LPIC-1 Administrative Tasks Practice Question
An administrator adds the line 'DenyUsers john' to /etc/ssh/sshd_config and restarts the SSH service. What is the effect?
⚠ Common exam trap
Test-takers frequently confuse 'DenyUsers' with broader access restrictions like PAM-based account denial or shell-level bans, but 'DenyUsers' is SSH-specific and only affects SSH logins, not console or other remote access methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User john cannot log in via SSH.
The 'DenyUsers' directive in /etc/ssh/sshd_config explicitly blocks the specified user(s) from authenticating via SSH. When the SSH service is restarted, the configuration is reloaded, and user 'john' will be denied SSH login attempts at the authentication layer, before any shell or command execution occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
User john cannot log in via SSH.
Why this is correct
DenyUsers in /etc/ssh/sshd_config blocks the named account from authenticating over SSH; after the service restart, john's connection attempts are refused. The directive is enforced by sshd itself, so it does not disable the local account or affect console logins.
- ✗
User john can still log in but his commands are logged.
Why it's wrong here
DenyUsers rejects authentication outright, so john's SSH sessions fail before any command runs; no logging-only mode exists in sshd_config. It is tempting because logging sounds like a plausible middle ground, and would fit if the requirement were auditing a permitted user's activity rather than blocking access.
- ✗
User john is denied all shell access, including local and console logins.
Why it's wrong here
DenyUsers is evaluated by sshd during SSH authentication only, so it cannot affect local console or TTY logins, which bypass sshd entirely. It is tempting because 'deny' suggests blanket account blocking, and would be right if the goal were disabling the account system-wide, which requires passwd or usermod instead.
- ✗
All users except john cannot log in via SSH.
Why it's wrong here
DenyUsers john blocks only john's SSH logins; every other user authenticates normally, so the option inverts the directive's meaning. It is tempting because a deny list can be misread as an allow list, and it would be correct if the line were AllowUsers john, which restricts SSH access to john alone.
Go deeper
Related to this question
About these practice questions
This LPIC-1 question is part of Courseiva's 402-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.