EX200 Manage users and groups Practice Question
A Red Hat Enterprise Linux 9 system enforces a security policy that user accounts must be disabled after 90 days of inactivity. The system administrator has configured /etc/shadow accordingly with the proper fields. User 'bob' has been on leave for 95 days. When bob returns and tries to log in, he is unable to do so. The administrator checks the shadow file and sees that bob's password expiration date has passed and the account is locked due to inactivity (the inactivity period has exceeded). The administrator wants to immediately reactivate bob's account without changing the password, and also wants to set the account to expire in 30 days from now (relative to the current date). Which set of commands should the administrator run to achieve this goal?
⚠ Common exam trap
Test-takers frequently confuse password lock (`passwd -l`/`passwd -u`) with inactivity lock (`chage -I`), and assume `passwd -u` can reactivate an account disabled by inactivity, when in fact only `chage -I` or modifying the INACTIVE field in `/etc/shadow` can do that.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
chage -E $(date -d +30days +%Y-%m-%d) bob; chage -I -1 bob
`chage -E $(date -d +30days +%Y-%m-%d) bob` sets the account expiration date to 30 days from now, and `chage -I -1 bob` disables the inactivity period (sets it to -1, meaning no inactivity lockout), which immediately reactivates the account without changing the password. This directly addresses the requirement to unlock the account (which was locked due to exceeding the inactivity period) and set a new expiration date.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
chage -E $(date -d +30days +%Y-%m-%d) bob; chage -I -1 bob
Why this is correct
This combination is correct because chage -E $(date -d +30days +%Y-%m-%d) bob dynamically sets the account expiration date to exactly 30 days from today, while chage -I -1 bob sets the inactivity period to -1, which disables the automatic locking of an account whose password has expired. This directly clears the lockout caused by exceeding the inactivity threshold, so Bob's account can be used again for the next 30 days. It addresses both the expired expiration date and the inactivity-based lock.
- ✗
usermod -e 2024-12-31 bob; passwd -S bob
Why it's wrong here
usermod -e 2024-12-31 bob assigns a fixed calendar date rather than a date relative to the current day, so it does not guarantee the required 30-day window; if today's date is past that date, the account is immediately expired. passwd -S bob merely reports the password status (for example, PS, LK, NP) and does not change any field in /etc/shadow, so it cannot unlock the account or reset its expiration. The password status may still show locked even after the first command.
- ✗
chage -d 0 bob; usermod -L bob
Why it's wrong here
chage -d 0 bob forces Bob to change his password at the next login by setting the last password change date to epoch, but this does not touch the account expiration or inactivity lock that caused the account to be disabled. usermod -L bob then explicitly locks the account by prepending '!' to the encrypted password hash in /etc/shadow, which is the opposite of reactivating it. The two commands together make the account more inaccessible, not less.
- ✗
usermod -e $(date -d +30days +%Y-%m-%d) bob; passwd -u bob
Why it's wrong here
While usermod -e $(date -d +30days +%Y-%m-%d) bob does correctly extend the account expiration to 30 days from now using shell command substitution, the second command fails to address the inactivity lock: passwd -u bob only removes the '!' or '!!' prefix from the password hash in /etc/shadow, essentially unlocking the password, but it does not reset the number of inactive days tracked by chage -I. As a result, the account still remains disabled under the inactivity policy, and Bob still cannot log in. This answer is incomplete because it only handles password locking, not expiration/inactivity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every EX200 question from scratch — 127 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.