EX200 Manage users and groups Practice Question
A server has a requirement that all users in the 'finance' group must have a password aging policy that forces password change every 90 days. Which approach best achieves this for existing users?
⚠ Common exam trap
Watch out — candidates often confuse `/etc/login.defs` as applying to all users (including existing ones), when in fact it only sets defaults for new user creation via `useradd`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Write a script to run 'chage -M 90' for each user in the finance group
`chage -M 90` sets the maximum password age for a specific user, and by scripting it to apply to all members of the 'finance' group, you directly enforce the 90-day policy on existing users. This approach works regardless of the default settings in `/etc/login.defs`, which only affect new users, and avoids the manual and error-prone editing of `/etc/shadow`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set PASS_MAX_DAYS 90 in /etc/login.defs
Why it's wrong here
Setting PASS_MAX_DAYS in /etc/login.defs only establishes a default value applied at the moment a new user account is created by useradd; existing accounts already have their password aging values stored in /etc/shadow, so they remain unchanged. Moreover, this global default cannot target only members of the finance group — every future account on the system would receive the 90-day policy, not just the intended group.
- ✗
Edit /etc/shadow and change the fifth field for all users
Why it's wrong here
Manually editing the fifth field of /etc/shadow would require parsing and rewriting the file for every user, which risks syntax errors, accidental lockouts, and incorrect field placement. Even if done correctly, it blindly changes the maximum password age for all users system-wide rather than isolating the finance group, and it bypasses the supported chage or usermod interfaces that are designed to safely update these timestamp-based fields.
- ✗
Configure pam_pwquality.so to enforce password age
Why it's wrong here
pam_pwquality.so is a PAM module that enforces password strength and complexity rules — such as minimum length, character classes, and dictionary checks — during password changes. It does not read or modify any /etc/shadow aging fields, so it cannot set or enforce a 90-day maximum age for finance users; password aging is handled separately by pam_unix.so and the shadow file's day-count fields.
- ✓
Write a script to run 'chage -M 90' for each user in the finance group
Why this is correct
A script that calls chage -M 90 for each user in the finance group is the correct approach because chage directly updates the maximum password age field in /etc/shadow for existing user accounts. For example, you can iterate over `getent group finance | cut -d: -f4`, and run chage for each member, which precisely targets the intended accounts and leaves all other users untouched.
Go deeper
Related to this question
About these practice questions
One of 127 original EX200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.