EX200 Essential Tools Practice Question

Exhibit

Refer to the exhibit.

$ cat /etc/passwd | head -3
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin

Refer to the exhibit. Why does the 'bin' user have /sbin/nologin as its shell?

⚠ Common exam trap

Red Hat often tests the distinction between a locked account (password disabled) and a non-interactive shell (shell set to /sbin/nologin), leading candidates to confuse the two mechanisms for restricting access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user is a system account that should not log in interactively.

The /sbin/nologin shell is explicitly assigned to system accounts like 'bin' to prevent interactive logins. This shell prints a message and exits, ensuring that the account can only be used for non-interactive system processes, such as owning files or running daemons, without providing a login session.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user's home directory is missing.
Why it's wrong here
A missing home directory does not cause the shell field to become /sbin/nologin. The home directory field (6th field in /etc/passwd) merely defines $HOME and the starting directory after login; if absent, the system may issue a warning and use '/' as the home directory. The shell field (7th field) independently determines what program is executed after authentication, and that is what displays /sbin/nologin here. Therefore, an absent home directory cannot produce this output.
✓
The user is a system account that should not log in interactively.
Why this is correct
The bin user is a system account (UID typically below 1000) created for running services and binaries rather than for human interactive use. Its login shell is deliberately set to /sbin/nologin in /etc/passwd, which causes any login attempt to print a message and exit immediately. This is a standard security precaution: system accounts should never provide an interactive shell, but they may still be used for non-interactive tasks like cron jobs or service startup. The exhibit shows nologin precisely because this account is not meant for shell access.
✗
The user is locked.
Why it's wrong here
A locked account is a distinct concept from a nologin shell. Locking is usually implemented by placing '!' or '*' at the beginning of the password hash in /etc/shadow, which makes password authentication always fail; it does not change the shell field. An account can be locked while still having /bin/bash, or unlocked while still having /sbin/nologin. The exhibit only shows /sbin/nologin, with no indication of an altered password hash, so this is not evidence that the account is locked.
✗
The shell is not installed.
Why it's wrong here
/sbin/nologin is a real, installed executable provided by the util-linux or shadow-utils package, and it is commonly used as the shell for system accounts. If the shell binary were missing, attempts to log in would fail with a 'shell not found' error, and the passwd file would not display a valid shell name. The exhibit's output reflects an intentional entry in /etc/passwd, not a misconfiguration or absence of the shell file. Therefore, claiming the shell is not installed contradicts the fact that nologin is deliberately set.

Go deeper

EX200 Essential Tools Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question