EX200 Manage users and groups Practice Question
Exhibit
# useradd -D GROUP=100 HOME=/home INACTIVE=-1 EXPIRE= SHELL=/bin/bash SKEL=/etc/skel CREATE_MAIL_SPOOL=yes
Refer to the exhibit. What effect does the value INACTIVE=-1 have on newly created user accounts?
⚠ Common exam trap
Red Hat often tests the distinction between password expiration (`PASS_MAX_DAYS`) and the inactivity period (`INACTIVE`), trapping candidates who confuse the two or misinterpret -1 as 'immediate' rather than 'disabled'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The password inactivity period is disabled.
The `INACTIVE=-1` setting in the `useradd -D` or `/etc/default/useradd` configuration disables the password inactivity period. This means that after a password expires, the account will not be locked due to inactivity, effectively turning off the inactivity timer. The value -1 is a special sentinel that indicates no inactivity period is enforced.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The account expires immediately.
Why it's wrong here
The INACTIVE parameter does not control account expiration; it controls the grace period between password expiration and account lockout. The value -1 simply disables that grace period, so the account cannot be locked due to inactivity after the password expires. A true immediate account expiration is set by the EXPIRE field (or `chage -E`), which is a completely separate attribute.
- ✗
Passwords never expire.
Why it's wrong here
Password expiration is governed by PASS_MAX_DAYS in /etc/login.defs or by the sp_max field in the shadow file, not by INACTIVE. Setting INACTIVE to -1 only disables the inactivity lock that would otherwise occur after the password has expired. The password itself still expires at its configured maximum age, and the user will be prompted to change it at the next login.
- ✗
Account is disabled if password expires but user does not log in within -1 days (immediately).
Why it's wrong here
INACTIVE=-1 is a special sentinel meaning 'no inactivity period', not a literal countdown of -1 days. If it were interpreted as a number, a negative value would be meaningless, and the shadow documentation explicitly defines -1 as disabling the inactivity feature. Positive values (e.g., 7) would disable the account seven days after password expiry if no login occurs, but -1 causes no such lockout to ever be applied.
- ✓
The password inactivity period is disabled.
Why this is correct
When INACTIVE is set to -1, the password inactivity period is disabled entirely. After a user's password expires, the account will not be automatically locked due to the user failing to log in within a set number of days. The user remains able to log in and is typically forced to change the expired password, provided other account expiration policies such as EXPIRE are not also set.
Go deeper
Related to this question
About these practice questions
One of 127 original EX200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.