The answer is to set a default ACL with `setfacl -d -m g:developers:rwx /projects`. This command works because default ACLs enforce inheritance rules on newly created files and directories, overriding the creating user’s umask and primary group. While the setgid bit on /projects changes the group ownership of new files to 'developers', it does not guarantee group-writable permissions if the user’s umask is restrictive (e.g., 022 producing 644). The default ACL explicitly grants `rwx` to the developers group, ensuring every new file gets 664 permissions and the correct group. On the Red Hat Certified System Administrator EX200 exam, this tests your understanding of ACL inheritance versus setgid behavior—a common trap is assuming setgid alone handles permissions. Remember the memory tip: “setgid for group, default ACL for permissions.”
EX200 Manage users and groups Practice Question
This EX200 practice question tests your understanding of manage users and groups. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are managing a Red Hat Enterprise Linux 8 server that hosts a shared development environment. The server has a directory /projects owned by root:developers with permissions 2770. There are three users: dev1, dev2, and dev3, all members of the 'developers' group. Developers need to create and edit files in /projects, and any new file should be writable by all members of the developers group. However, you notice that when dev1 creates a file, the permissions are 644 instead of 664, and the group is set to dev1's primary group (dev1) instead of 'developers'. After investigating, you find that the setgid bit is set on /projects, but the directory's ACLs are not configured. What is the most efficient way to ensure that new files in /projects inherit the group 'developers' and have group-writable permissions by default?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "primary"
Why it matters: Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set a default ACL with setfacl -d -m g:developers:rwx /projects
Option A is correct because setting a default ACL on the /projects directory with `setfacl -d -m g:developers:rwx /projects` ensures that any new file or subdirectory created inside /projects automatically inherits the 'developers' group with rwx permissions. This overrides the creating user's umask and primary group, guaranteeing group-writable files (664) and the correct group ownership, which the setgid bit alone cannot achieve for group permissions when the user's umask is restrictive.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Set a default ACL with setfacl -d -m g:developers:rwx /projects
Why this is correct
Default ACLs ensure that new files inherit the specified permissions, overriding umask for group.
Clue confirmation
The clue word "primary" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Reapply the setgid bit using chmod g+s /projects
Why it's wrong here
The setgid bit is already set; reapplying does not fix the umask issue.
✗
Change dev1's umask to 0002 in /etc/bashrc
Why it's wrong here
This would affect all files created by dev1 system-wide, not just in /projects, and is not directory-specific.
✗
Set the sticky bit on /projects with chmod o+t /projects
Why it's wrong here
The sticky bit prevents users from deleting others' files, but does not affect permissions or group inheritance.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume the setgid bit alone is sufficient to enforce group-writable permissions, but they overlook that the umask of the creating user still restricts the file's group permissions, making default ACLs necessary to guarantee group-write access.
Detailed technical explanation
How to think about this question
Default ACLs work by storing an ACL entry in the directory's extended attributes that is applied as a mask to new files' permissions, effectively combining with the setgid bit to enforce both group ownership and group-writable permissions. The ACL mask is calculated from the maximum permissions allowed by the default ACL entries, and for files, the create mode is ANDed with the mask, so a default ACL of rwx results in rw- for files (since execute is not typically set on new files). In real-world shared development environments, this approach is preferred over umask changes because it is directory-specific and does not require modifying user profiles or shell configurations.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Manage users and groups — This question tests Manage users and groups — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Set a default ACL with setfacl -d -m g:developers:rwx /projects — Option A is correct because setting a default ACL on the /projects directory with `setfacl -d -m g:developers:rwx /projects` ensures that any new file or subdirectory created inside /projects automatically inherits the 'developers' group with rwx permissions. This overrides the creating user's umask and primary group, guaranteeing group-writable files (664) and the correct group ownership, which the setgid bit alone cannot achieve for group permissions when the user's umask is restrictive.
What should I do if I get this EX200 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "primary". Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.