LPIC-1 Administrative Tasks Practice Question
A company security policy requires that user accounts be disabled after 90 days of inactivity. The system administrator locks user accounts using 'usermod -L username'. However, users with SSH key authentication can still log in. The administrator has verified that the locked flag is set in /etc/shadow. Which of the following is the most likely explanation?
⚠ Common exam trap
Many candidates assume 'locking' an account with `usermod -L` disables all login methods, but it only affects password-based authentication, not SSH key-based or other non-password mechanisms.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The usermod -L command only locks password-based login, not SSH key login.
The `usermod -L` command locks a user account by placing a '!' in the password hash field of /etc/shadow, which only prevents authentication via password-based methods (e.g., PAM's pam_unix). SSH key authentication uses the SSH protocol's public-key challenge-response, which is handled by the SSH daemon (sshd) and does not consult the locked password field in /etc/shadow. Therefore, users with valid SSH keys in ~/.ssh/authorized_keys can still log in despite the account being locked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The administrator forgot to restart the SSH service after locking accounts.
Why it's wrong here
Restarting SSH would not change the behavior; key authentication is still allowed.
- ✗
The SSH daemon is configured to allow passwordless login for locked accounts.
Why it's wrong here
SSH does not have a specific setting for locked accounts; key authentication bypasses the lock.
- ✓
The usermod -L command only locks password-based login, not SSH key login.
Why this is correct
usermod -L sets an '!' in the password field, which prevents password authentication but not SSH key authentication.
- ✗
The users have valid SSH keys in their ~/.ssh/authorized_keys, and SSH does not check the account lock status.
Why it's wrong here
While SSH does not check the lock flag, the correct answer is that usermod -L only affects password auth.
Go deeper
Related to this question
About these practice questions
This LPIC-1 question is part of Courseiva's 527-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.