EX200 Manage users and groups Practice Question
A system administrator needs to ensure that a user named 'bob' can access a shared directory '/data' owned by group 'developers'. The directory has permissions 2775 and is owned by root:developers. Bob is a member of the 'developers' group. However, when Bob tries to create a file in '/data', it fails with 'Permission denied'. What is the most likely cause?
⚠ Common exam trap
Red Hat often tests the misconception that group membership alone guarantees access, ignoring that SELinux can block operations even when Unix permissions are correct; the trap here is that candidates focus on umask or primary group instead of recognizing SELinux as the likely cause when permissions and group membership appear correct.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The directory has incorrect SELinux context
The directory '/data' has permissions 2775, which grants read, write, and execute to the group 'developers'. Bob is a member of 'developers', so standard Unix permissions should allow him to create files. However, the failure with 'Permission denied' despite correct group membership and permissions strongly indicates that SELinux is enforcing a policy that denies Bob write access. The most likely cause is that the directory lacks the correct SELinux context (e.g., `default_t` instead of a type like `public_content_rw_t` or a context that allows write operations).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The directory has incorrect SELinux context
Why this is correct
Even when the directory's mode and ownership (2775, root:developers) grant Bob write access, SELinux performs a separate mandatory access control check. If /data carries a context type that Bob's domain is not allowed to write to (for example, default_t instead of a type like public_content_rw_t or a domain-specific type), the kernel denies the operation with EACCES. This appears as a permission problem though standard permissions are correct. To fix, restore or apply the correct context, e.g., restorecon -Rv /data or a custom semanage fcontext rule.
- ✗
Bob's umask is set to 0077
Why it's wrong here
Bob's umask only controls the permission bits requested when he creates a new file, it does not gate the creation itself. Even with umask 0077, Bob can create a file in a directory where he has write and execute access; the umask merely strips group/other permissions from the default mode (e.g., 0666 & ~0077 = 0600). Since the directory /data grants write access via group permissions, umask does not prevent the file from being created. So a restrictive umask would affect the final mode of the file, not whether Bob can create it.
- ✗
The setgid bit is not set
Why it's wrong here
The premise that the setgid bit is not set is factually incorrect: 2775 contains the setgid bit (2) in the special permission digit. Moreover, setgid affects what group owns newly created files and directories inside the parent directory, not whether creation is allowed. Even without setgid, Bob could still create files as long as he has write permission on the directory (e.g., by being in the owning group or via other write bits). Therefore this option cannot be the cause of Bob's failure.
- ✗
Bob's primary group is not developers
Why it's wrong here
Bob's primary group is irrelevant in this scenario because the setgid bit on /data causes new files and directories to inherit the directory's group (developers), not Bob's primary group. As long as Bob is a member of the developers group and the group has write permission, he can create files regardless of his primary group. If the primary group mattered, it would be the group check in the directory's DAC permissions, but the setgid behavior overrides that for new files. Thus this does not explain a denial.
Go deeper
Related to this question
About these practice questions
This EX200 question is part of Courseiva's 127-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.