -g contractors tempuser

C.useradd -m -d /home/contractors/tempuser -s /bin/bash -p contractors tempuser

D.useradd -m -d /home/contractors/tempuser -s /bin/bash -g contractors tempuser

AnswerD

Correct syntax: -m creates home if missing, -d sets home path, -s sets shell, -g sets primary group.

Why this answer

The `-g` flag specifies the primary group for the user, which in this case is 'contractors'. The `-m` flag creates the home directory, `-d` sets the home directory path to `/home/contractors/tempuser`, and `-s` sets the login shell to `/bin/bash`. This satisfies all requirements: the user 'tempuser' will have a home directory under `/home/contractors`, use `/bin/bash` as their shell, and be a member of the 'contractors' group as their primary group.

Exam trap

The trap here is that candidates often confuse `-g` (primary group) with `-G` (supplementary groups), leading them to choose Option A, which adds the user to the group but does not set it as the primary group, failing the requirement that the user 'be a member of the contractors group' in the context of primary group membership.

How to eliminate wrong answers

Option A is wrong because the `-G` flag adds the user to supplementary groups, not the primary group; the user would be a member of 'contractors' as a secondary group, but the primary group would default to a new group with the same name as the user, which does not meet the requirement of being a member of the 'contractors' group. Option B is wrong because the `-h` flag is not a valid option for `useradd`; it is used with `usermod` to specify the home directory, and the `-g` flag is missing, so the primary group would not be set to 'contractors'. Option C is wrong because the `-p` flag is used to set the user's password (in encrypted form), not to specify the group; the `-g` flag is required to set the primary group to 'contractors'.

Practice this question →

Multi-Selecthard

Which THREE files are directly related to user and group management in a Linux system? (Select three.)

Select 3 answers

A./etc/sudoers

B./etc/login.defs

C./etc/group

D./etc/passwd

E./etc/shadow

AnswersC, D, E

Contains group definitions.

Why this answer

The files /etc/passwd, /etc/group, and /etc/shadow are the core local databases for user and group management. /etc/passwd stores user account information (username, UID, GID, home directory, shell), /etc/group stores group definitions (group name, GID, member list), and /etc/shadow stores encrypted password hashes and password aging data. These three files are directly consulted by commands like useradd, usermod, groupadd, and login for authentication and identity management.

Exam trap

The trap here is that candidates may confuse configuration files like /etc/sudoers or /etc/login.defs with the actual user/group database files, but the question specifically asks for files 'directly related to user and group management'—meaning the files that store the user and group records themselves, not files that configure how those records are created or used.

Practice this question →

Matchingmedium

Match each Linux filesystem hierarchy standard (FHS) directory to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Host-specific configuration files

Variable data like logs and databases

Secondary hierarchy for user utilities

Virtual filesystem for process and kernel info

Temporary files

Why these pairings

The correct matches pair each standard FHS directory with its primary purpose. Common confusions include mixing up /bin with /etc, /root with /dev, and /opt with /tmp.

Practice this question →

MCQeasy

Refer to the exhibit. The administrator attempted to create a user 'newuser' but received an error. Which command should be used to check if the user already exists?

A.cat /etc/passwd | grep newuser

B.passwd -S newuser

C.usermod -c newuser

D.userdel -v newuser

AnswerA

Correct. The /etc/passwd file stores all user account information. Using cat and grep to search for the username is a reliable method to verify if the user exists.

Why this answer

The /etc/passwd file stores all user account information, and using cat to pipe its contents through grep allows the administrator to search for the specific username 'newuser'. If the user exists, grep will output the matching line; if not, no output is returned. This is a standard, quick method to verify user existence without modifying system state.

Exam trap

The trap here is that candidates may choose a command that seems related to user management (like passwd or usermod) without realizing those commands assume the user already exists and will produce errors or unintended side effects when used for existence verification.

How to eliminate wrong answers

Option B is wrong because 'passwd -S newuser' displays the status of a user's password (e.g., locked, password set), but it will fail with an error if the user does not exist, making it unsuitable for checking existence without causing an error. Option C is wrong because 'usermod -c newuser' attempts to modify the comment field of an existing user named 'newuser', which will fail if the user does not exist; the -c flag expects a comment string, not a username to check. Option D is wrong because 'userdel -v newuser' attempts to delete the user 'newuser' with verbose output, which will fail with an error if the user does not exist, and it is a destructive command that should not be used for mere existence checks.

Practice this question →

MCQmedium

A user's account needs to be set to expire on a specific date. Which command should the administrator use?

A.usermod -e 2025-01-01 username

B.usermod -c 'expire=2025-01-01' username

C.passwd -x 90 username

D.chage -E 2025-01-01 username

AnswerD

The `chage -E` command correctly sets the account expiration date in YYYY-MM-DD format. This is the standard method for disabling a user account on a specific date.

Why this answer

The `chage -E` command sets the account expiration date for a user, which is the standard Linux method for specifying when a user account should become disabled. The `-E` flag accepts a date in YYYY-MM-DD format and updates the `/etc/shadow` file's eighth field (account expiration). This is the precise tool for the task described.

Exam trap

The trap here is that candidates often confuse `usermod -e` with `chage -E` because both can set account expiration, but the LFCS exam expects `chage` as the standard and more feature-rich command for managing account aging and expiration, while `usermod -e` is a valid but less precise alternative that may not be accepted as the 'correct' answer.

How to eliminate wrong answers

Option A is wrong because `usermod -e` expects the date in the format YYYY-MM-DD, but the syntax shown is correct; however, the real issue is that `usermod -e` sets the account expiration date in `/etc/shadow`, but the question asks for the command the administrator should use, and `chage` is the more appropriate and dedicated tool for this purpose, though `usermod -e` could technically work. Option B is wrong because `usermod -c` sets the user's GECOS comment field (typically full name or description), not an expiration date; the string 'expire=2025-01-01' would be stored as a comment and have no effect on account expiry. Option C is wrong because `passwd -x 90` sets the maximum number of days a password is valid (password aging), not the account expiration date; this forces a password change after 90 days but does not disable the account on a specific date.

Practice this question →

Multi-Selecthard

Which THREE of the following statements about the user private group (UPG) scheme are true?

Select 3 answers

A.It is the default scheme in Red Hat-based distributions.

B.The umask 0027 ensures files created are NOT readable by the group.

C.The primary group of a user is a system group with GID less than 1000.

D.It ensures that new files have a default group of the user's private group.

E.Each user is assigned a unique group with the same name as the username.

AnswersA, D, E

Red Hat-based distributions like RHEL, CentOS, and Fedora use User Private Groups (UPG) by default, where each user is assigned a unique private group with the same name as the username.

Why this answer

Options A, D, and E are true. A: It is the default scheme in Red Hat-based distributions. D: It ensures that new files have a default group of the user's private group.

E: Each user is assigned a unique group with the same name as the username. B is false because umask 0027 gives group read permission, not denies it. C is false because the primary group is the user's private group, not a system group.

Practice this question →

MCQeasy

An administrator created a new user 'john' with the default settings, but 'john' cannot log in. The error message indicates an invalid shell. Which command should the administrator use to fix this issue?

A.passwd -s john

B.useradd -s /bin/bash john

C.chsh -s /bin/bash john

D.usermod -s /bin/bash john

AnswerD

usermod modifies an existing user; -s sets the login shell.

Why this answer

The correct command is `usermod -s /bin/bash john` because it modifies an existing user's login shell in the `/etc/passwd` file. The error 'invalid shell' indicates the user's current shell is either missing or not listed in `/etc/shells`, and `usermod` is the proper tool to change a user's attributes after account creation.

Exam trap

The trap here is that candidates confuse `useradd` (for creating new users) with `usermod` (for modifying existing users), or they think `chsh` is the only shell-changing command, overlooking that `usermod` is the proper administrative tool for this task.

How to eliminate wrong answers

Option A is wrong because `passwd -s` is not a valid command; `passwd` only manages passwords, not shells (the `-s` flag is for `chsh`, not `passwd`). Option B is wrong because `useradd -s /bin/bash john` would attempt to create a new user 'john', but the user already exists, so it will fail or create a duplicate, and it does not modify the existing user. Option C is wrong because `chsh -s /bin/bash john` changes the login shell for the current user only (unless run as root), but it requires the shell to be listed in `/etc/shells`; while it could work if the shell is valid, the question specifies the administrator should use a command to fix the issue, and `usermod` is the standard tool for modifying existing user accounts in system administration contexts.

Practice this question →