LPIC-2 chage Practice Question
A system administrator needs to ensure that all users must change their passwords every 90 days and that passwords must be at least 12 characters long. The administrator modifies /etc/login.defs and /etc/pam.d/common-password. Which additional step is required to enforce these settings for existing users?
⚠ Common exam trap
The trap is that candidates assume modifications to /etc/login.defs apply retroactively to existing users, but they only affect new user creations. Therefore, a per-user command like 'chage' is required to enforce the policy on current accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'chage -M 90' for each existing user
Modifying /etc/login.defs sets default password aging parameters for new users, and /etc/pam.d/common-password enforces password length via pam_pwquality. However, these changes do not retroactively apply to existing users. The 'chage -M 90' command modifies the /etc/shadow file directly for each user, setting their maximum password age to 90 days. Option B ('passwd -x 90') is incorrect because it is an incomplete command—'passwd -x' requires a username argument (e.g., 'passwd -x 90 username') and is not the standard tool for bulk policy enforcement. The 'pwconv' command (Option C) synchronizes passwords between /etc/passwd and /etc/shadow, not password aging. Option D ('pwunconv' then 'pwconv') reverts to non-shadow then back to shadow, which would remove existing password ages. Therefore, the correct additional step is to run 'chage -M 90' for each existing user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run 'chage -M 90' for each existing user
Why this is correct
chage modifies password aging for existing users.
- ✗
Run 'passwd -x 90' for each existing user
Why it's wrong here
passwd -x sets max days but requires the username argument; also less efficient than chage.
- ✗
Run 'pwconv' to synchronize password aging
Why it's wrong here
pwconv only converts to shadow, it does not set aging.
- ✗
Run 'pwunconv' then 'pwconv' to update shadow file
Why it's wrong here
This converts shadow passwords but does not set max days.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.