Linux Essentials Security and File Permissions: 156 practice questions

12 of the 156 Security and File Permissions questions in the Certsqill Linux Essentials bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Linux Essentials? Take the free 5-min readiness check →

1. `awk -F: '$3==0{print$1}' /etc/passwd`: Which command satisfies that goal?

1. `id --user --name "$USER"`

   This prints the current user's name rather than searching every `/etc/passwd` record for UID 0.
2. `getent passwd | cut --delimiter=: --fields=1`

   This lists account names from the passwd database but does not filter records by numeric UID.
3. `grep --extended-regexp '^root:' /etc/passwd`

   This searches specifically for the username `root` and can miss another name assigned UID 0.
4. `awk -F: '$3==0{print$1}' /etc/passwd` ✓

   The command tests the third colon-separated field, the UID, and prints the first field for matching records.

The `awk` command selects passwd records whose UID field equals zero.

2. Alice's home directory is requested: Select TWO results of this command.

Select two. More than one option is correct — every correct one is ticked below.

1. Alice's initial password is set to the text `alice`.

   This command does not set a plaintext password; password configuration is separate.
2. Alice's home directory is requested, with skeleton files potentially copied into it. ✓

   The `-m` option requests creation of the home directory; skeleton files are normally copied during that creation.
3. The missing `project` group is created during Alice's account creation.

   `useradd -G` assigns supplementary groups but does not create them; `project` must already exist.
4. Alice is added to `project` as a supplementary group member. ✓

   The `-G project` option requests membership in the existing supplementary group `project`.
5. Alice's login shell is set as her primary group.

   The `-s` option selects the login shell; it does not select any group.

`-m` requests a home directory, while `-G` assigns an existing supplementary group.

3. Owner read/write: What permissions result?

1. Owner read/write; group read/write; others read

   That permission pattern is 664, not 640; the command grants neither group write nor other read.
2. Owner read/write; group read; others no permissions ✓

   Octal 640 assigns owner `rw-`, group `r--`, and other `---` permissions.
3. Owner read/write/execute; group read; others no permissions

   The owner digit 6 represents read and write, not execute; execute would require an additional value of one.
4. Owner read; group read/write; others no permissions

   The first digit applies to the owner, while the second digit applies to the group.

Mode 640 means owner `rw-`, group `r--`, and other `---`.

4. Whether the guest's configured cleanup and retention: Before relying on `/var/tmp`, what must be checked?

1. Whether the guest's filesystem layout keeps both temporary directories separate

   Separate filesystems are not required for the longer-retention convention to apply.
2. Whether the guest's configured cleanup and retention policy allows `/var/tmp` data to survive the reboot ✓

   `/var/tmp` is intended for longer retention than `/tmp`, but local cleanup policies can still remove its contents.
3. Whether the application closes and reopens its temporary files correctly

   Application file handling does not establish whether system cleanup policy will remove the files.
4. Whether the directory has enough free space for the temporary data

   Free space affects whether data can be written, but it does not determine how long the system retains it.

Check the guest's cleanup policy; `/var/tmp` is not guaranteed permanent storage.

5. It commonly runs a service: On a Bash GNU/Linux workstation, which statement best distinguishes a typical syst

1. The username alone proves that an account is a system account.

   Account purpose, configuration, and distribution conventions matter; a name alone is not decisive.
2. It commonly runs a service, not a person. ✓

   System accounts commonly provide identities for services or daemons rather than interactive human use.
3. A human account always receives unrestricted administrator privileges.

   Human users generally have limited permissions unless policy grants additional privileges.
4. Every system account uses one universal numeric UID range.

   UID ranges and cutoff conventions vary among distributions and configurations.

System accounts commonly provide identities for services rather than people.

6. A new group definition named `research` is created: Select TWO statements that follow.

Select two. More than one option is correct — every correct one is ticked below.

1. The current user is automatically added to `research`.

   Creating a group does not automatically change the current user's supplementary or primary memberships.
2. The group receives the same numeric ID as the current user.

   The system selects a group identifier according to its configuration; it is not automatically copied from the current user.
3. A home directory named `/home/research` is created.

   Home directories are associated with user creation, not with the `groupadd` command.
4. A new group definition named `research` is created. ✓

   `groupadd` creates a group definition, subject to the system's next available group identifier and policy.
5. No user account is created by this command. ✓

   `groupadd` manages groups only; creating a login account requires a separate user-management command.

`groupadd` creates a group definition, not a user or membership.

7. Add Bob to the existing `lab` group as a supplementary: Which is the least disruptive valid action?

1. Add Bob to the existing `lab` group as a supplementary member. ✓

   Bob then matches the file's group class and receives its existing group-read permission without changing other classes.
2. Copy `report.txt` into Bob's home directory.

   This creates another copy, risks inconsistent data, and changes more state than necessary for group-based access.
3. Run `chmod o+r report.txt`.

   This grants read access to every other user, exceeding the stated requirement and weakening confidentiality.
4. Change `report.txt` to mode `644`, remove group restrictions, and document the exception for future access.

   This exposes the file to all users, although only Bob needs access through the existing group.

Add Bob to `lab`; the existing group-read bit then grants access without exposing the file to others.

8. Entry removal still requires suitable directory write: Select TWO statements that correctly describe its behav

Select two. More than one option is correct — every correct one is ticked below.

1. Entry removal still requires suitable directory write and search permissions. ✓

   The sticky bit adds an ownership restriction; it does not replace the directory's required write and search permissions.
2. The sticky permission prevents ordinary users from reading files in that directory.

   Sticky-directory rules concern removing and renaming entries, not reading file contents.
3. The sticky permission makes each newly created file private to its creator.

   File privacy depends on the file mode and creation settings, not on the directory sticky bit.
4. Removal or renaming is normally limited to the entry owner, directory owner, or a privileged user. ✓

   The sticky bit restricts who may remove or rename directory entries despite directory write permission.
5. The sticky permission prevents privileged users from removing entries.

   Privileged users can generally override ordinary discretionary permission restrictions, including sticky-directory limits.

Sticky directories restrict removal and renaming, while required directory permissions still apply.

9. getent passwd jordan: Which command prints Jordan's `passwd`-database account record?

1. cat /etc/shadow (reads protected password and aging information).

   `/etc/shadow` contains protected password and aging data, not the requested passwd record.
2. who jordan (checks current login sessions instead of account metadata).

   `who` reports current login sessions and does not retrieve account-database records.
3. id jordan (summarizes Jordan's UID and group identities).

   `id` reports identity and group information rather than printing the complete passwd record.
4. getent passwd jordan ✓

   `getent passwd jordan` queries the configured passwd database for Jordan's record.

`getent passwd jordan` queries the configured passwd database.

10. It targets the account named `sam`: Select TWO statements that correctly interpret this command.

Select two. More than one option is correct — every correct one is ticked below.

1. It targets the account named `sam`. ✓

   The account name following `passwd` identifies the account whose password operation is requested.
2. It changes Sam's password only when Sam is currently logged in.

   The target account need not be logged in; the command targets sam subject to authorization and account existence.
3. It prints Sam's plaintext password to the terminal.

   `passwd` requests password input interactively and does not display the resulting password as plaintext.
4. It creates the `sam` account if that account does not exist.

   `passwd` changes passwords; account creation uses account-management commands such as `useradd`.
5. `sudo` requests authorization to run the password operation with elevated privileges. ✓

   `sudo` runs the command under an authorized policy, commonly allowing an administrator to modify Sam's password.

`passwd sam` targets Sam, while `sudo` provides authorized elevated execution.

11. `chmod u+x build.sh` adds the owner's execute permission: Select TWO correct diagnoses or fixes.

Select two. More than one option is correct — every correct one is ticked below.

1. Adding a shebang automatically changes the file mode to executable.

   A shebang selects an interpreter during execution but does not modify the file's permission bits.
2. `chmod u+x build.sh` adds the owner's execute permission. ✓

   This symbolic mode change adds owner execute permission while preserving the existing owner read/write and other bits.
3. The file needs write permission removed before it can be executed.

   Write permission does not prevent execution; the missing owner execute bit is the relevant problem.
4. The owner lacks the file's execute permission. ✓

   Mode `644` gives the owner read and write permission but not execute permission for direct execution.
5. The file must be readable by the other class before its owner can execute it.

   The owner class is selected first; permissions in the other class do not supplement missing owner execute permission.

Mode `644` lacks owner execute permission; `chmod u+x build.sh` adds precisely that permission.

12. Search permission on `~/archive`: What prerequisite is missing?

1. Write permission on the symbolic link itself.

   Linux symbolic-link permission bits are not used to grant access; the target path and directories matter.
2. Search permission on `~/archive`. ✓

   Mode `600` lacks directory search permission, so the target path cannot be traversed through `~/archive`.
3. A second `ln -s` command using an absolute target path.

   The relative target resolves from the link's containing directory and is correct; traversal permission is the problem.
4. A regular-file copy of `today.txt` inside `~/notes`.

   A symbolic link can point to a file elsewhere; it does not require a duplicate target in its own directory.

`~/archive` lacks search permission, preventing traversal to the valid target file.

Other Linux Essentials domains

• Finding Your Way on a Linux System — 199 questions →
• The Power of the Command Line — 197 questions →
• The Linux Operating System — 178 questions →
• The Linux Community and a Career in Open Source — 155 questions →
• All 885 Linux Essentials questions →
• Linux Essentials certification: requirements, cost and exam format →