Courseiva

CCNA User Group Management Questions

75 of 87 questions · Page 1/2 · User Group Management topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

A system administrator needs to create a new group named 'developers' with GID 1500 and add the user 'alice' to this group. Which set of commands accomplishes this?

A.newgrp -g 1500 developers; adduser alice developers
B.create group developers gid=1500; useradd -G developers alice
C.groupadd developers -g 1500; usermod -G developers alice
D.groupadd -g 1500 developers; usermod -aG developers alice
AnswerD

Correct: groupadd creates the group with GID 1500, usermod appends alice to the supplementary group.

Why this answer

`groupadd -g 1500 developers` creates the group with the specified GID, and `usermod -aG developers alice` adds the user 'alice' to the supplementary group 'developers' while preserving her existing group memberships (the `-a` flag is essential with `-G` to avoid overwriting them). This matches the requirement exactly.

Exam trap

The trap here is that candidates often forget the `-a` flag with `usermod -G`, assuming `-G` alone appends, when in fact it replaces all supplementary groups, leading to unintended removal of existing group memberships.

How to eliminate wrong answers

Option A is wrong because `newgrp` is used to change a user's primary group for a login session, not to create a group or add a user to a group; `adduser` is a Debian/Ubuntu interactive tool that does not accept a group name as a direct argument in that syntax. Option B is wrong because `create group` is not a valid Linux command; the correct command is `groupadd`, and `useradd -G developers alice` would create a new user 'alice' (if she doesn't exist) and set her supplementary groups, but it does not create the group first and would fail if the group doesn't exist. Option C is wrong because `usermod -G developers alice` without the `-a` flag replaces all supplementary groups of 'alice' with only 'developers', potentially removing her from other necessary groups.

Practice this question →
2
MCQmedium

A security policy requires that a user's password must expire 90 days after last change, and the user must change it immediately on next login. The last password change was 30 days ago. Which set of commands achieves this?

A.chage -M 90 user1; chage -d 0 user1
B.chage -M 90 user1; chage -m 1 user1
C.chage -M 90 user1; chage -W 7 user1
D.chage -M 90 user1; chage -I 5 user1
AnswerA

-M sets max days; -d 0 forces immediate change on next login.

Why this answer

`chage -M 90 user1` sets the maximum password age to 90 days, and `chage -d 0 user1` forces the password to expire immediately (setting the last change date to epoch 0), which requires the user to change the password on the next login. This satisfies both requirements: the password will expire 90 days after the forced change, and the user must change it immediately.

Exam trap

The trap here is that candidates may confuse `-d 0` with other `chage` options like `-M`, `-m`, `-W`, or `-I`, not realizing that only `-d 0` forces an immediate password change on next login.

How to eliminate wrong answers

Option B is wrong because `chage -m 1` sets the minimum number of days between password changes to 1, which does not force immediate expiration or enforce the 90-day expiry; it only prevents the user from changing the password more than once per day. Option C is wrong because `chage -W 7` sets a warning period of 7 days before password expiration, which does not force immediate password change on next login. Option D is wrong because `chage -I 5` sets the inactive lockout period to 5 days after expiration, which does not force immediate password change on next login.

Practice this question →
3
MCQmedium

Refer to the exhibit. An administrator adds user 'frank' to the group 'projectx' by editing /etc/group directly and changing the line to 'projectx:x:500:carol,dave,frank'. After saving, the administrator runs 'groups frank' and sees only 'frank' in the output. Why does frank not appear in the group 'projectx'?

A.Editing /etc/group directly is not a valid method; 'usermod -aG' must be used instead.
B.The group 'projectx' has a GID conflict with another group.
C.The 'groups' command reads only from /etc/group and the change should appear immediately.
D.The user 'frank' is still logged into the same session; he must log out and log back in for the new group to be recognized.
AnswerD

Group membership is cached at login; re-login is required to refresh.

Why this answer

The `groups` command shows the current effective group membership of the user's shell session, which is cached at login time. When `/etc/group` is edited directly, the change is written to disk immediately, but the running shell for user 'frank' still holds the old group membership list from the login process. The new group 'projectx' will only appear after 'frank' logs out and logs back in, or starts a new login shell (e.g., `su - frank`).

Exam trap

The trap here is that candidates assume editing `/etc/group` takes effect immediately for the user's current session, confusing the file's on-disk state with the per-process credential cache that is only refreshed at login.

How to eliminate wrong answers

Option A is wrong because editing `/etc/group` directly is a valid method to modify group membership; the system reads this file for group definitions, and the change is permanent once saved. Option B is wrong because there is no evidence of a GID conflict; the GID 500 is unique in the exhibit, and a conflict would not cause the `groups` command to show only 'frank' — it would cause other errors like group resolution failures. Option C is wrong because while the `groups` command does read from `/etc/group`, it reads the cached group membership of the current shell process, not the file directly; the change is on disk but not reflected in the running session.

Practice this question →
4
MCQhard

A security policy requires that user 'svc_backup' have a password that never expires. Additionally, the account should be locked after 90 days of inactivity. Which set of commands achieves this?

A.chage -W 7 -I 90 svc_backup
B.chage -E 2025-01-01 -I 90 svc_backup
C.chage -M 99999 -I 90 svc_backup
D.chage -M 90 -I 90 svc_backup
AnswerC

-M 99999 effectively disables password expiration; -I 90 locks account after 90 days of inactivity.

Why this answer

`chage -M 99999` sets the maximum password age to 99999 days, effectively preventing the password from ever expiring (since 99999 days far exceeds any practical lifespan). The `-I 90` flag sets the inactivity period to 90 days, meaning the account will be locked after 90 days of no login activity. This combination satisfies both security policy requirements: a non-expiring password and automatic lockout after 90 days of inactivity.

Exam trap

The trap here is that candidates often confuse `-I` (inactivity lock) with `-E` (account expiration) or assume that setting `-M 90` combined with `-I 90` will satisfy both requirements, but `-M 90` causes the password to expire, which violates the 'never expires' mandate.

How to eliminate wrong answers

Option A is wrong because `-W 7` sets a warning period of 7 days before password expiration, but it does not disable password expiration; the password will still expire based on the default maximum age (typically 99999 or a system-defined value), and `-I 90` alone does not prevent expiration. Option B is wrong because `-E 2025-01-01` sets an absolute account expiration date, which would lock the account on that date regardless of inactivity, and does not prevent password expiration; the policy requires the password to never expire, not the account to expire on a fixed date. Option D is wrong because `-M 90` sets the maximum password age to 90 days, meaning the password will expire after 90 days, contradicting the requirement that the password never expires; the `-I 90` inactivity lock would only apply after the password expires, not independently.

Practice this question →
5
Multi-Selectmedium

Which THREE commands can be used to list all users currently logged into the system?

Select 3 answers
A.w
B.last
C.users
D.id
E.who
AnswersA, C, E

Correct. The `w` command lists all currently logged-in users with detailed session information.

Why this answer

The `w` command displays detailed information about currently logged-in users, including login time, idle time, and current process. The `users` command lists the usernames of all users currently logged in. The `who` command shows a list of users currently logged in, typically with login time and session details.

All three commands read from /var/run/utmp or similar system files to present active sessions, making them valid for listing current users.

Exam trap

Candidates often confuse `last` (which shows historical logins) with `w`, `who`, or `users` (which show current logins). They may also overlook that `users` is a valid command, or mistakenly think `id` provides login status. While `w` and `who` are commonly taught, `users` is also correct and should not be dismissed.

Practice this question →
6
MCQmedium

An admin needs to change the primary group of user 'alice' from 'grp1' to 'grp2', but alice should still be a member of 'grp1' as a supplementary group. Which command accomplishes this?

A.usermod -s /bin/bash alice
B.usermod -g grp2 -aG grp1 alice
C.usermod -g grp2 alice
D.usermod -G grp2 alice
AnswerB

Correctly sets primary group to grp2 and adds grp1 as a supplementary group without affecting other groups.

Why this answer

The usermod -g grp2 changes the primary group to grp2, and -aG grp1 adds grp1 as a supplementary group without removing other supplementary groups, satisfying the requirement that alice remains a member of grp1.

Practice this question →
7
Multi-Selectmedium

Which TWO commands can be used to display the groups to which the current user belongs? (Select exactly two.)

Select 2 answers
A.cat /etc/group
B.groupmems -l
C.id
D.getent group
E.groups
AnswersC, E

Displays user identity including group memberships.

Why this answer

The `id` command (option C) displays the current user's UID, GID, and all supplementary group memberships. When run without arguments, it shows the effective user and group IDs along with all groups the user belongs to, making it a direct and reliable way to list group membership.

Exam trap

The trap here is that candidates often confuse commands that list all system groups (like `cat /etc/group` or `getent group`) with commands that specifically show only the groups of the current user, leading them to select options A or D as correct.

Practice this question →
8
MCQeasy

Refer to the exhibit. User 'alice' cannot log in. What is the most likely problem?

A.The shadow file is missing alice's entry
B.The user's UID or GID is not unique
C.The home directory ownership is incorrect
D.The login shell /bin/bash does not exist
AnswerC

Home directory should be owned by alice:alice, not root:root.

Why this answer

The exhibit shows that the home directory /home/alice is owned by root, not by user alice. When a user's home directory ownership is incorrect, the login process may fail or the user may be dropped into a restricted environment, as the system cannot write necessary files (like .bashrc or .bash_logout) to the home directory. This is a common misconfiguration that prevents normal login.

Exam trap

The exam often tests the misconception that missing shadow entries or shell issues are the primary causes of login failures, but the trap here is that incorrect home directory ownership is a subtle yet common problem that still allows password authentication but prevents a full interactive session.

How to eliminate wrong answers

Option A is wrong because if the shadow file were missing alice's entry, the system would typically report 'user does not exist' or a similar error, not a login failure after password entry; the exhibit shows no such error. Option B is wrong because non-unique UID or GID would cause permission conflicts but would not prevent login; the user could still authenticate and access the system. Option D is wrong because if /bin/bash did not exist, the system would fall back to /bin/sh or display a 'shell not found' error, but the exhibit does not indicate a shell error.

Practice this question →
9
MCQhard

A user 'alice' cannot log in via SSH. The administrator checks /etc/passwd and sees: alice:x:1002:1002::/home/alice:/sbin/nologin. Which command should be used to allow alice to log in with a bash shell?

A.usermod -d /home/alice alice
B.usermod -u 1002 alice
C.usermod -s /bin/bash alice
D.useradd -m -s /bin/bash alice
AnswerC

usermod -s changes the login shell to /bin/bash, allowing interactive login.

Why this answer

The /sbin/nologin shell in the /etc/passwd entry prevents alice from logging in via SSH. The usermod -s /bin/bash alice command changes alice's login shell to /bin/bash, allowing interactive SSH sessions. This directly addresses the shell restriction without altering other account properties.

Exam trap

The trap here is that candidates may confuse the shell field with other fields like home directory or UID, or attempt to recreate the user with useradd instead of modifying the existing account with usermod.

How to eliminate wrong answers

Option A is wrong because usermod -d /home/alice alice changes the home directory, but alice's home directory is already /home/alice, and this does not affect the login shell restriction. Option B is wrong because usermod -u 1002 alice changes the UID to 1002, which is already alice's UID, and has no impact on the shell or login ability. Option D is wrong because useradd -m -s /bin/bash alice attempts to create a new user 'alice', which will fail if the user already exists, and it does not modify the existing user's shell.

Practice this question →
10
MCQeasy

A system administrator needs to create a user 'john' with a home directory in /data/users and an expiry date of 2025-12-31. Which command accomplishes this?

A.useradd -d /data/users -c 2025-12-31 john
B.adduser --home /data/users --expiredate 2025-12-31 john
C.useradd -d /data/users -e 2025-12-31 john
D.useradd -m -e 2025-12-31 john
AnswerC

Correctly sets home directory and expiry.

Why this answer

The `useradd` command with `-d /data/users` sets the home directory to the specified path, and `-e 2025-12-31` sets the account expiry date in YYYY-MM-DD format. The `-e` flag directly corresponds to the `EXPIRE_DATE` field in `/etc/shadow`, which controls when the account becomes locked.

Exam trap

The trap here is that candidates confuse `-c` (comment) with `-e` (expiry) or assume `adduser` supports the same long options as `useradd`, leading them to pick A or B, while D is tempting because it includes `-m` but misses the required `-d` to specify the custom path.

How to eliminate wrong answers

Option A is wrong because `-c` is used for the GECOS comment field (e.g., full name), not for setting an expiry date; using `-c 2025-12-31` would incorrectly store that string as the user's comment. Option B is wrong because `adduser` is a Perl script that does not accept `--home` or `--expiredate` flags; it uses different syntax (e.g., `--home` is not a valid long option, and the correct flag for expiry in `adduser` is `--expiredate` but it is not supported in standard LFCS distributions). Option D is wrong because while `-e 2025-12-31` is correct for expiry, `-m` creates the home directory in the default location (e.g., `/home/john`) rather than `/data/users`, and no `-d` is provided to override the path.

Practice this question →
11
MCQhard

You are a system administrator for a company with a strict security policy: user accounts must be disabled after 90 days of inactivity. The tool used is the chage command with the -I (inactive) option. User 'bob' has been on leave and cannot log in. You run 'chage -l bob' and see: Last password change: Jan 10, 2024; Password expires: Apr 09, 2024; Account expires: never; Minimum number of days between password change: 0; Maximum number of days between password change: 90; Number of days of warning before password expires: 7; Number of days of inactivity after password expires: 90. Bob tells you he tried to log in today (date is July 15, 2024) and received 'Your account has expired; contact your system administrator'. You need to restore Bob's account access immediately while still enforcing the inactivity lock for future periods. What should you do?

A.Run 'chage -M 99999 bob' to set password to never expire, then 'passwd bob' to set a new password, and finally 'chage -d 0 bob'.
B.Run 'chage -E -1 bob' to clear account expiration, then 'chage -I 90 bob' to set inactivity period, then instruct Bob to change his password immediately.
C.Run 'passwd bob' to reset his password, then 'chage -d 0 bob' to force password change on next login.
D.Delete Bob's user account with 'userdel -r bob' and recreate it with 'useradd bob', then assign him to his groups and restore his data from backup.
AnswerB

This correctly removes the account expiration and resets the inactivity timer. Bob can then log in with his current password (which will force a change if password is expired) or reset it.

Why this answer

Chage -E -1 bob sets the account expiration to never, effectively removing any expiry that might have locked the account due to inactivity, and chage -I 90 bob re-sets the inactivity period to 90 days after password expiry. This allows Bob to log in after resetting his password (since his password has already expired), and future inactivity will be tracked. Option A is incorrect because changing the maximum password age to 99999 does not address the expired account; the account may still be locked due to inactivity.

Option C only resets the password but does not clear the account expiration or inactivity counter. Option D is overkill and loses Bob's home directory, files, and group memberships.

Practice this question →
12
Multi-Selectmedium

Which TWO options in /etc/shadow are correctly described?

Select 2 answers
A.The password expiration date is stored in the third field
B.The minimum number of days between password changes is the fourth field
C.The account expiration date is the sixth field
D.The number of days since Jan 1, 1970 until the account expires is stored in the seventh field
E.The maximum number of days a password is valid is the fifth field
AnswersB, E

Field 4 is minimum days (pass_min days).

Why this answer

The fourth field in /etc/shadow stores the minimum number of days that must pass between password changes. This field prevents users from changing their password too frequently, enforcing password history policies. Option E is correct because the fifth field holds the maximum number of days a password is valid, after which the user is forced to change it.

Exam trap

The trap here is that candidates confuse the field numbering for password expiration (field 5) with account expiration (field 7), and often misremember that the seventh field stores the account expiration date, not the sixth or eighth.

Practice this question →
13
MCQmedium

A system administrator needs to ensure that all users in the 'developers' group have read and write access to a shared project directory /project/data, but new files created in that directory should belong to the 'developers' group automatically. Which command sequence achieves this goal?

A.setfacl -m g:developers:rwx /project/data && chmod 2775 /project/data
B.chown root:developers /project/data && chmod u+s /project/data
C.chmod g+s /project/data && chown root:developers /project/data
D.chown :developers /project/data && chmod g+s /project/data
AnswerD

chown :developers sets the group to developers; chmod g+s sets the SGID bit so new files inherit the group.

Why this answer

`chown :developers /project/data` changes the group ownership of the directory to 'developers', and `chmod g+s /project/data` sets the setgid bit on the directory. The setgid bit ensures that new files created inside inherit the directory's group ('developers') instead of the creator's primary group, and the group ownership gives all members of 'developers' read and write access based on the directory's permissions (e.g., 775).

Exam trap

The trap here is that candidates confuse the setuid bit (u+s) with the setgid bit (g+s), or they forget that group ownership must be explicitly set to 'developers' for inheritance to work, leading them to choose options that set the wrong sticky bit or omit the group change.

How to eliminate wrong answers

Option A is wrong because `setfacl -m g:developers:rwx` grants read, write, and execute access via ACL, but `chmod 2775` sets the setgid bit (2) and permissions 775, which does not automatically assign new files to the 'developers' group—the setgid bit is set, but the group ownership of the directory must be 'developers' for inheritance to work, and this command does not change the group. Option B is wrong because `chown root:developers` sets the group to 'developers', but `chmod u+s` sets the setuid bit (not setgid), which affects the user owner, not group inheritance; new files will not automatically belong to the 'developers' group. Option C is wrong because `chmod g+s` sets the setgid bit, but `chown root:developers` changes the group to 'developers'—however, the order is reversed: the setgid bit should be set after changing group ownership to ensure proper inheritance, though technically the commands would work if executed in any order; the primary issue is that the setgid bit is set before the group change, which is not a functional error but the sequence is less logical; more importantly, the option does not include the necessary permissions (e.g., 2775) to guarantee read/write access for the group, relying on default umask, which may not grant write access.

Practice this question →
14
MCQmedium

You are managing a Linux server that hosts web applications. Developers often need to access the server via SSH using their personal accounts. You have been asked to create a new user 'devops' who will have sudo privileges to restart services. The user 'devops' should be a member of the 'sudo' group and also have a secondary group 'devs' for file access. The user's home directory should be /home/devops. You need to create this user with a password that is set to expire immediately so that the user must choose a new password upon first login. Which command would you use to accomplish this?

A.useradd -m -g sudo -G devs devops && passwd -e devops
B.useradd -m -g devs -G sudo devops && chage -d 0 devops
C.useradd -m -G sudo,devs -p '' devops && passwd -d devops
D.useradd -m -g sudo -G devs -p $(openssl passwd -1 temp) -e 0 devops
AnswerB

Creates user with primary group devs, supplementary group sudo, and forces password change at first login.

Why this answer

Useradd -m creates the home directory /home/devops. -g devs sets the primary group to 'devs', which is the secondary group for file access mentioned in the requirement. -G sudo adds the user to the 'sudo' group for sudo privileges. chage -d 0 sets the last password change date to 0, forcing the user to change the password on first login. Option A uses -g sudo as primary group (should be devs) and -G devs (should be sudo), and passwd -e is not a valid command to force password expiration; use chage -d 0 instead. Option C does not set a primary group, so it defaults to a new group 'devops'; -p '' sets an empty password which is insecure but does not force a change on first login; passwd -d removes the password entirely.

Option D sets primary group to sudo (incorrect), uses -e 0 which sets account expiry date, not password expiry; and hashing a temp password does not force a change.

Practice this question →
15
MCQhard

Refer to the exhibit. Assuming today is Feb 20, 2025, what happens when 'bob' attempts to log in today?

A.Login is denied because the password has expired
B.Login is successful, but a warning message is displayed that password will expire soon
C.Login is denied because the account expired on Mar 01
D.Login is successful without warnings
AnswerD

Both account and password are still valid; no warning period yet.

Why this answer

The exhibit shows that 'bob's account has an expiration date of Mar 01, 2025, and today is Feb 20, 2025, so the account is still active. Additionally, the password last changed on Feb 01, 2025, with a maximum password age (PASS_MAX_DAYS) of 30 days, meaning the password will not expire until Mar 03, 2025. Therefore, both the account and password are valid, and no warnings are triggered because the password is not within the typical 7-day warning period (PASS_WARN_AGE) before expiration.

Exam trap

The trap here is that candidates often confuse the account expiration date with password expiration, or assume that any upcoming password change triggers a warning, but the warning only appears when the password is within the `PASS_WARN_AGE` window (default 7 days), not simply because it will expire in the future.

How to eliminate wrong answers

Option A is wrong because the password has not expired; it was last changed on Feb 01, 2025, and with a 30-day maximum age, it expires on Mar 03, 2025, which is after today. Option B is wrong because no warning message is displayed; the password will expire in 11 days (Mar 03), which is beyond the typical 7-day warning window (PASS_WARN_AGE defaults to 7 days unless overridden), so the system does not issue a warning. Option C is wrong because the account does not expire until Mar 01, 2025, which is after today (Feb 20, 2025), so the account is still active and login is not denied due to account expiration.

Practice this question →
16
MCQhard

You are a systems administrator at a company that uses a centralized LDAP server for authentication, but also maintains local users for emergency access. Recently, the compliance team mandated that all service accounts must have passwords that expire every 90 days. You have a local service account 'svc_backup' with UID 2000 and GID 2000. The account is used by a backup script that runs nightly. You have updated the password aging policy but the account still shows 'Password expires : never' when you run 'chage -l svc_backup'. You suspect that the account was created without an expiry date. Which command would you use to force the password to expire 90 days from now and also ensure that the account's password is changed at the next login?

A.usermod -e $(date -d '+90 days' +%Y-%m-%d) svc_backup
B.chage -M 90 -d 0 svc_backup
C.passwd -x 90 svc_backup
D.chage -W 7 -I 30 svc_backup
AnswerB

Sets max password age to 90 days and forces password change at next login.

Why this answer

(chage -M 90 -d 0) is correct. The -M 90 flag sets the maximum number of days a password is valid to 90, and the -d 0 flag sets the last password change date to 0 (epoch), which forces the user to change the password upon next login. This satisfies the requirement of expiring the password in 90 days and requiring an immediate change.

Option A (usermod -e) sets an account expiration date, not password aging. Option C (passwd -x 90) only sets the maximum password age but does not force an immediate change. Option D (chage -W 7 -I 30) sets warning and inactivity periods but does not set the maximum age or force a password change.

Practice this question →
17
MCQeasy

Which command will display all groups a specific user belongs to, including both primary and supplementary groups?

A.cat /etc/passwd | grep username
B.groups username
C.id -g username
D.grep username /etc/group
AnswerB

Correct: displays all groups.

Why this answer

The 'groups' command is the standard utility to list all group memberships for a given user, showing both the primary group (from /etc/passwd) and any supplementary groups (from /etc/group). It queries the system's group database directly, making it the correct and simplest choice for this task.

Exam trap

The trap here is that candidates often confuse 'id -g' (which shows only the primary group ID) with listing all groups, or they assume grepping /etc/group is sufficient, overlooking that the primary group is defined in /etc/passwd and supplementary groups may come from external sources.

How to eliminate wrong answers

Option A is wrong because 'cat /etc/passwd | grep username' only displays the user's primary group ID (GID) from the passwd database, not supplementary groups. Option C is wrong because 'id -g username' outputs only the numeric primary group ID, not the group names or supplementary memberships. Option D is wrong because 'grep username /etc/group' only shows lines in /etc/group where the username appears in the comma-separated member list, missing the primary group and any groups where the user is not explicitly listed (e.g., via NSS or LDAP).

Practice this question →
18
Multi-Selecthard

Which THREE of the following are valid methods to temporarily switch to a different user account without logging out entirely? (Choose three.)

Select 3 answers
A.sudo -u username -s
B.su - username
C.newgrp groupname
D.login username
E.runuser -l username -c 'bash'
AnswersA, B, E

Launches a shell as the specified user with sudo.

Why this answer

Options A, B, and E are correct. `sudo -u username -s` launches a shell as the specified user. `su - username` starts a login shell as that user. `runuser -l username -c 'bash'` runs a command as another user (common in scripts). Option C (`newgrp groupname`) changes the group, not the user. Option D (`login username`) requires a full login, which logs out the current session.

Practice this question →
19
MCQmedium

An administrator needs to create a user 'john' with a home directory in /data/home/john, a UID of 1500, and membership in the group 'developers' as a secondary group. The group 'developers' already exists. Which single command accomplishes this?

A.adduser --uid 1500 --home /data/home/john --group developers john
B.useradd john; usermod -u 1500 -d /data/home/john -G developers john
C.useradd -u 1500 -d /data/home/john -g developers john
D.useradd -u 1500 -d /data/home/john -G developers john
AnswerD

Correct: all options in one useradd.

Why this answer

Ly uses useradd with -u to set UID 1500, -d to specify home directory /data/home/john, and -G to add john to the existing supplementary group 'developers'. This is a single command that accomplishes all requirements. Option A uses adduser which is distribution-specific and may not support --uid or --group flags.

Option B uses two separate commands (useradd then usermod), not a single command. Option C uses lowercase -g which sets the primary group, not secondary membership, so it would make 'developers' the primary group instead of adding it as a secondary group.

Practice this question →
20
MCQeasy

An administrator wants to change the primary group of user 'jane' from 'staff' to 'developers'. Which command accomplishes this?

A.usermod -g developers jane
B.usermod -G developers jane
C.groupmod -g developers jane
D.chgrp developers jane
AnswerA

Correct: -g sets the primary group.

Why this answer

The `usermod -g` command changes the primary group of a user. The `-g` option specifies the new primary group (by name or GID), and the user's existing primary group is replaced. This directly accomplishes the administrator's goal of changing jane's primary group from 'staff' to 'developers'.

Exam trap

The trap here is confusing the `-g` (primary group) and `-G` (supplementary groups) options of `usermod`, leading candidates to mistakenly choose the uppercase `-G` option when the question explicitly asks for a primary group change.

How to eliminate wrong answers

Option B is wrong because `usermod -G` (uppercase) modifies the supplementary group list, not the primary group; it would add 'developers' as an additional group while leaving the primary group unchanged. Option C is wrong because `groupmod -g` changes the GID of an existing group, not the primary group of a user; it would rename or renumber the 'developers' group itself. Option D is wrong because `chgrp` changes the group ownership of files or directories, not the primary group of a user account.

Practice this question →
21
Multi-Selecthard

Which two commands can add an existing user to a supplementary group?

Select 2 answers
A.useradd -G
B.gpasswd -a
C.addgroup
D.groupmod
E.usermod -aG
AnswersB, E

Adds user to a group.

Why this answer

The `gpasswd -a` command adds a user to a specified group, and `usermod -aG` appends a user to a supplementary group without removing them from other groups. Both commands modify the `/etc/group` file to include the user in the group's member list, making them correct for adding an existing user to a supplementary group.

Exam trap

The trap here is that candidates often confuse `usermod -G` (which replaces all supplementary groups) with `usermod -aG` (which appends), leading them to select `usermod -G` alone as correct, or they mistakenly think `useradd -G` can modify an existing user.

Practice this question →
22
Drag & Dropmedium

Order the steps to set up passwordless SSH key-based authentication.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Key generation, copying, and testing are essential; permissions and file verification ensure security.

Practice this question →
23
MCQhard

A user reports that they cannot execute a file even though they are in the file's group. The file has permissions 644 and group ownership 'staff'. The user is a member of 'staff'. What is the likely issue?

A.The file lacks execute permission for the group
B.The file does not have the setgid bit
C.The user's primary group is not 'staff'
D.The user is not the owner of the file
AnswerA

644 gives read/write to owner, read to group, no execute. Group needs execute to run.

Why this answer

The file has permissions 644, which means the owner has read/write (6), the group has read-only (4), and others have read-only (4). Since the user is a member of the group 'staff' but not the owner, they fall under the group permission class. The group lacks execute permission (the 'x' bit), so the user cannot execute the file.

Execute permission is required to run a file as a command or script, regardless of group membership.

Exam trap

LFCS exams often test the distinction between file ownership and group membership, trapping candidates who think being in the group automatically grants execute permission without checking the actual permission bits.

How to eliminate wrong answers

Option B is wrong because the setgid bit is not required for executing a file; it affects the effective group ID during execution, not the ability to execute. Option C is wrong because the user's primary group does not matter for file access; being a member of the file's group ('staff') is sufficient to apply group permissions. Option D is wrong because ownership is not required for execution; group membership grants the group permissions, which in this case lack execute.

Practice this question →
24
MCQmedium

A large company needs to create 100 user accounts from a list of names in a CSV file. Which tool is most efficient for batch user creation?

A.vipw
B.for loop with useradd
C.newusers
D.pwconv
AnswerC

Designed for batch user creation from a formatted file.

Why this answer

The `newusers` command is the most efficient tool for batch user creation because it reads a file in a specific format (username:password:UID:GID:comment:home_directory:shell) and can create multiple user accounts in a single pass, automatically handling password hashing and home directory creation. This avoids the overhead of scripting loops and multiple `useradd` invocations, making it ideal for bulk operations like creating 100 accounts from a CSV list.

Exam trap

The trap here is that candidates may think a `for loop with useradd` is the most flexible approach, but the LFCS exam emphasizes efficiency and built-in tools, making `newusers` the correct choice for batch operations over scripting a loop.

How to eliminate wrong answers

Option A is wrong because `vipw` is used to safely edit the /etc/passwd file with locking, not for batch user creation; it requires manual entry of each user line and does not automate account setup. Option B is wrong because while a `for loop with useradd` can technically create multiple users, it is less efficient than `newusers` as it requires separate shell calls for each user, lacks built-in batch password handling, and is more error-prone when processing a CSV file. Option D is wrong because `pwconv` is used to convert passwords to shadow passwords (creating /etc/shadow from /etc/passwd), not for creating user accounts.

Practice this question →
25
MCQeasy

A junior administrator issued the command 'usermod -L alice' to lock the account of user alice. However, alice is still able to log in via SSH using a public key. What is the most likely reason?

A.The usermod -L command only locks the password but does not prevent SSH key-based authentication.
B.The usermod -L command only changes the user's shell to /sbin/nologin.
C.The usermod -L command requires a restart of the SSH service to take effect.
D.The usermod -L command is not effective on accounts with a UID less than 1000.
AnswerA

Correct as described.

Why this answer

The `usermod -L` command locks the user's password by placing an exclamation mark (!) in the second field of the /etc/shadow file, which prevents password-based authentication. However, SSH public key authentication does not rely on the password field; it uses the authorized_keys file and the SSH daemon's public key challenge-response mechanism. Therefore, even with a locked password, the user can still log in via SSH if their public key is present in ~/.ssh/authorized_keys.

Exam trap

The trap here is that candidates assume `usermod -L` disables all authentication methods, but it only affects password-based authentication, not SSH public key or other key-based mechanisms.

How to eliminate wrong answers

Option B is wrong because `usermod -L` does not change the user's shell; it only locks the password. Changing the shell to /sbin/nologin is done with `usermod -s /sbin/nologin` or `chsh`. Option C is wrong because `usermod -L` takes effect immediately on the password database; no SSH service restart is required, as SSH checks the password status at each authentication attempt.

Option D is wrong because `usermod -L` works on any user account regardless of UID; there is no UID threshold for password locking, and the command affects all users with entries in /etc/shadow.

Practice this question →
26
MCQeasy

Refer to the exhibit. What is the primary group ID of user 'charlie'?

A.1000
B.Charlie Brown
C.1005 (the same as UID)
D.1005
AnswerC, D

Correct. '1005 (the same as UID)' accurately describes the primary group ID and its default relationship to the UID.

Why this answer

The primary group ID for user 'charlie' is 1005. By default, Linux creates a private user group for each new user with a GID equal to the user's UID. Both option C, which adds explanatory context, and option D, which provides the numeric value alone, are factually correct.

Therefore, both are acceptable answers.

Exam trap

The trap here is that candidates often assume the primary group ID is always different from the UID or that it is the same as the user's full name (GECOS field), but the LFCS exam expects you to know that by default, Linux creates a private group with a GID matching the UID, making '1005 (the same as UID)' the most accurate answer.

How to eliminate wrong answers

Option A is wrong because 1000 is typically the UID/GID of the first regular user created on a fresh system (e.g., 'ubuntu' or 'admin'), not the GID for user 'charlie' whose UID is 1005. Option B is wrong because 'Charlie Brown' is the GECOS field (full name) stored in /etc/passwd, not the group ID; the primary group ID is a numeric value found in /etc/group or the fourth field of /etc/passwd. Option D is wrong because while 1005 is the correct numeric GID, the answer option '1005 (the same as UID)' is more precise as it explains the relationship; selecting just '1005' misses the key concept that the GID matches the UID by default, which is the exact trap being tested.

Practice this question →
27
MCQhard

A sysadmin set up a shared directory /data/project with group ownership project and permissions 2775 (rwxrwsr-x). Users in the project group can create files, but when they try to edit files created by other group members, they get permission denied. Which is the most likely cause?

A.The directory is owned by root, so files inherit owner root, not the user's primary group.
B.The umask of users is set to 027, which prevents group write on new files.
C.The sticky bit interferes with group editing.
D.The SGID bit is not set; the directory must be chmod g+s to enforce group ownership inheritance.
AnswerB

A umask of 027 results in files with 640 permissions, no group write.

Why this answer

The directory has permissions 2775, meaning the SGID bit is set (2) and group has rwx (7). New files inherit the project group ownership due to SGID, but the user's umask controls the permissions assigned to new files. A umask of 027 removes group write permission (since 777 - 027 = 750 for directories, 666 - 027 = 640 for files), resulting in files with permissions 640 (rw-r-----) which lack group write.

This prevents other group members from editing the files. Option A is incorrect because while files are owned by root (the directory owner), that does not affect group permissions; the issue is the missing group write bit. Option C is incorrect because the sticky bit (1000) is not set; the directory uses SGID (2000).

Option D is incorrect because the SGID bit is already set (2 in 2775) and is functioning for ownership inheritance.

Practice this question →
28
Multi-Selectmedium

A Linux administrator wants to restrict user 'alice' to only be able to use the system for non-interactive tasks (e.g., running cron jobs and receiving mail) but not allow her to log in via SSH or console. Which TWO actions would achieve this goal? (Choose two.)

Select 2 answers
A.Lock alice's password with 'passwd -l alice'.
B.Set alice's login shell to /sbin/nologin in /etc/passwd.
C.Add alice to the DenyUsers directive in /etc/ssh/sshd_config.
D.Change alice's UID to 0.
E.Add alice to /etc/cron.deny.
AnswersB, C

Prevents interactive login without affecting cron/mail.

Why this answer

Sets alice's shell to /sbin/nologin, which prevents interactive logins (console, SSH, etc.) but still allows non-interactive tasks like cron jobs and mail delivery because those do not require a login shell. Option C adds alice to the DenyUsers directive in sshd_config, which blocks all SSH access regardless of authentication method (password or key). Together, these two measures ensure alice cannot log in interactively but can still run cron jobs and receive mail.

Option A locks the password but does not prevent SSH key-based login. Option D gives root privileges. Option E blocks cron, which is not desired.

Practice this question →
29
Multi-Selecteasy

An administrator needs to grant a user named 'john' the ability to switch to any other user without a password. Which TWO of the following steps are required to achieve this?

Select 2 answers
A.Add 'john' to the 'wheel' group and configure /etc/pam.d/su to use pam_wheel.so with the 'trust' option.
B.Add a sudo rule: 'john ALL=(ALL) NOPASSWD: ALL' to /etc/sudoers.
C.Set the suid bit on /bin/su.
D.Run 'usermod -L john'.
E.Add 'john' to the 'root' group.
AnswersA, B

Correct: This allows members of the wheel group to su without a password if pam_wheel.so is configured.

Why this answer

Adding 'john' to the 'wheel' group and configuring /etc/pam.d/su with pam_wheel.so and the 'trust' option allows members of the 'wheel' group to switch to any user via su without being prompted for a password. The 'trust' modifier in PAM bypasses the password authentication for users in the specified group, effectively granting passwordless su access.

Exam trap

The trap here is that candidates may confuse the 'wheel' group's traditional role in restricting su access (via pam_wheel.so without 'trust') with granting passwordless su, or they may incorrectly assume that adding a user to the 'root' group or locking the account would enable privilege escalation.

Practice this question →
30
MCQhard

A team of developers must share files under /opt/project. All developers are members of the 'devteam' group. New files must be automatically assigned to group 'devteam' and be writable by the group. Which umask and setgid configuration should be applied?

A.Set setgid bit on /opt/project and set umask to 007
B.Set the sticky bit on /opt/project and umask to 022
C.Set umask for developers to 002 only
D.Set setgid bit on /opt/project and set umask for developers to 002
AnswerD

Setgid ensures group ownership inheritance; umask 002 ensures group write.

Why this answer

Setting the setgid bit on /opt/project ensures that new files inherit the group ownership of the directory (devteam), and setting the umask to 002 removes write permission for others but preserves group write permission, so new files are group-writable. This combination meets both requirements automatically without manual intervention.

Exam trap

Candidates often make two mistakes regarding this question. First, they may think setting the setgid bit is sufficient without adjusting the umask; but without umask 002, the default 022 strips group write. Second, some may select umask 007 thinking it denies group write, but in reality umask 007 grants group write (660/770) while denying others, which is more restrictive than needed.

The correct umask is 002.

How to eliminate wrong answers

Option A is wrong because umask 007 removes all permissions for others (rwx) but also removes read and execute for group, making files not group-writable (group gets only rw-). Option B is wrong because the sticky bit only prevents users from deleting files they don't own, it does not affect group inheritance or permissions, and umask 022 removes group write permission, so new files are not group-writable. Option C is wrong because setting umask to 002 alone does not ensure new files inherit the devteam group; without the setgid bit, new files will have the primary group of the creating user, which may not be devteam.

Practice this question →
31
Multi-Selecthard

Which THREE fields are part of a standard /etc/group entry?

Select 3 answers
A.Group password (often 'x')
B.Primary GID of user
C.Group name
D.Home directory of group
E.Group members list
AnswersA, C, E

Second field, usually placeholder.

Why this answer

The /etc/group file traditionally includes a password field for the group, which is often set to 'x' to indicate that a shadowed group password is stored in /etc/gshadow. This field is part of the standard colon-delimited format defined by the system's group database, even though group passwords are rarely used in modern Linux systems.

Exam trap

The trap here is that candidates often confuse the fields of /etc/group with those of /etc/passwd, mistakenly thinking that a group entry includes a primary GID or home directory, which are user-specific attributes stored in /etc/passwd.

Practice this question →
32
MCQhard

After running 'chage -l bob', the output shows: 'Last password change: Apr 01, 2023', 'Password expires: May 31, 2023', 'Account expires: Jul 15, 2023'. What will happen on May 31, 2023?

A.Bob can still log in but will be forced to change his password.
B.Bob's account will be locked.
C.Bob's password will be disabled.
D.Bob will receive a warning message only.
AnswerA

Password expiry forces a password change on next login, but login is still allowed until account expiry.

Why this answer

On May 31, 2023, Bob's password expires. According to the PAM (Pluggable Authentication Modules) configuration and the `chage` command's behavior, a password expiration does not lock the account or disable the password; instead, it forces the user to change their password at the next login. The user can still authenticate with their current password, but upon successful authentication, the system will prompt them to set a new password before granting access to the shell.

Exam trap

The trap here is that candidates confuse password expiration with account expiration or password disabling, but the LFCS exam tests the precise distinction: password expiration forces a password change at next login, while account expiration locks the account entirely.

How to eliminate wrong answers

Option B is wrong because account locking is controlled by the 'Account expires' field (Jul 15, 2023) or by the `passwd -l` command, not by password expiration. Option C is wrong because password disabling (e.g., setting the password field to '!!' in /etc/shadow) is a separate administrative action, not triggered by password expiration; the password remains valid until changed. Option D is wrong because while a warning message may be displayed (controlled by the `PASS_WARN_AGE` parameter in /etc/login.defs, default 7 days), the primary action on the expiration date is that the user is forced to change the password, not just warned.

Practice this question →
33
MCQhard

A security policy requires that a user account 'temp_audit' be locked immediately without changing the password. Which command locks the account and prevents login?

A.userdel temp_audit
B.usermod -L temp_audit
C.chage -E 0 temp_audit
D.passwd -u temp_audit
AnswerB

Locks the account by prepending '!' to the encrypted password.

Why this answer

The `usermod -L` command locks a user account by placing an exclamation mark (!) at the beginning of the password hash in /etc/shadow, effectively disabling password-based authentication without altering the existing password. This satisfies the security policy requirement to immediately prevent login without changing the password.

Exam trap

The trap here is confusing `usermod -L` with `passwd -l` (which also locks the account) or mistaking `chage -E 0` for an immediate lock, when in fact `chage` sets a future expiration date and does not prevent all authentication methods like SSH keys or sudo.

How to eliminate wrong answers

Option A is wrong because `userdel temp_audit` deletes the user account entirely, which violates the requirement to lock the account without changing the password. Option C is wrong because `chage -E 0` sets the account expiration date to epoch (January 1, 1970), which locks the account but is not immediate if the current date is already past epoch; it also does not prevent all login methods (e.g., SSH keys may still work depending on PAM configuration). Option D is wrong because `passwd -u temp_audit` unlocks the account (the -u flag means unlock), which is the opposite of the required action.

Practice this question →
34
MCQeasy

Which command adds an existing user to a supplementary group without removing the user from other groups?

A.groupmod -a username groupname
B.usermod -A groupname username
C.usermod -aG groupname username
D.usermod -g groupname username
AnswerC

-a (append) with -G adds to supplementary group without affecting other groups.

Why this answer

The correct command is `usermod -aG groupname username`. The `-a` option (append) combined with `-G` (supplementary groups) adds the user to the specified group without affecting existing supplementary group memberships. Option A (`groupmod -a`) is incorrect because `groupmod` modifies group attributes, not user membership.

Option B (`-A`) is not a valid `usermod` option. Option D (`-g`) changes the user's primary group, not supplementary groups.

Practice this question →
35
MCQeasy

Which file stores the encrypted password (or password hash) for user accounts?

A./etc/group
B./etc/shadow
C./etc/passwd
D./etc/gshadow
AnswerB

Correct. Contains password hashes and aging info.

Why this answer

The /etc/shadow file contains the encrypted password and password aging information. The /etc/passwd file historically contained passwords but now uses 'x' placeholder.

Practice this question →
36
MCQhard

A security policy requires that all users in the 'admin' group must have a umask of 027 set automatically upon login. An administrator adds 'umask 027' to /etc/profile. However, users report that the umask is still 022. What is a likely cause?

A.The umask in /etc/profile is overridden by user-specific .bash_profile or .bashrc files.
B.The umask command in /etc/profile has a syntax error that is silently ignored.
C.The admin placed the umask command after the call to /etc/bash.bashrc which resets it.
D.The admin forgot to run 'source /etc/profile' on each user's session.
AnswerA

User files commonly override global settings.

Why this answer

User-specific shell configuration files (like ~/.bash_profile, ~/.bash_login, or ~/.profile for login shells, and ~/.bashrc for interactive non-login shells) are sourced after /etc/profile. These files can override the system-wide umask setting with a user-defined value, such as the default 022. Since the administrator only modified /etc/profile, any existing user-specific umask command in their personal dotfiles will take precedence.

Exam trap

The trap here is that candidates assume /etc/profile is the final authority for login shell settings, but they overlook that user-specific dotfiles are sourced after it and can override variables like umask.

How to eliminate wrong answers

Option B is wrong because the 'umask 027' command has no syntax error; umask accepts a three-digit octal value and is not silently ignored—if there were a syntax error, the shell would display an error message. Option C is wrong because /etc/bash.bashrc is typically sourced for interactive non-login shells, not for login shells where /etc/profile is read first; moreover, the order of sourcing does not cause a reset unless a later file explicitly changes the umask. Option D is wrong because /etc/profile is automatically sourced by the login shell for all users when they log in; running 'source /etc/profile' manually is unnecessary and not part of standard login procedures.

Practice this question →
37
Drag & Dropmedium

Order the steps to create a systemd service unit that runs a script at boot.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Creating the unit file, enabling for boot, starting, and checking status are standard steps.

Practice this question →
38
MCQeasy

An administrator needs to delete user 'obsolete' and remove its home directory and mail spool. Which command should be used?

A.userdel -f obsolete
B.userdel -r obsolete
C.userdel obsolete
D.groupdel obsolete
AnswerB

-r removes home and mail spool along with user account.

Why this answer

The correct command is `userdel -r obsolete` because the `-r` flag removes the user's home directory and mail spool in addition to deleting the user account. This matches the requirement to delete the user 'obsolete' along with its home directory and mail spool, as specified in the question.

Exam trap

The trap here is that candidates may confuse the `-r` flag with the `-f` flag, assuming `-f` (force) also removes files, or they may think `userdel` alone is sufficient, missing the requirement to clean up the home directory and mail spool.

How to eliminate wrong answers

Option A is wrong because `userdel -f` forces the removal of the user even if they are logged in, but it does not remove the home directory or mail spool; the `-f` flag is for force, not for recursive removal. Option C is wrong because `userdel obsolete` only removes the user account without deleting the home directory or mail spool, leaving those files orphaned. Option D is wrong because `groupdel obsolete` is used to delete a group, not a user, and it does not affect the user's home directory or mail spool.

Practice this question →
39
MCQhard

A user reports that they cannot log in via SSH. The system administrator checks that the account is not locked, the password is correct, and the shell is valid. However, the user's home directory is owned by root instead of the user. What is the most likely cause of the login failure?

A.The home directory ownership is incorrect, causing SSH PAM session module to reject login
B.The user's login shell is not listed in /etc/shells
C.The /etc/nologin file exists
D.The user's entry in /etc/shadow is corrupted
AnswerA

pam_umask or pam_limits may check ownership; many systems require home owned by user.

Why this answer

When a user's home directory is owned by root instead of the user, the PAM `pam_namespace` or `pam_selinux` session modules may reject the login because they enforce strict ownership and permissions on the home directory for security. Specifically, `pam_namespace` requires the home directory to be owned by the user to create a polyinstantiated namespace, and `pam_selinux` may fail if it cannot relabel the directory. This results in SSH authentication succeeding but the session failing to open, causing a login failure.

Exam trap

The trap here is that candidates often assume SSH login failures are always due to authentication issues (password, shell, or account lock), but the LFCS exam tests the subtle distinction between authentication success and session setup failure, specifically how PAM session modules can reject a login even when credentials are correct.

How to eliminate wrong answers

Option B is wrong because the user's login shell is explicitly stated to be valid, and the shell not being listed in /etc/shells would cause a different error (e.g., 'shell not valid') during authentication, not a session failure after password acceptance. Option C is wrong because the existence of /etc/nologin prevents all non-root logins system-wide, not just for a single user, and the scenario describes a user-specific issue. Option D is wrong because a corrupted entry in /etc/shadow would cause authentication to fail outright (e.g., 'password incorrect' or 'account disabled'), not allow the password to be accepted and then fail at session setup.

Practice this question →
40
MCQmedium

A user must change their password at next login per security policy. The admin wants to expire the password immediately. Which command accomplishes this?

A.passwd -f username
B.usermod -p '' username
C.chage -M 90 username
D.chage -d 0 username
AnswerD

Sets last password change date to 0, forcing change on next login.

Why this answer

Chage -d 0 sets the last password change date to the epoch, forcing a password change on next login.

Practice this question →
41
MCQhard

You are managing a multi-user Linux server used by a development team. The server has a shared directory /data/projects where each project has a subdirectory owned by a project lead. The requirement is that all members of the 'devteam' group need to be able to create files in any project subdirectory, but only the project lead (owner) should be able to delete files. Currently, members of devteam are unable to create files in /data/projects. You check permissions: /data/projects has drwxrwxr-x root:devteam. Each project subdirectory, e.g., /data/projects/proj1, has drwx------ lead1:devteam. The lead1 user is in devteam. What is the most likely reason that devteam members cannot create files in proj1, and what is the correct solution?

A.The devteam group does not include all members; add each user to the devteam group.
B.The parent directory /data/projects lacks execute permission for devteam; add execute permission to /data/projects.
C.The sticky bit is not set; set the sticky bit on proj1 to allow only owners to delete files.
D.The proj1 directory lacks group write and execute permissions; use chmod g+rwx proj1 and chmod g+s proj1 to allow group members to create files and ensure new files inherit group.
AnswerD

drwx------ means only owner has access; adding group rwx gives devteam access; SGID ensures new files belong to devteam.

Why this answer

The project subdirectory /data/projects/proj1 has permissions drwx------ (700), which means only the owner (lead1) has read, write, and execute access. The devteam group lacks both write and execute permissions, preventing group members from creating files. The solution is to add group write and execute permissions (chmod g+rwx proj1) and set the setgid bit (chmod g+s proj1) so that new files inherit the group ownership, ensuring all devteam members can create files while only the owner can delete them.

Exam trap

The trap here is that candidates may focus on the sticky bit (Option C) because it relates to deletion control, but they overlook that the primary issue is the lack of group write and execute permissions on the subdirectory, which prevents file creation entirely.

How to eliminate wrong answers

Option A is wrong because the problem states that the devteam group already includes all members (lead1 is in devteam), and the issue is not group membership but missing permissions on the subdirectory. Option B is wrong because /data/projects already has drwxrwxr-x permissions, which include execute for the group (the 'x' in 'rwx' for the group), so the parent directory does not lack execute permission. Option C is wrong because the sticky bit prevents users from deleting files they do not own, but the requirement is that only the project lead (owner) should be able to delete files; however, the immediate problem is that group members cannot create files at all due to missing group write and execute permissions, not deletion control.

Practice this question →
42
MCQmedium

A developer was removed from the 'developers' group but still needs to run commands that require membership in that group. The user has logged out and back in, but the issue persists. What is the most likely cause?

A.The user did not explicitly start a new login shell after group removal.
B.The user's primary group is different from the 'developers' group.
C.The user is using 'newgrp developers' but is no longer a member.
D.The 'id' command shows the old group because the user's shell is still running.
AnswerA

Group membership changes require a new login session; logging out and back in should suffice, but if the user only logged out of the desktop and the session manager cached credentials, it might not refresh. The most likely cause is that the user's current shell environment still has cached group membership from the previous session.

Why this answer

When a user is removed from a supplementary group, the group membership is cached in the user's current login session. Even after logging out and back in, if the user does not explicitly start a new login shell (e.g., by using `su -` or `login`), the old group membership persists because the session's group list is inherited from the parent process. The `newgrp` command or a fresh login shell is required to re-read the group database and update the group list.

Exam trap

The trap here is that candidates assume logging out and back in always refreshes group membership, but the LFCS exam tests the nuance that a new login shell (e.g., `su -` or `login`) is required to reinitialize the group list, not just a graphical logout/login.

How to eliminate wrong answers

Option B is wrong because the primary group is irrelevant to supplementary group membership; the issue is that the user's current session still holds the old supplementary group list from before removal. Option C is wrong because `newgrp developers` would fail with an error if the user is no longer a member of the 'developers' group; it does not cause the issue described. Option D is wrong because the `id` command reflects the actual group membership of the current process, not a cached value from a previous state; if the shell were still running, `id` would show the old group because the process's group list is inherited and not automatically updated.

Practice this question →
43
Multi-Selecteasy

Which THREE of the following actions require root privileges?

Select 3 answers
A.Changing your own login shell
B.Changing another user's password
C.Changing your own password
D.Viewing /etc/shadow
E.Creating a new group
AnswersB, D, E

Requires root unless using sudo.

Why this answer

Changing another user's password (Option B) requires root privileges because the `passwd` command, when used to change another user's password, must write to `/etc/shadow`, which is owned by root and has permissions 000 (or 600) on most systems. Only root can modify this file directly or via the `passwd` command with a target username. Non-root users can only change their own password, which is handled by the `passwd` command's setuid bit, not by direct file access.

Exam trap

The trap here is that candidates often confuse 'changing your own password' (which uses setuid and does not require root) with 'changing another user's password' (which requires root), or they mistakenly think viewing `/etc/shadow` is always restricted, but root can view it directly, and non-root users cannot—so viewing it requires root privileges.

Practice this question →
44
Multi-Selecteasy

Which two commands can be used to set password expiration policies for a user?

Select 2 answers
A.usermod
B.passwd
C.chage
D.expiry
E.pwconv
AnswersB, C

Can set expiration with appropriate options.

Why this answer

The `passwd` command can set password expiration policies using options like `-x` (maximum days), `-n` (minimum days), `-w` (warning days), and `-i` (inactive days). The `chage` command is the dedicated tool for managing password aging, allowing you to set all expiration parameters interactively or via command-line options. Both commands modify the `/etc/shadow` file to enforce password aging policies.

Exam trap

The trap here is that candidates often confuse `usermod` with `chage` because `usermod` can lock accounts, but it cannot set password aging parameters like maximum days or warning periods.

Practice this question →
45
MCQmedium

A company follows the principle of least privilege. Several developers need sudo access to run specific commands like systemctl and journalctl. What is the best practice for granting this access?

A.Use 'usermod -a -G sudo' for each developer and edit /etc/sudoers manually with visudo
B.Create a new group 'devops', add developers to it, and create a sudoers drop-in file with rules for specific commands
C.Add all developers to the 'wheel' group and configure %wheel ALL=(ALL) ALL
D.Edit /etc/sudoers directly to add each developer username with command restrictions
AnswerB

Allows granular command restrictions and is maintainable.

Why this answer

It follows the principle of least privilege by creating a dedicated 'devops' group and using a sudoers drop-in file (e.g., /etc/sudoers.d/devops) to grant only specific commands like systemctl and journalctl. This avoids modifying the main /etc/sudoers file directly, which is error-prone, and ensures that developers have no more privileges than necessary. The drop-in file approach is the recommended best practice for maintainability and security.

Exam trap

The trap here is that candidates often default to adding users to the 'sudo' or 'wheel' group for convenience, overlooking the principle of least privilege and the proper use of sudoers drop-in files for command-specific restrictions.

How to eliminate wrong answers

Option A is wrong because using 'usermod -a -G sudo' adds developers to the 'sudo' group, which typically grants full root access via %sudo ALL=(ALL:ALL) ALL, violating least privilege. Option C is wrong because adding developers to the 'wheel' group with %wheel ALL=(ALL) ALL grants unrestricted root access, which is excessive and insecure. Option D is wrong because editing /etc/sudoers directly is error-prone and not scalable; the best practice is to use a drop-in file in /etc/sudoers.d/ for granular command restrictions.

Practice this question →
46
MCQeasy

An administrator wants to force a user to change their password at next login. Which command should be used?

A.passwd -l user
B.passwd -e user
C.chage -m 0 user
D.usermod -p '!' user
AnswerB

Correct: -e expires the password immediately, forcing change. Also chage -d 0 is valid, but passwd -e is simpler.

Why this answer

The `passwd -e user` command immediately expires the user's password, forcing them to change it at the next login. This is the standard method to achieve this requirement on Linux systems.

Exam trap

The trap here is confusing account locking (`passwd -l` or `usermod -p '!'`) with password expiration, as both prevent normal login but only expiration forces a password change at next login.

How to eliminate wrong answers

Option A is wrong because `passwd -l user` locks the user account, preventing any login, rather than forcing a password change. Option C is wrong because `chage -m 0 user` sets the minimum number of days between password changes to 0, which allows the user to change their password immediately but does not force a change at next login. Option D is wrong because `usermod -p '!' user` sets the password field to an invalid value (starting with '!'), which effectively locks the account, not forcing a password change.

Practice this question →
47
MCQmedium

An administrator needs to view a list of users who have logged in recently. Which command provides this information?

A.users
B.who
C.finger
D.last
AnswerD

Shows login history.

Why this answer

The `last` command reads the `/var/log/wtmp` file to display a list of all users who have logged in and out, including recent login sessions. This makes it the correct choice for viewing a history of recent logins, as it provides timestamps, duration, and originating host information.

Exam trap

The trap here is that candidates often confuse `who` or `users` (which show current sessions) with `last` (which shows historical login records), leading them to pick a command that only displays active users rather than recent login history.

How to eliminate wrong answers

Option A is wrong because `users` only shows the usernames of currently logged-in users, not a history of recent logins. Option B is wrong because `who` displays information about currently logged-in users (including terminal and login time), but does not show historical login records. Option C is wrong because `finger` can show a user's last login time from `/var/log/lastlog`, but it does not provide a comprehensive list of all recent login events and is not the standard command for viewing a login history.

Practice this question →
48
MCQeasy

A user 'alice' is unable to log in via SSH. The administrator checks /etc/shadow and sees 'alice:!:19234:0:99999:7:::'. What does the '!' in the password field indicate?

A.The password must be changed at next login.
B.The account is disabled.
C.The account is locked.
D.The password is expired.
AnswerC

'!' is a common indicator of a locked account in /etc/shadow.

Why this answer

The '!' in the password field of /etc/shadow indicates that the account is locked. This is a standard convention in Linux shadow password files: an exclamation mark placed before the hashed password (or replacing it entirely) disables password-based authentication, effectively locking the account. SSH login fails because the system refuses to authenticate any password attempt against a locked entry.

Exam trap

The trap here is that candidates confuse 'account locked' (indicated by '!' in the password field) with 'password expired' (indicated by aging fields) or 'password must be changed at next login' (indicated by a last-change value of 0).

How to eliminate wrong answers

Option A is wrong because the '!' does not force a password change at next login; that behavior is triggered by setting the password's last-change field to 0 (or a value in the past) or using the 'passwd -e' command. Option B is wrong because 'disabled' is not a standard term in shadow file semantics; the account is specifically 'locked' via the password field, not disabled via other mechanisms like nologin shell or account expiration. Option D is wrong because password expiration is indicated by the aging fields (e.g., a value of 0 in the third field or a warning in the seventh field), not by a '!' in the password hash.

Practice this question →
49
MCQhard

An administrator wants to temporarily disable a user account without deleting it. The account should be locked, expire immediately, and the user should not be able to log in. Which single command accomplishes this with minimum side effects?

A.usermod -L user1; chage -E 0 user1
B.usermod -L -e 1970-01-01 user1
C.usermod -L user1
D.usermod -e 1970-01-01 user1
AnswerB

Combined lock and account expiration; -e sets account expiration date.

Why this answer

It combines `usermod -L` to lock the password (preventing authentication via password) with `-e 1970-01-01` to set the account expiration date to January 1, 1970, which immediately expires the account (the epoch date is treated as already past). This ensures the user cannot log in via any method (password, SSH keys, etc.) because the account is both locked and expired, with minimal side effects — no files or home directory are removed.

Exam trap

The trap here is that candidates often think `usermod -L` alone is sufficient to fully disable an account, forgetting that it only locks password-based authentication and does not prevent login via SSH keys, `su`, or other mechanisms, while the `-e` option alone only expires the account without locking the password.

How to eliminate wrong answers

Option A is wrong because it uses two separate commands (`usermod -L` and `chage -E 0`), which is not a single command as required; also `chage -E 0` sets the expiration to 0 days after the epoch, which may not immediately expire the account depending on system interpretation. Option C is wrong because `usermod -L` only locks the password, but the account remains active and can still be accessed via SSH keys or other authentication methods (e.g., `sudo` or `su`), so it does not fully disable the account. Option D is wrong because `usermod -e 1970-01-01` only sets the account expiration date without locking the password, meaning the user could still log in if password authentication is bypassed (e.g., via SSH keys) or if the system does not enforce account expiration for all login methods.

Practice this question →
50
Multi-Selectmedium

Which TWO commands will correctly add the user 'john' to the 'docker' group without removing him from any existing supplementary groups?

Select 2 answers
A.adduser john docker
B.gpasswd -a john docker
C.groupmod -a john docker
D.usermod -G docker john
E.usermod -aG docker john
AnswersB, E

Adds john to the docker group without affecting other groups.

Why this answer

The correct commands are B and E. usermod -aG docker john appends john to the docker group without affecting other supplementary groups. gpasswd -a john docker also adds john to the docker group without removing existing memberships. Option A (adduser john docker) is not standard and does not exist in this form; adduser typically does not have a group argument. Option C (groupmod -a john docker) has invalid syntax; groupmod modifies group properties, not user memberships.

Option D (usermod -G docker john) replaces all supplementary groups with only docker, removing existing groups.

Practice this question →
51
MCQhard

You are the Linux administrator for a medium-sized company that uses a centralized authentication system (LDAP) for user accounts, but local files (/etc/passwd, /etc/shadow, /etc/group) are also used for a few service accounts. The server is running RHEL 8. A new employee, 'jane', needs to be added to the local system for a temporary project. You create the user with 'useradd jane' and set a password with 'passwd jane'. However, when jane tries to log in via SSH using her password, she receives 'Permission denied, please try again.' The SSH server is configured to allow password authentication. Other users (both LDAP and local) can log in successfully. You verify that the password was set correctly and that the account is not locked. What is the most likely cause and solution?

A.Configure the SSH daemon to allow password authentication for local users
B.Change jane's login shell to /bin/bash using usermod -s /bin/bash jane
C.Unlock the account using passwd -u jane
D.Remove the password expiry for jane using chage -E -1 jane
AnswerB

If the user's shell is set to /sbin/nologin or a non-existent shell, SSH will reject authentication despite correct password.

Why this answer

SSH login may fail if the user's login shell is not a valid interactive shell listed in /etc/shells. While the default shell for new users on RHEL 8 is /bin/bash, the 'useradd' command can be configured with different defaults. In this case, jane's shell might be set to /sbin/nologin, preventing SSH session establishment after successful authentication.

Changing it to /bin/bash with 'usermod -s /bin/bash jane' resolves the issue.

Exam trap

The trap is that candidates often overlook that the shell must be a valid login shell. They may focus on account locking or password issues while the shell silently rejects login.

How to eliminate wrong answers

Option A is wrong because the SSH daemon is already configured to allow password authentication, as stated in the scenario, and other users (both LDAP and local) can log in successfully. Option C is wrong because the account is not locked; the scenario explicitly states the account is not locked, and 'passwd -u jane' would only unlock an account that had been locked with 'usermod -L' or similar. Option D is wrong because password expiry is not the issue; the password was set correctly and the account is not expired, so removing expiry with 'chage -E -1' would not fix the login rejection caused by a nologin shell.

Practice this question →
52
Drag & Dropmedium

Arrange the steps to configure a new user account with sudo privileges on a Linux system.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

After creating the user and setting a password, adding to the wheel group grants sudo access. Verification and testing confirm it works.

Practice this question →
53
Multi-Selectmedium

Which three files contain user account information?

Select 3 answers
A./etc/passwd
B./etc/shadow
C./etc/gshadow
D./etc/login.defs
E./etc/group
AnswersA, B, E

User account database.

Why this answer

The /etc/passwd file stores essential user account information, including username, UID, GID, GECOS field, home directory, and default shell. It is world-readable and contains the user's password hash only as a placeholder (typically 'x') to indicate that the actual hash is stored in /etc/shadow. This file is required for user authentication and identification on Linux systems.

Exam trap

The trap here is that candidates often confuse /etc/group (which stores group membership) with user account information, or incorrectly include /etc/gshadow or /etc/login.defs because they associate them with user accounts without understanding their distinct roles.

Practice this question →
54
MCQhard

An administrator wants to enforce that users in the 'contractors' group must change their password every 30 days, with a warning 7 days before expiry. Which command should be used?

A.groupmod -p 30 contractors
B.passwd -x 30 -w 7 contractors
C.usermod -e 30 contractors
D.chage -M 30 -W 7 contractors
AnswerD

Incorrect. `chage -M 30 -W 7` is the right command for password aging, but it requires a username, not a group name.

Why this answer

None of the provided commands can be directly applied to a group. The `chage` command is the appropriate tool for password aging, but it requires a username as an argument. To enforce password aging on all users in the 'contractors' group, an administrator would need to iterate over each user in the group and run `chage -M 30 -W 7 <username>` for each.

Exam trap

The trap is that candidates may think `chage` can take a group name, but it requires a username. Also, `passwd` has similar aging options but also requires a username.

How to eliminate wrong answers

Option A is wrong because `groupmod` is used to modify group properties (like GID or group name), not password aging; the `-p` flag does not exist for password expiration. Option B is wrong because `passwd` with `-x` and `-w` can set password aging for a user, but the syntax requires a username, not a group name; it cannot be applied to a group directly. Option C is wrong because `usermod -e` sets an account expiration date (a specific date), not a password aging interval; it does not enforce a 30-day password change cycle.

Practice this question →
55
MCQmedium

Refer to the exhibit. User 'alice' is a member of groups 'users' and 'projectx'? She needs to be a member of 'staff' as well. Which of the following statements is true?

A.Alice is a member of 'projectx' but the groups command is outdated
B.Alice's primary group is 'users' and she cannot have supplementary groups
C.The entry in /etc/group for 'projectx' is incorrect because alice is not a member
D.To become a member of 'staff', alice must either log out and log in, or use newgrp command
AnswerD

New group memberships are only effective after re-login or newgrp.

Why this answer

When a user is added to a new supplementary group (e.g., 'staff'), the group membership is only applied to new login sessions. The current shell session retains the old group set. To pick up the new group without logging out, the user can run `newgrp staff` to start a new shell with the updated group membership, or log out and log back in.

This behavior is governed by how the `initgroups()` function and the `groups` command read the current session's cached group list.

Exam trap

The trap here is that candidates assume the `groups` command or current shell immediately reflects changes made to `/etc/group`, when in fact group membership is only updated at login or via explicit commands like `newgrp`.

How to eliminate wrong answers

Option A is wrong because the `groups` command reflects the current session's group membership, which is accurate for the running shell; it is not 'outdated' but rather does not automatically update when group membership changes in `/etc/group`. Option B is wrong because a user can have both a primary group and multiple supplementary groups; 'users' is likely Alice's primary group, but she can also be a member of 'projectx' and 'staff' as supplementary groups. Option C is wrong because the entry in `/etc/group` for 'projectx' is correct if it lists Alice as a member; the exhibit does not indicate an error in that file, and the issue is that the current session has not loaded the new 'staff' membership.

Practice this question →
56
MCQhard

A user named 'charlie' has just been added to the 'devops' group. However, when 'charlie' runs 'sudo -l', no sudo entries are shown. What is the most likely cause?

A.'charlie' is not listed by name in the sudoers file.
B.'charlie' must log out and log back in for the group change to take effect.
C.'charlie' is also a member of another group that restricts sudo.
D.The systemctl command is not executable by 'charlie'.
E.The sudoers file has a syntax error.
AnswerB

Correct: Group changes require a new login session to be recognized by PAM and sudo.

Why this answer

When a user is added to a new group, the group membership is only applied to new login sessions. The `sudo -l` command checks the user's current group memberships, which are cached at login time. Since 'charlie' was added to the 'devops' group while already logged in, the new group membership is not reflected until 'charlie' logs out and logs back in, or uses `newgrp` or `sg` to start a new session with the updated groups.

Exam trap

The trap here is that candidates assume group changes are immediate for all processes, but Linux caches group membership at login time, so `sudo -l` reflects only the groups present when the session started.

How to eliminate wrong answers

Option A is wrong because the sudoers file can grant sudo access via group membership (e.g., `%devops ALL=(ALL) ALL`), so 'charlie' does not need to be listed by name; the group membership should suffice. Option C is wrong because being a member of another group does not restrict sudo unless that group is explicitly denied in sudoers; group membership is additive, not restrictive. Option D is wrong because the `systemctl` command's executability is irrelevant to `sudo -l` showing entries; `sudo -l` displays the commands the user is allowed to run, not whether a specific command is executable.

Option E is wrong because a syntax error in the sudoers file would typically cause `sudo` to fail with an error message (e.g., 'syntax error near line X'), not silently show no entries.

Practice this question →
57
MCQmedium

You are a system administrator for a financial firm. One of your users, 'alice', has forgotten her password and is locked out of the system. The security policy requires that all passwords must be changed every 30 days. Alice's account was disabled due to inactivity; the account has been inactive for 45 days. You need to unlock the account and ensure that Alice must change her password at the next login. You have root access. Which set of commands should you run?

A.usermod -U alice; chage -d 0 alice
B.passwd -u alice; chage -M 30 alice
C.usermod -e '' alice; passwd alice
D.chage -E -1 alice; usermod -L alice
AnswerA

Unlocks and forces immediate password change.

Why this answer

Usermod -U unlocks the account, and chage -d 0 forces password change. Option B: passwd -u is not standard on all distros; chage -M 30 sets max days but does not force immediate change. Option C: usermod -e '' sets no account expiry but may not unlock; passwd alice sets a new password but does not force change.

Option D: chage -E -1 sets no account expiry but also uses usermod -L which locks the account.

Practice this question →
58
MCQmedium

Refer to the exhibit. The 'developers' group has members alice, bob, and charlie. User 'charlie' is not in the 'developers' group. Which statement is true?

A.alice can write to file.txt because she is in the developers group and the file has group write.
B.bob can delete /shared/project because he is the owner? No, directory permissions apply.
C.charlie can read /shared because the directory has world read? No, it's --- for others.
D.charlie can list the contents of /shared if he knows the path.
AnswerA

File has rw-rw----, group can write; alice is in developers, so she can write.

Why this answer

Alice is a member of the 'developers' group, which has group ownership of 'file.txt'. Since the file has group write permissions, Alice can write to it. Bob's statement about deleting /shared/project is incorrect because directory permissions (specifically write on the directory) determine deletion, not ownership alone.

Charlie cannot access /shared because permissions are 770 (wx for owner and group, no permissions for others), and he is not in the developers group. Therefore, option A is correct.

Practice this question →
59
MCQhard

Refer to the exhibit. The shadow entry for user 'carol' shows 18000 in the third field. What does the value 18000 represent?

A.The number of days until the account expires.
B.The minimum number of days required between password changes.
C.The number of days since the password was last changed.
D.The number of days before password expiration that the user is warned.
AnswerC

Third field is days since epoch of last password change.

Why this answer

The third field in /etc/shadow is the date of last password change, expressed as the number of days since January 1, 1970 (epoch). A value of 18000 corresponds to approximately April 2025. Option A is incorrect because the account expiration days are stored in the eighth field.

Option B is incorrect because the minimum days between password changes is the fourth field. Option D is incorrect because the warning days before expiration is the seventh field.

Practice this question →
60
MCQhard

A user 'alice' has a umask of 027 in her .bashrc, but the system administrator wants to enforce a umask of 007 for all users in the 'staff' group. Where should the administrator place the umask command to ensure it cannot be overridden by users?

A./etc/bash.bashrc
B./etc/skel/.bashrc
C./etc/profile
D.In /etc/pam.d/common-session with pam_umask.so
AnswerD

PAM umask module applies the umask regardless of shell scripts.

Why this answer

Using pam_umask.so in /etc/pam.d/common-session sets the umask at the PAM (Pluggable Authentication Modules) level, which is applied before any user shell configuration files are read. This makes it impossible for users to override the umask in their personal dot files like .bashrc. Options A (/etc/bash.bashrc), B (/etc/skel/.bashrc), and C (/etc/profile) are all shell configuration files that are processed before or after user files, but users can still override the umask by modifying their own .bashrc or .profile after these files are sourced.

Therefore, only a PAM-based solution ensures enforcement that cannot be bypassed by regular users.

Practice this question →
61
MCQeasy

An administrator needs to create a system user that runs a service (no login, no home directory). Which command is appropriate?

A.useradd -r myservice
B.useradd -r -m myservice
C.useradd -r -M myservice
D.useradd -M myservice
AnswerC

-r system user, -M no home directory. Perfect for service account.

Why this answer

The `-r` flag creates a system user (UID below SYSTEM_UID_MIN, typically 1000) without a home directory by default, and `-M` explicitly overrides any default that might create a home directory, ensuring no home directory is created. This matches the requirement for a service account that does not need login or a home directory.

Exam trap

The trap here is that candidates assume `-r` alone always prevents home directory creation, but the default behavior depends on the `CREATE_HOME` setting in `/etc/default/useradd` or `/etc/login.defs`, so `-M` must be explicitly added to guarantee no home directory.

How to eliminate wrong answers

Option A is wrong because `useradd -r myservice` creates a system user but may still create a home directory if the system's default configuration (e.g., `CREATE_HOME=yes` in `/etc/default/useradd`) is set, which violates the 'no home directory' requirement. Option B is wrong because `-m` forces the creation of a home directory, which directly contradicts the requirement. Option D is wrong because `-M` prevents home directory creation, but without `-r`, the user is created as a regular user with a UID in the normal range (typically 1000+), not a system user, which does not meet the 'system user' requirement.

Practice this question →
62
MCQhard

Refer to the exhibit. What is the most likely security issue with this configuration?

A.The 'daemon' user has a login shell of /usr/sbin/nologin, which is not secure.
B.The 'user1' home directory does not match the username.
C.There are multiple users with UID 0.
D.The 'admin' user has no password set (x in place of password).
AnswerC

Both root and admin have UID 0, which gives root privileges to admin.

Why this answer

The user 'admin' has UID 0 (root UID), giving it root privileges. This is a backdoor or misconfiguration.

Practice this question →
63
MCQeasy

Refer to the exhibit. User alice attempts to create a file in /data/project but receives 'Permission denied'. User bob can create files successfully. What is the most likely reason?

A.The directory's SGID bit requires primary group membership for write access.
B.Alice is not a member of the project group.
C.The directory has an ACL that denies write to user alice.
D.Alice needs to run 'newgrp project' or log out and back in for her group membership to take effect.
AnswerD

Group membership changes apply only to new sessions.

Why this answer

The most likely reason is that Alice's group membership for the project group was added after her current login session. Supplementary group memberships are only loaded at login, so she needs to log out and back in or run 'newgrp project' to gain the group's permissions. Options A, B, and C are incorrect because the SGID bit does not require primary group membership, Alice is indeed a member of the project group (as shown in groups output), and there is no evidence of an ACL denying her access.

Practice this question →
64
MCQmedium

A temporary contractor 'contractor1' has left the company. The administrator needs to remove the user account and all associated files in the home directory. Which command accomplishes this?

A.userdel contractor1
B.passwd -d contractor1
C.userdel -r contractor1
D.deluser --remove-home contractor1
AnswerC

Removes the user and their home directory (-r).

Why this answer

The `userdel -r contractor1` command removes the user account and, with the `-r` flag, also deletes the user's home directory and mail spool. This is the standard Linux command to completely remove a user and their associated files, as required by the scenario.

Exam trap

The trap here is that candidates may choose Option A, thinking `userdel` alone removes everything, or Option D, assuming `deluser` is universally available, when the LFCS exam tests the standard `userdel -r` command that works across all major Linux distributions.

How to eliminate wrong answers

Option A is wrong because `userdel contractor1` removes the user account but leaves the home directory and its files intact, failing to meet the requirement to remove all associated files. Option B is wrong because `passwd -d contractor1` only deletes the user's password, allowing password-less login, and does not remove the account or any files. Option D is wrong because `deluser --remove-home contractor1` is a Debian/Ubuntu-specific command, not a standard command on all Linux distributions (e.g., RHEL/CentOS), and the LFCS exam expects distribution-agnostic commands like `userdel -r`.

Practice this question →
65
MCQhard

Your company has a server that hosts a critical application. The application runs under a service account 'appuser'. Due to a security audit, it was discovered that 'appuser' has a password that never expires, which is against company policy. The policy requires that all user passwords expire after 60 days. Additionally, the application developers have requested that 'appuser' should not be allowed to change its own password via the 'passwd' command to prevent accidental lockouts. You need to enforce password expiry for 'appuser' but also ensure that only root can change its password. Which of the following approaches is the best course of action?

A.Run 'chage -M 60 appuser' and then 'passwd -e appuser' to expire the password immediately.
B.Run 'chage -M 60 -d 0 appuser' and then 'usermod -r appuser' to make it a system account.
C.Run 'chage -M 60 -d 0 appuser' and then 'passwd -l appuser' to lock the password, ensuring that the application uses sudo to run commands as appuser.
D.Run 'chage -M 60 -W 7 appuser' and then modify /etc/shadow to set the password field to '!', and configure the application to use SSH keys for authentication.
AnswerD

Disables password authentication and prevents password changes; SSH keys allow access; password expiry becomes moot.

Why this answer

The approach in D disables password-based authentication by locking the password (setting the password field to '!'). This means the account no longer uses a password, so password expiry settings are effectively irrelevant. However, this configuration prevents the appuser from changing their own password via the passwd command (since there is no usable password), and still allows the application to authenticate using SSH keys.

Root can still modify or unlock the password if needed. While this does not directly enforce password expiry, it eliminates the password as a vector, thus satisfying the security intent of the policy.

Practice this question →
66
MCQhard

An administrator runs 'pwck' and receives an error indicating a user in /etc/passwd has no matching group in /etc/group. What is the most likely cause and the appropriate corrective action?

A.The user's GID in /etc/passwd is invalid; use usermod -g to set a valid group.
B.The user's secondary group in /etc/group is missing; add the user back to the group.
C.The group was deleted with groupdel but the user's primary group in /etc/passwd was not updated; recreate the group.
D.The user's password hash is corrupted; run 'pwconv' to synchronize.
AnswerA

Correct: usermod -g can change the primary group to an existing one.

Why this answer

The `pwck` command validates the integrity of the /etc/passwd file. When it reports that a user has no matching group in /etc/group, it means the user's primary group ID (GID) specified in /etc/passwd does not correspond to any existing group entry in /etc/group. The correct action is to use `usermod -g` to assign the user to a valid existing group, which updates the GID field in /etc/passwd.

Exam trap

The trap here is that candidates confuse primary group membership (stored in /etc/passwd) with secondary group membership (stored in /etc/group), and incorrectly assume the error is about missing secondary groups rather than an invalid primary GID.

How to eliminate wrong answers

Option B is wrong because `pwck` checks the primary group GID in /etc/passwd, not secondary group memberships in /etc/group; missing secondary groups would not trigger this error. Option C is wrong because while deleting a group with `groupdel` can cause this error, the corrective action is to update the user's GID with `usermod -g`, not to recreate the group (which would restore the old GID but not fix the underlying inconsistency). Option D is wrong because `pwck` does not validate password hashes; that is the role of `pwconv` or `pwunconv`, and a corrupted hash would not cause a 'no matching group' error.

Practice this question →
67
Multi-Selectmedium

Which TWO commands can be used to display the group membership of a user? (Choose two.)

Select 2 answers
A.id -Gn username
B.cat /etc/passwd | grep username
C.id -g username
D.groups username
E.grep username /etc/group
AnswersA, D

Correct. `id -Gn username` displays all group names (primary and supplementary) for the user.

Why this answer

Options A and D are correct. The `id -Gn` command displays all group names (primary and supplementary) for a user. The `groups` command also lists all group memberships for a user.

Option B shows the user's entry in /etc/passwd, which includes primary group ID but not supplementary groups. Option C shows only the primary group ID (numeric). Option E lists groups where the user is explicitly listed in /etc/group, but it misses the primary group if not listed there.

Exam trap

A common trap is confusing `id -g` (primary group only) with `id -Gn` (all group names). Also, `grep username /etc/group` does not show primary group membership if the primary group is listed only in /etc/passwd.

Practice this question →
68
MCQmedium

You are managing a Linux server that hosts a shared project directory /projects/alpha, owned by the group 'alpha' (GID 2001). The directory has permissions 2770 (setgid, rwx for owner and group, no access for others). User 'jane' (UID 1501) has a primary group 'staff' (GID 1001) and is not in the 'alpha' group. She reports being unable to list or modify files in /projects/alpha. You need to give her access as a member of the 'alpha' group without changing her primary group. Which command sequence should you use?

A.usermod -aG alpha jane; usermod -G '' jane; usermod -aG alpha jane
B.usermod -aG alpha jane
C.usermod -g alpha jane
D.usermod -G alpha jane
AnswerB

This correctly adds Jane to the supplementary group 'alpha' without affecting her existing supplementary groups, and preserves her primary group.

Why this answer

`usermod -aG alpha jane` adds Jane to the supplementary group 'alpha' without removing her from existing supplementary groups (the `-a` flag is essential to preserve her current supplementary group memberships). The directory /projects/alpha has setgid (2770) and group ownership 'alpha', so once Jane is added to the 'alpha' group, she gains group‑level rwx permissions, allowing her to list and modify files. Option A attempts to add, then clear, then re‑add, which is unnecessary and riskier.

Option C (`-g`) changes Jane's primary group to 'alpha', which is not required and may disrupt permissions tied to her original primary group 'staff'. Option D (`-G` without `-a`) replaces all her supplementary groups with just 'alpha', removing potentially needed memberships.

Practice this question →
69
MCQhard

An administrator needs to set up a shared directory /project for the group 'projectteam' (GID 5000). All members of the group should be able to create and delete files, but only the file owner can modify their own files. The directory should also ensure that new files inherit the group ownership. Which set of commands achieves this?

A.chown root:projectteam /project; chmod 2775 /project; setfacl -m g:projectteam:rwx /project
B.chown root:projectteam /project; chmod 2770 /project; setfacl -d -m o::--- /project
C.chown root:projectteam /project; chmod 2775 /project
D.chown root:projectteam /project; chmod 1770 /project; setfacl -m m::rwx /project
AnswerB

SGID (2) inherits group; 770 gives group rwx; default ACL denies others.

Why this answer

Option B correctly achieves all requirements. 'chown root:projectteam /project' sets the owner and group. 'chmod 2770 /project' sets the SGID bit (2) so new files inherit the group 'projectteam', and gives the owner and group full rwx on the directory (allowing group members to create and delete files), while granting no permissions to others. 'setfacl -d -m o::---' adds a default ACL that denies all access to others for new items. Since no default group ACL is defined, new files inherit group permissions from the process umask (typically 022, giving group read-only). Thus, group members have read-only access to files owned by others, so only the file owner can modify their files.

All requirements are met without unnecessary ACLs for the group.

Exam trap

Candidates often confuse directory write permission with file write permission. Directory write allows creating and deleting files; file write is required to modify content. The SGID bit ensures group inheritance, but file permissions depend on umask.

Many think they need to explicitly restrict group write via ACL, but the default umask often achieves this.

How to eliminate wrong answers

Option A is wrong because the SGID bit (2) is set but the default ACL `-m g:projectteam:rwx` is redundant and doesn't restrict 'other' permissions, allowing non-group users to read files. Option C is wrong because it only sets SGID and 2775, which gives 'other' read/execute access, violating the requirement that only group members can create/delete files. Option D is wrong because 1770 sets the sticky bit instead of SGID, so new files don't inherit group ownership, and `setfacl -m m::rwx` sets a mask but doesn't enforce owner-only modification or remove 'other' permissions.

Practice this question →
70
Matchingmedium

Match each logical volume management (LVM) term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

A disk or partition used by LVM

Pool of physical volumes

Virtual block device created from a volume group

Smallest allocatable unit in a physical volume

Maps to a physical extent in a logical volume

Why these pairings

Physical Volume (PV) is the raw disk/partition; Volume Group (VG) pools PVs; Logical Volume (LV) is a virtual device from a VG; Physical Extent (PE) is the fixed-size chunk in a PV. Common confusions: swapping LV and PV, or VG and PE.

Practice this question →
71
Multi-Selecteasy

Which TWO commands are used to modify user account attributes such as password age, expiration, or lock status? (Choose two.)

Select 2 answers
A.chage
B.useradd
C.chsh
D.usermod
E.passwd
AnswersA, D

chage modifies password aging attributes like maximum days, expiry date, etc. Correct.

Why this answer

Options A and D are correct. chage is used for password aging (e.g., -M for max days, -E for expiry). usermod can lock/unlock accounts (-L/-U) and set account expiration (-e). Option B (useradd) creates new users, not modify existing. Option C (chsh) changes the user's login shell.

Option E (passwd) changes passwords and can set password aging with -x, but does not manage account lock status or account expiration date.

Practice this question →
72
MCQmedium

Scenario: You are managing a Linux server that hosts a web application. The application runs under the user 'webapp' and the group 'webgroup'. Recently, a new intern 'john' (username 'john') needs to be able to view and modify files in /var/www/html, which is owned by root:webgroup with permissions 775. John is currently a member of the group 'staff', but not 'webgroup'. The security policy requires that John must be able to edit files without using sudo, and his primary group must remain 'staff'. Which of the following actions should you take to meet the requirements?

A.Add John to the 'webgroup' supplementary group with 'usermod -a -G webgroup john'.
B.Change the group ownership of /var/www/html to 'staff' and set the setgid bit.
C.Change John's primary group to 'webgroup' with 'usermod -g webgroup john'.
D.Set the setgid bit on /var/www/html with 'chmod g+s /var/www/html'.
AnswerA

Correct: John gains the group permissions of webgroup, allowing read/write access to the directory, while his primary group remains 'staff'.

Why this answer

Adding John to the 'webgroup' supplementary group with `usermod -a -G webgroup john` grants him group-level access to /var/www/html (owned by root:webgroup with permissions 775) without changing his primary group 'staff'. This allows him to view and modify files as a member of 'webgroup', satisfying the security policy that he must not use sudo and his primary group must remain unchanged.

Exam trap

The trap here is that candidates may confuse the setgid bit (Option D) with granting group membership, or incorrectly assume that changing the primary group (Option C) is acceptable despite the explicit requirement to keep it as 'staff'.

How to eliminate wrong answers

Option B is wrong because changing the group ownership of /var/www/html to 'staff' would grant access to all members of 'staff', which violates the principle of least privilege and does not specifically give John access as a member of 'webgroup'. Option C is wrong because changing John's primary group to 'webgroup' with `usermod -g webgroup john` would violate the requirement that his primary group must remain 'staff'. Option D is wrong because setting the setgid bit on /var/www/html with `chmod g+s /var/www/html` only ensures new files inherit the group ownership of the directory, but does not grant John membership in 'webgroup' or access to the directory itself.

Practice this question →
73
Multi-Selectmedium

Which TWO commands can change a user's primary group?

Select 2 answers
A.groupdel groupname
B.groupmod -g newGID groupname
C.usermod -g groupname username
D.usermod -G groupname username
E.useradd -g groupname username
AnswersB, C

Changing a group's GID updates the GID in /etc/passwd for users whose primary group is that group.

Why this answer

`groupmod -g newGID groupname` changes the GID of a group, and since a user's primary group is identified by GID in `/etc/passwd`, altering the group's GID effectively changes the primary group for all users who have that GID as their primary group. Option C is correct because `usermod -g groupname username` directly modifies the user's primary group entry in `/etc/passwd` to the specified group name or GID.

Exam trap

The trap here is that candidates confuse `-g` (primary group) with `-G` (supplementary groups) in `usermod`, or assume `groupmod -g` only changes the group name without affecting user primary group associations.

Practice this question →
74
MCQeasy

An administrator needs to grant a user 'bob' the ability to run all commands as root without a password prompt. Which configuration in /etc/sudoers accomplishes this?

A.bob ALL=(ALL) NOPASSWD: ALL
B.bob ALL=(ALL) PASSWD: ALL
C.bob ALL=(root) NOPASSWD: ALL
D.bob ALL=(ALL) ALL
AnswerA, C

Correct. The entry `bob ALL=(ALL) NOPASSWD: ALL` allows bob to run any command as any user (including root) without a password, satisfying the requirement.

Why this answer

Both options A and C grant user bob the ability to run all commands as root without a password. Option A uses `(ALL)` as the runas list, which includes root and any other user, while option C uses `(root)` to restrict to root only. Since the requirement is specifically to run commands as root, both entries satisfy it.

Options B and D are incorrect because they require a password (PASSWD is explicit in B, and D omits NOPASSWD, defaulting to requiring a password).

Exam trap

A common pitfall is assuming that the runas list must match the target user exactly, leading to the belief that option C is the only correct one or that option A is too broad. However, both are valid as long as they allow running commands as root without a password. Another trap is misinterpreting the `PASSWD` tag as optional, but it explicitly enforces password prompting.

How to eliminate wrong answers

Option B is wrong because `PASSWD: ALL` explicitly requires a password prompt, which contradicts the requirement of no password. Option C is wrong because `(root)` restricts bob to only run commands as root, not as any user; while this still allows running commands as root without a password, the question asks for 'all commands as root' but the syntax `(root)` is overly restrictive compared to `(ALL)`, and more importantly, the question's intent is full root access, but the correct answer must match the standard LFCS phrasing which uses `(ALL)` for completeness. Option D is wrong because `ALL` without the `NOPASSWD` tag means bob will be prompted for his password before executing commands as root, which fails the 'without a password prompt' requirement.

Practice this question →
75
MCQmedium

A system administrator needs to create a shared group 'projectx' and add existing users 'bob' and 'carol' to it. The users need to collaborate on files in a directory /projectx. What is the correct sequence of commands to set up the group and ensure new files created in /projectx are automatically owned by the group 'projectx'?

A.groupadd projectx; usermod -G projectx bob carol; chmod 2770 /projectx
B.addgroup projectx; adduser bob projectx; adduser carol projectx; chmod u+s /projectx
C.groupadd projectx; usermod -aG projectx bob; usermod -aG projectx carol; chmod g+s /projectx
D.groupadd projectx; usermod -G projectx bob; usermod -G projectx carol; chmod g+s /projectx
AnswerC

Correct commands to add to group and set setgid.

Why this answer

It uses `groupadd` to create the group, `usermod -aG` to append users to the group without removing them from other groups, and `chmod g+s` to set the setgid bit on the directory. The setgid bit ensures that new files created in /projectx inherit the group ownership of the directory (projectx), enabling collaboration.

Exam trap

The trap here is that `usermod -G` without `-a` overwrites the user's supplementary groups, and candidates often forget the `-a` flag, leading to accidental removal of existing group memberships.

How to eliminate wrong answers

Option A is wrong because `usermod -G` without `-a` replaces the user's supplementary group list, removing any existing supplementary groups, which can cause loss of access. Option B is wrong because `adduser` and `addgroup` are distribution-specific (Debian/Ubuntu) and not standard on all Linux systems; also `chmod u+s` sets the setuid bit (affects user ownership, not group), which does not enforce group ownership inheritance. Option D is wrong because `usermod -G` without `-a` overwrites the user's supplementary groups, potentially removing them from other groups they need.

Practice this question →
Page 1 of 2 · 87 questions totalNext →

Ready to test yourself?

Try a timed practice session using only User Group Management questions.

Start 20-question session