How should I use these User and Group Management practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just User and Group Management questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the User and Group Management domain.

LFCS · topic practice

User and Group Management practice questions

This domain covers local account and group administration on Linux: creating, modifying and deleting users and groups, password aging, the user private group scheme, and login-time defaults such as umask and shell configuration files. LFCS tests it through scenario questions where you pick the correct command, flags, or file to satisfy a stated policy.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: User and Group Management

Practice 10 questions Browse domain →

What the exam tests

What to know about User and Group Management

You must be able to create, modify and delete users and groups, set password aging with chage or passwd, and control login defaults like umask. The key skill is knowing which file or command flag actually takes effect last for a given user.

useradd, usermod, userdel and their flags for home directories, shells and supplementary groups

passwd -e, chage and /etc/shadow fields for password expiry and forced change

groupadd, groupmod, gpasswd and /etc/group, /etc/gshadow membership management

umask, /etc/profile, /etc/login.defs and per-user shell startup file precedence

Watch out for

Common User and Group Management exam traps

▸Using userdel without -r leaves the home directory and mail spool behind, failing the requirement to remove them.
▸Editing /etc/profile for umask when a later-read per-user file such as ~/.bashrc overrides it, so the value stays 022.
▸Setting expiry with usermod -e (account expiry) instead of chage/passwd -e, which controls password expiry, not the account.

Practice set

User and Group Management questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full User and Group Management explanation →

A developer was removed from the 'developers' group but still needs to run commands that require membership in that group. The user has logged out and back in, but the issue persists. What is the most likely cause?

Trap 1: The user's primary group is different from the 'developers' group.

Primary group mismatch does not prevent supplementary group access after re-login.

Trap 2: The user is using 'newgrp developers' but is no longer a member.

Using 'newgrp' without being a member will fail, but the issue is that the user hasn't refreshed their session properly.

Trap 3: The 'id' command shows the old group because the user's shell is…

'id' reads from kernel; after re-login, it should show updated groups.

Study all User and Group Management common traps →

A
The user did not explicitly start a new login shell after group removal.
Group membership changes require a new login session; logging out and back in should suffice, but if the user only logged out of the desktop and the session manager cached credentials, it might not refresh. The most likely cause is that the user's current shell environment still has cached group membership from the previous session.
B
The user's primary group is different from the 'developers' group.
Why it fails: Primary group mismatch does not prevent supplementary group access after re-login.
C
The user is using 'newgrp developers' but is no longer a member.
Why it fails: Using 'newgrp' without being a member will fail, but the issue is that the user hasn't refreshed their session properly.
D
The 'id' command shows the old group because the user's shell is still running.
Why it fails: 'id' reads from kernel; after re-login, it should show updated groups.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full User and Group Management explanation →

A system administrator needs to create a user 'john' with a home directory in /data/users and an expiry date of 2025-12-31. Which command accomplishes this?

Trap 1: useradd -d /data/users -c 2025-12-31 john

-c sets the GECOS comment, not expiry.

Trap 2: adduser --home /data/users --expiredate 2025-12-31 john

adduser is distribution-specific and interactive; not the standard command.

Trap 3: useradd -m -e 2025-12-31 john

-m creates the home directory in /home/john by default, not /data/users.

Study all User and Group Management common traps →

A
useradd -d /data/users -c 2025-12-31 john
Why it fails: -c sets the GECOS comment, not expiry.
B
adduser --home /data/users --expiredate 2025-12-31 john
Why it fails: adduser is distribution-specific and interactive; not the standard command.
C
useradd -d /data/users -e 2025-12-31 john
The `-d` flag sets john's home directory to /data/users, while `-e` assigns the account expiry date of 2025-12-31, satisfying both stem constraints in one invocation. Unlike `usermod`, which modifies existing accounts, `useradd` creates the account directly with these attributes at creation time.
D
useradd -m -e 2025-12-31 john
Why it fails: -m creates the home directory in /home/john by default, not /data/users.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full User and Group Management explanation →

An administrator needs to set up a shared directory /project for the group 'projectteam' (GID 5000). All members of the group should be able to create and delete files, but only the file owner can modify their own files. The directory should also ensure that new files inherit the group ownership. Which set of commands achieves this?

Trap 1: chown root:projectteam /project; chmod 2775 /project; setfacl -m…

Default ACL not set, so new files may not inherit group permissions.

Trap 2: chown root:projectteam /project; chmod 2775 /project

Sticky bit (1) prevents deletion of others' files, which is not desired.

Trap 3: chown root:projectteam /project; chmod 1770 /project; setfacl -m…

Sticky bit (1) prevents deletion; mask not inherited.

Study all User and Group Management common traps →

A
chown root:projectteam /project; chmod 2775 /project; setfacl -m g:projectteam:rwx /project
Why it fails: Default ACL not set, so new files may not inherit group permissions.
B
chown root:projectteam /project; chmod 2770 /project; setfacl -d -m o::--- /project
The 2770 mode sets setgid on /project, forcing new files to inherit group projectteam, while group write permits members to create and delete entries. The default ACL denying others, combined with owner-only write on files, restricts modification to each file's owner.
C
chown root:projectteam /project; chmod 2775 /project
Why it fails: Sticky bit (1) prevents deletion of others' files, which is not desired.
D
chown root:projectteam /project; chmod 1770 /project; setfacl -m m::rwx /project
Why it fails: Sticky bit (1) prevents deletion; mask not inherited.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full User and Group Management explanation →

A user 'alice' is unable to log in via SSH. The administrator checks /etc/shadow and sees 'alice:!:19234:0:99999:7:::'. What does the '!' in the password field indicate?

Trap 1: The password must be changed at next login.

That is indicated by the last change field set to 0.

Trap 2: The account is disabled.

Disabled accounts often have '!!' or '*'.

Trap 3: The password is expired.

Expired passwords are shown by a '!' at the start of the hash.

Study all User and Group Management common traps →

A
The password must be changed at next login.
Why it fails: That is indicated by the last change field set to 0.
B
The account is disabled.
Why it fails: Disabled accounts often have '!!' or '*'.
C
The account is locked.
In /etc/shadow, a leading exclamation mark before the hash field marks the password as disabled, so PAM rejects authentication attempts. The account cannot log in with a password until the field is replaced with a valid hash.
D
The password is expired.
Why it fails: Expired passwords are shown by a '!' at the start of the hash.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full User and Group Management explanation →

You are the Linux administrator for a medium-sized company that uses a centralized authentication system (LDAP) for user accounts, but local files (/etc/passwd, /etc/shadow, /etc/group) are also used for a few service accounts. The server is running RHEL 8. A new employee, 'jane', needs to be added to the local system for a temporary project. You create the user with 'useradd jane' and set a password with 'passwd jane'. However, when jane tries to log in via SSH using her password, she receives 'Permission denied, please try again.' The SSH server is configured to allow password authentication. Other users (both LDAP and local) can log in successfully. You verify that the password was set correctly and that the account is not locked. What is the most likely cause and solution?

Trap 1: Configure the SSH daemon to allow password authentication for local…

The SSH server already allows password authentication.

Trap 2: Unlock the account using passwd -u jane

The account is not locked according to the administrator's verification.

Trap 3: Remove the password expiry for jane using chage -E -1 jane

Password expiry would cause a warning, not immediate denial.

Study all User and Group Management common traps →

A
Configure the SSH daemon to allow password authentication for local users
Why it fails: The SSH server already allows password authentication.
B
Change jane's login shell to /bin/bash using usermod -s /bin/bash jane
A shell of /sbin/nologin or /bin/false lets the account exist but blocks interactive SSH sessions, producing 'Permission denied' despite a valid password. Setting /bin/bash with usermod restores login capability, satisfying the requirement that jane authenticate via SSH.
C
Unlock the account using passwd -u jane
Why it fails: The account is not locked according to the administrator's verification.
D
Remove the password expiry for jane using chage -E -1 jane
Why it fails: Password expiry would cause a warning, not immediate denial.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full User and Group Management explanation →

A system administrator needs to ensure that all users in the 'developers' group have read and write access to a shared project directory /project/data, but new files created in that directory should belong to the 'developers' group automatically. Which command sequence achieves this goal?

Trap 1: setfacl -m g:developers:rwx /project/data && chmod 2775…

ACL grants access but without SGID, new files will inherit the creating user's primary group, not developers.

Trap 2: chown root:developers /project/data && chmod u+s /project/data

chmod u+s sets setuid bit (user), not SGID; new files will inherit the owner's primary group, not developers group.

Trap 3: chmod g+s /project/data && chown root:developers /project/data

Order matters: chmod g+s first on a directory owned by root:root will set SGID, but then chown changes group to developers but may clear SGID on some systems; also new files still inherit primary group without proper group ownership set first.

Study all User and Group Management common traps →

A
setfacl -m g:developers:rwx /project/data && chmod 2775 /project/data
Why it fails: ACL grants access but without SGID, new files will inherit the creating user's primary group, not developers.
B
chown root:developers /project/data && chmod u+s /project/data
Why it fails: chmod u+s sets setuid bit (user), not SGID; new files will inherit the owner's primary group, not developers group.
C
chmod g+s /project/data && chown root:developers /project/data
Why it fails: Order matters: chmod g+s first on a directory owned by root:root will set SGID, but then chown changes group to developers but may clear SGID on some systems; also new files still inherit primary group without proper group ownership set first.
D
chown :developers /project/data && chmod g+s /project/data
Setting the group owner to developers grants group access, and the setgid bit (g+s) forces new files and subdirectories to inherit the developers group rather than the creator's primary group, meeting the automatic group-ownership requirement.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full User and Group Management explanation →

An administrator wants to add user 'bob' to the supplementary group 'docker' without removing bob from any existing groups. Which command accomplishes this?

Trap 1: usermod -g docker bob

-g changes the primary group, not supplementary.

Trap 2: usermod -G docker bob

-G without -a replaces all supplementary groups with only docker, removing bob from any other groups.

Trap 3: usermod -G docker bob

Same as B; no -a flag.

Study all User and Group Management common traps →

A
usermod -g docker bob
Why it fails: -g changes the primary group, not supplementary.
B
usermod -aG docker bob
`usermod -aG docker bob` appends the docker group to bob's existing supplementary group list, satisfying the stem's constraint of preserving current memberships. Without `-a`, `usermod -G` would overwrite all supplementary groups, stripping bob from every other group. The `-G` flag targets supplementary groups specifically, leaving the primary group untouched.
C
usermod -G docker bob
Why it fails: -G without -a replaces all supplementary groups with only docker, removing bob from any other groups.
D
usermod -G docker bob
Why it fails: Same as B; no -a flag.

Full breakdown with real-world context →

Question 8mediummulti select

Read the full User and Group Management explanation →

Which TWO commands can be used to display the groups to which the current user belongs? (Select exactly two.)

Trap 1: cat /etc/group

Lists all groups, not just those of the current user.

Trap 2: groupmems -l

groupmems lists members of a group, not groups of a user.

Trap 3: getent group

Lists all groups from configured sources.

Study all User and Group Management common traps →

A
cat /etc/group
Why it fails: Lists all groups, not just those of the current user.
B
groupmems -l
Why it fails: groupmems lists members of a group, not groups of a user.
C
id
The id command prints the current user's UID, GID and supplementary group memberships, directly satisfying the requirement to display the groups the logged-in user belongs to. It reads identity data without needing a separate group database lookup.
D
getent group
Why it fails: Lists all groups from configured sources.
E
groups
The `groups` command reads the current user's group memberships and prints them directly, satisfying the requirement to display groups for the logged-in user without arguments. It queries the same local account database entries that `id` exposes, making it one of the two valid selections for this scenario.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full User and Group Management explanation →

You are managing a multi-user Linux server used by a development team. The server has a shared directory /data/projects where each project has a subdirectory owned by a project lead. The requirement is that all members of the 'devteam' group need to be able to create files in any project subdirectory, but only the project lead (owner) should be able to delete files. Currently, members of devteam are unable to create files in /data/projects. You check permissions: /data/projects has drwxrwxr-x root:devteam. Each project subdirectory, e.g., /data/projects/proj1, has drwx------ lead1:devteam. The lead1 user is in devteam. What is the most likely reason that devteam members cannot create files in proj1, and what is the correct solution?

Trap 1: The devteam group does not include all members; add each user to…

The group membership is not the issue; the directory permissions are too restrictive.

Trap 2: The parent directory /data/projects lacks execute permission for…

The parent directory already has rwx for group; execute is present (x in rwx).

Trap 3: The sticky bit is not set; set the sticky bit on proj1 to allow…

Sticky bit does not affect ability to create files; it affects deletion of files. The immediate issue is no write access.

Study all User and Group Management common traps →

A
The devteam group does not include all members; add each user to the devteam group.
Why it fails: The group membership is not the issue; the directory permissions are too restrictive.
B
The parent directory /data/projects lacks execute permission for devteam; add execute permission to /data/projects.
Why it fails: The parent directory already has rwx for group; execute is present (x in rwx).
C
The sticky bit is not set; set the sticky bit on proj1 to allow only owners to delete files.
Why it fails: Sticky bit does not affect ability to create files; it affects deletion of files. The immediate issue is no write access.
D
The proj1 directory lacks group write and execute permissions; use chmod g+rwx proj1 and chmod g+s proj1 to allow group members to create files and ensure new files inherit group.
The proj1 directory's mode drwx------ grants no group access, so devteam members cannot traverse or write despite the parent's group permissions. Adding g+rwx restores group write and execute, satisfying the requirement that devteam create files. The setgid bit ensures new files inherit the devteam group, though deletion remains restricted to the owner.

Full breakdown with real-world context →

Question 10easymulti select

Read the full User and Group Management explanation →

An administrator needs to grant a user named 'john' the ability to switch to any other user without a password. Which TWO of the following steps are required to achieve this?

Trap 1: Set the suid bit on /bin/su.

Incorrect: The suid bit is already set on su; it does not bypass the password prompt.

Trap 2: Run 'usermod -L john'.

Incorrect: This locks the account, preventing any login.

Trap 3: Add 'john' to the 'root' group.

Incorrect: Being in the root group does not grant passwordless su.

Study all User and Group Management common traps →

A
Add 'john' to the 'wheel' group and configure /etc/pam.d/su to use pam_wheel.so with the 'trust' option.
Correct: This allows members of the wheel group to su without a password if pam_wheel.so is configured.
B
Add a sudo rule: 'john ALL=(ALL) NOPASSWD: ALL' to /etc/sudoers.
Correct: This allows 'john' to run any command as any user without a password via sudo.
C
Set the suid bit on /bin/su.
Why it fails: Incorrect: The suid bit is already set on su; it does not bypass the password prompt.
D
Run 'usermod -L john'.
Why it fails: Incorrect: This locks the account, preventing any login.
E
Add 'john' to the 'root' group.
Why it fails: Incorrect: Being in the root group does not grant passwordless su.

Full breakdown with real-world context →

Question 11mediummatching

Read the full User and Group Management explanation →

Match each Linux filesystem hierarchy standard (FHS) directory to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Host-specific configuration files

Variable data like logs and databases

Secondary hierarchy for user utilities

Virtual filesystem for process and kernel info

Temporary files

Trap 1: /bin: Contains configuration files

Incorrect — /bin contains essential command binaries, not configuration files. Configuration files are in /etc.

Trap 2: /root: Contains device files

Incorrect — /root is the home directory for the root user. Device files are in /dev.

Trap 3: /opt: Contains temporary files

Incorrect — /opt is for optional add-on software packages. Temporary files are stored in /tmp.

Study all User and Group Management common traps →

A
/boot: Contains the boot loader and kernel images
/boot stores files needed for system startup, such as the Linux kernel and boot loader configuration.
B
/dev: Contains device files representing hardware
/dev contains special files that allow access to hardware devices (e.g., hard drives, terminals).
C
/etc: Contains system configuration files
/etc holds host-specific configuration files for system and application settings.
D
/home: Contains user home directories
/home stores personal files and settings for each user on the system.
E
/var: Contains variable data like logs and spools
/var holds data that changes frequently, such as log files, mail queues, and print spools.
F
/bin: Contains configuration files
Why it fails: Incorrect — /bin contains essential command binaries, not configuration files. Configuration files are in /etc.
G
/root: Contains device files
Why it fails: Incorrect — /root is the home directory for the root user. Device files are in /dev.
H
/opt: Contains temporary files
Why it fails: Incorrect — /opt is for optional add-on software packages. Temporary files are stored in /tmp.

Full breakdown with real-world context →

Question 12mediummatching

Read the full User and Group Management explanation →

Match each logical volume management (LVM) term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

A disk or partition used by LVM

Pool of physical volumes

Virtual block device created from a volume group

Smallest allocatable unit in a physical volume

Maps to a physical extent in a logical volume

Trap 1: Physical Volume: A virtual block device created from a volume group.

Incorrect — this describes a Logical Volume, not a Physical Volume.

Trap 2: Volume Group: The smallest unit of storage in a physical volume.

Incorrect — this describes a Physical Extent, not a Volume Group.

Study all User and Group Management common traps →

A
Physical Volume: A physical disk or partition used by LVM.
A Physical Volume is the underlying block device (e.g., disk or partition) that LVM uses as raw storage.
B
Volume Group: A pool of storage that consists of one or more physical volumes.
A Volume Group aggregates multiple Physical Volumes into a single storage pool.
C
Logical Volume: A virtual block device created from a volume group.
A Logical Volume is a flexible, resizable virtual disk carved out of a Volume Group.
D
Physical Extent: The smallest unit of storage in a physical volume.
Physical Extents are fixed-size chunks (typically 4 MiB) that compose a Physical Volume.
E
Physical Volume: A virtual block device created from a volume group.
Why it fails: Incorrect — this describes a Logical Volume, not a Physical Volume.
F
Volume Group: The smallest unit of storage in a physical volume.
Why it fails: Incorrect — this describes a Physical Extent, not a Volume Group.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full User and Group Management explanation →

A system administrator needs to create a user account for a temporary contractor. The account should have a home directory under /home/contractors, the login shell should be /bin/bash, and the user should be a member of the 'contractors' group. Which command accomplishes this?

Trap 1: useradd -m -d /home/contractors/tempuser -s /bin/bash -G…

-G adds supplementary groups, not primary group; the primary group would default.

Trap 2: useradd -m -h /home/contractors/tempuser -s /bin/bash -g…

-h is not a valid useradd option; it is used with userdel.

Trap 3: useradd -m -d /home/contractors/tempuser -s /bin/bash -p…

-p sets password (usually encrypted), not group.

Study all User and Group Management common traps →

A
useradd -m -d /home/contractors/tempuser -s /bin/bash -G contractors tempuser
Why it fails: -G adds supplementary groups, not primary group; the primary group would default.
B
useradd -m -h /home/contractors/tempuser -s /bin/bash -g contractors tempuser
Why it fails: -h is not a valid useradd option; it is used with userdel.
C
useradd -m -d /home/contractors/tempuser -s /bin/bash -p contractors tempuser
Why it fails: -p sets password (usually encrypted), not group.
D
useradd -m -d /home/contractors/tempuser -s /bin/bash -g contractors tempuser
The `-d` flag sets the home directory to /home/contractors/tempuser, satisfying the required location, while `-m` creates it. `-s /bin/bash` assigns the login shell and `-g contractors` sets the primary group, meeting every constraint in the stem.

Full breakdown with real-world context →

Question 14easymultiple choice

Read the full User and Group Management explanation →

An administrator needs to create a system user that runs a service (no login, no home directory). Which command is appropriate?

Trap 1: useradd -r myservice

-r creates system user but without -M, it may create home if default settings allow.

Trap 2: useradd -r -m myservice

-m forces home directory creation, inappropriate for service account.

Trap 3: useradd -M myservice

-M no home, but not system user (UID >= 1000).

Study all User and Group Management common traps →

A
useradd -r myservice
Why it fails: -r creates system user but without -M, it may create home if default settings allow.
B
useradd -r -m myservice
Why it fails: -m forces home directory creation, inappropriate for service account.
C
useradd -r -M myservice
-r system user, -M no home directory. Perfect for service account.
D
useradd -M myservice
Why it fails: -M no home, but not system user (UID >= 1000).

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full User and Group Management explanation →

A user reports that they cannot log in via SSH. The system administrator checks that the account is not locked, the password is correct, and the shell is valid. However, the user's home directory is owned by root instead of the user. What is the most likely cause of the login failure?

Trap 1: The user's login shell is not listed in /etc/shells

This error typically shows 'shell not in /etc/shells' during login attempt.

Trap 2: The /etc/nologin file exists

/etc/nologin prevents all non-root logins; would affect all users.

Trap 3: The user's entry in /etc/shadow is corrupted

Corrupted shadow would cause password authentication failure, not ownership issue.

Study all User and Group Management common traps →

A
The home directory ownership is incorrect, causing SSH PAM session module to reject login
pam_umask or pam_limits may check ownership; many systems require home owned by user.
B
The user's login shell is not listed in /etc/shells
Why it fails: This error typically shows 'shell not in /etc/shells' during login attempt.
C
The /etc/nologin file exists
Why it fails: /etc/nologin prevents all non-root logins; would affect all users.
D
The user's entry in /etc/shadow is corrupted
Why it fails: Corrupted shadow would cause password authentication failure, not ownership issue.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full User and Group Management explanation →

A team of developers must share files under /opt/project. All developers are members of the 'devteam' group. New files must be automatically assigned to group 'devteam' and be writable by the group. Which umask and setgid configuration should be applied?

Trap 1: Set setgid bit on /opt/project and set umask to 007

This option sets the setgid bit correctly but uses umask 007. With umask 007, new files get permissions 660 and directories 770, which do include group write. However, it also removes all permissions for others (---). While this meets the requirement for group write, it is more restrictive than necessary. The key misconception is that umask 007 denies group write—it does not. The standard solution is umask 002 to allow others read/execute permissions.

Trap 2: Set the sticky bit on /opt/project and umask to 022

Sticky bit affects deletion, not group inheritance; umask 022 gives group read only.

Trap 3: Set umask for developers to 002 only

Without setgid, new files may be owned by the user's primary group, not 'devteam'.

Study all User and Group Management common traps →

A
Set setgid bit on /opt/project and set umask to 007
Why it fails: This option sets the setgid bit correctly but uses umask 007. With umask 007, new files get permissions 660 and directories 770, which do include group write. However, it also removes all permissions for others (---). While this meets the requirement for group write, it is more restrictive than necessary. The key misconception is that umask 007 denies group write—it does not. The standard solution is umask 002 to allow others read/execute permissions.
B
Set the sticky bit on /opt/project and umask to 022
Why it fails: Sticky bit affects deletion, not group inheritance; umask 022 gives group read only.
C
Set umask for developers to 002 only
Why it fails: Without setgid, new files may be owned by the user's primary group, not 'devteam'.
D
Set setgid bit on /opt/project and set umask for developers to 002
The setgid bit forces new files under /opt/project to inherit the devteam group, while umask 002 grants group write and read. Together they satisfy both constraints: automatic group assignment and group writability for all developers.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full User and Group Management explanation →

An administrator wants to temporarily disable a user account without deleting it. The account should be locked, expire immediately, and the user should not be able to log in. Which single command accomplishes this with minimum side effects?

Trap 1: usermod -L user1; chage -E 0 user1

chage -E 0 sets expiration to epoch; but -L alone locks; this works but is two commands.

Trap 2: usermod -L user1

Locks password but account may still be accessible via SSH keys or other methods.

Trap 3: usermod -e 1970-01-01 user1

Only expires account; password not locked, so if password not expired, login possible?

Study all User and Group Management common traps →

A
usermod -L user1; chage -E 0 user1
Why it fails: chage -E 0 sets expiration to epoch; but -L alone locks; this works but is two commands.
B
usermod -L -e 1970-01-01 user1
usermod -L prepends an exclamation mark to the password hash in /etc/shadow, blocking password logins, while -e 1970-01-01 sets the account expiry date in the past, disabling all authentication including SSH keys. No files or home directory are removed, minimising side effects.
C
usermod -L user1
Why it fails: Locks password but account may still be accessible via SSH keys or other methods.
D
usermod -e 1970-01-01 user1
Why it fails: Only expires account; password not locked, so if password not expired, login possible?

Full breakdown with real-world context →

Question 18mediummulti select

Read the full User and Group Management explanation →

Which TWO commands can change a user's primary group?

Trap 1: groupdel groupname

Deletes a group entirely; does not change a user's primary group.

Trap 2: usermod -G groupname username

-G sets supplementary groups, not primary.

Trap 3: useradd -g groupname username

Creates a new user with specified primary group; does not change existing user's primary group.

Study all User and Group Management common traps →

A
groupdel groupname
Why it fails: Deletes a group entirely; does not change a user's primary group.
B
groupmod -g newGID groupname
Changing a group's GID updates the GID in /etc/passwd for users whose primary group is that group.
C
usermod -g groupname username
`usermod -g` directly reassigns the user's primary group (GID) in `/etc/passwd`, satisfying the requirement to change the primary group rather than a supplementary one. It accepts either a group name or numeric GID, and the change takes effect for subsequent logins and file creation.
D
usermod -G groupname username
Why it fails: -G sets supplementary groups, not primary.
E
useradd -g groupname username
Why it fails: Creates a new user with specified primary group; does not change existing user's primary group.

Full breakdown with real-world context →

Question 19mediummulti select

Read the full User and Group Management explanation →

Which TWO options in /etc/shadow are correctly described?

Trap 1: The password expiration date is stored in the third field

Third field is days since last change, not the expiration date itself.

Trap 2: The account expiration date is the sixth field

Field 6 is the warning period, not expiration date.

Trap 3: The number of days since Jan 1, 1970 until the account expires is…

Account expiration (field 8) is days since epoch; field 7 is inactivity period.

Study all User and Group Management common traps →

A
The password expiration date is stored in the third field
Why it fails: Third field is days since last change, not the expiration date itself.
B
The minimum number of days between password changes is the fourth field
The fourth colon-separated field in /etc/shadow stores the minimum password age, so this description is accurate. It satisfies the stem's requirement for a correctly described field by naming the right position and meaning, matching the shadow file's documented layout.
C
The account expiration date is the sixth field
Why it fails: Field 6 is the warning period, not expiration date.
D
The number of days since Jan 1, 1970 until the account expires is stored in the seventh field
Why it fails: Account expiration (field 8) is days since epoch; field 7 is inactivity period.
E
The maximum number of days a password is valid is the fifth field
The fifth colon-separated field in /etc/shadow, `PASS_MAX_DAYS`, sets the maximum number of days a password remains valid before the system forces a change. This directly satisfies the stem's requirement to identify correctly described fields, since the count runs from the login name as field one.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full User and Group Management explanation →

Refer to the exhibit. User 'alice' cannot log in. What is the most likely problem?

Exhibit

Refer to the exhibit:

$ cat /etc/passwd | grep alice
alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash

$ ls -ld /home/alice
drwxr-x--- 2 root root 4096 Jan 10 10:00 /home/alice

Trap 1: The shadow file is missing alice's entry

The 'x' in passwd indicates shadow entry exists; otherwise it would be blank or other.

Trap 2: The user's UID or GID is not unique

Uniqueness is not a direct cause of login failure.

Trap 3: The login shell /bin/bash does not exist

The shell exists (common).

Study all User and Group Management common traps →

A
The shadow file is missing alice's entry
Why it fails: The 'x' in passwd indicates shadow entry exists; otherwise it would be blank or other.
B
The user's UID or GID is not unique
Why it fails: Uniqueness is not a direct cause of login failure.
C
The home directory ownership is incorrect
Home directory should be owned by alice:alice, not root:root.
D
The login shell /bin/bash does not exist
Why it fails: The shell exists (common).

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused User and Group Management sessions

Start a User and Group Management only practice session

Every question in these sessions is drawn from the User and Group Management domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all User and Group Management questions →Mixed LFCS session

Frequently asked questions

What does the LFCS exam test about User and Group Management?: You must be able to create, modify and delete users and groups, set password aging with chage or passwd, and control login defaults like umask. The key skill is knowing which file or command flag actually takes effect last for a given user.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just User and Group Management questions in a focused session?: Yes — the session launcher on this page draws every question from the User and Group Management domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other LFCS topics?: Use the topic links above to move to related areas, or go back to the LFCS question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the LFCS exam covers. They are not copied from any real exam or dump site.

User and Group Management only

10 questions 20 questions 30 questions 50 questions

Mixed LFCS session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All LFCS questions User and Group Management domain overview LFCS exam guide

Exam traps to avoid

▸Using userdel without -r leaves the home directory and mail spool behind, failing the requirement to remove them.
▸Editing /etc/profile for umask when a later-read per-user file such as ~/.bashrc overrides it, so the value stays 022.
▸Setting expiry with usermod -e (account expiry) instead of chage/passwd -e, which controls password expiry, not the account.

User and Group Management practice questions

What to know about User and Group Management

Common User and Group Management exam traps

User and Group Management questions

A developer was removed from the 'developers' group but still needs to run commands that require membership in that group. The user has logged out and back in, but the issue persists. What is the most likely cause?

A system administrator needs to create a user 'john' with a home directory in /data/users and an expiry date of 2025-12-31. Which command accomplishes this?

A user 'alice' is unable to log in via SSH. The administrator checks /etc/shadow and sees 'alice:!:19234:0:99999:7:::'. What does the '!' in the password field indicate?

A system administrator needs to ensure that all users in the 'developers' group have read and write access to a shared project directory /project/data, but new files created in that directory should belong to the 'developers' group automatically. Which command sequence achieves this goal?

An administrator wants to add user 'bob' to the supplementary group 'docker' without removing bob from any existing groups. Which command accomplishes this?

Which TWO commands can be used to display the groups to which the current user belongs? (Select exactly two.)

An administrator needs to grant a user named 'john' the ability to switch to any other user without a password. Which TWO of the following steps are required to achieve this?

Match each Linux filesystem hierarchy standard (FHS) directory to its purpose.

Match each logical volume management (LVM) term to its definition.

A system administrator needs to create a user account for a temporary contractor. The account should have a home directory under /home/contractors, the login shell should be /bin/bash, and the user should be a member of the 'contractors' group. Which command accomplishes this?

An administrator needs to create a system user that runs a service (no login, no home directory). Which command is appropriate?

A user reports that they cannot log in via SSH. The system administrator checks that the account is not locked, the password is correct, and the shell is valid. However, the user's home directory is owned by root instead of the user. What is the most likely cause of the login failure?

A team of developers must share files under /opt/project. All developers are members of the 'devteam' group. New files must be automatically assigned to group 'devteam' and be writable by the group. Which umask and setgid configuration should be applied?

An administrator wants to temporarily disable a user account without deleting it. The account should be locked, expire immediately, and the user should not be able to log in. Which single command accomplishes this with minimum side effects?

Which TWO commands can change a user's primary group?

Which TWO options in /etc/shadow are correctly described?

Refer to the exhibit. User 'alice' cannot log in. What is the most likely problem?

Exhibit

Track your progress over time

Start a User and Group Management only practice session

Related LFCS topic practice pages