Correct Answer: A  🗳️

Correct Answer:

See the complete solution in Explanation.
Explanation:
Objective: Create the Linux user james, assign the specified password, create two groups with exact group IDs, and configure the user's primary and supplementary group memberships.
The task requires these operations to be performed in the specified order:
Requirement
Expected configuration
Username
james
Password
Foundation
Supplementary group
commander
Supplementary group GID
15002
Primary group
pilot
Primary group GID
15001
Important: Adding james to commander must not change the user's primary group. Only the final operation changes the primary group to pilot.
Step 1: Connect to the correct Linux server.
The video specifies host lfcs00091.
From the candidate terminal, execute:
ssh lfcs00091
This establishes an SSH connection to the designated Linux server.
All account and group-management operations must be performed on this host.
Step 2: Check whether user james already exists.
Execute:
id james
If the account does not exist, an expected message is:
id: 'james': no such user
You can also execute:
getent passwd james
This searches the configured user-account databases.
If the account already exists, inspect it before changing anything. Since the task explicitly requests creating the user, the normal exam starting state should not already contain the account.
Step 3: Create the user james.
Execute:
sudo useradd -m james
sudo runs the command with administrative privileges.
useradd creates a new Linux user account.
-m creates a home directory for the user.
james is the required username.
On a typical Ubuntu system configured for private user groups, the command creates an account with a home directory at:
/home/james
The default primary group is determined by the system's account-creation policy. It is commonly a private group named james.
The official Linux useradd(8) documentation confirms that -m creates a home directory and that default primary-group behavior depends on system configuration.
Linux manual page
Step 4: Verify that the user was created successfully.
Execute:
id james
An illustrative output is:
uid=1001(james) gid=1001(james) groups=1001(james)
The numerical UID and initial GID can differ on the actual system.
Check the account entry:
getent passwd james
Verify the home directory:
ls -ld /home/james
The account should exist before proceeding.
Step 5: Set the user's password to Foundation.
Execute:
sudo passwd james
The system will request a new password.
Enter:
Foundation
When prompted to confirm, enter:
Foundation
The password is case-sensitive.
A successful operation normally displays:
passwd: password updated successfully
The passwd command securely processes the supplied password and updates the account's password authentication information.
The official passwd(1) manual confirms that an administrator can assign a password to another user and that the utility requests the new password interactively.
Linux manual page
Step 6: Verify the user's password status.
Execute:
sudo passwd -S james
The output may resemble:
james P 2026-10-12 0 99999 7 -1
The date and password-aging fields will depend on the system.
The important value is:
P
This indicates that the account has a usable password.
This command does not reveal or independently confirm the plaintext password. To verify the actual credential, authenticate as james using Foundation through an appropriate login method.
Do not attempt to read the plaintext password from /etc/shadow. Linux stores password hashes rather than recoverable plaintext passwords.
Step 7: Check whether the group commander already exists.
Before creating the group, execute:
getent group commander
If the group does not exist, the command normally produces no output.
Also check whether GID 15002 is already allocated:
getent group 15002
If both checks produce no results, the requested group name and ID are available.
Step 8: Create group commander with GID 15002.
Execute:
sudo groupadd -g 15002 commander
groupadd creates a new Linux group.
-g 15002 assigns the exact numerical GID.
commander is the required group name.
The -g option explicitly controls the group's numerical identifier.
The official groupadd(8) documentation confirms that this option creates a group using the specified GID and normally requires it to be unique.
Linux manual page
Step 9: Verify that group commander was created.
Execute:
getent group commander
Expected output, before adding members:
commander:x:15002:
The fields in /etc/group are arranged as:
group_name:password:GID:user_list
Therefore:
commander is the group name.
x indicates the group password field is not stored directly in /etc/group.
15002 is the assigned GID.
The final field lists supplementary group members.
Step 10: Record james's current primary group.
Before adding james to commander, execute:
id -gn james
This displays the user's current primary group name.
To display its numerical GID:
id -g james
On a typical Ubuntu system, the group name may initially be:
james
The purpose of this step is to establish the primary-group value before making any changes to supplementary memberships.
Step 11: Add james to commander as a supplementary group.
Execute:
sudo usermod -aG commander james
This is one of the most important commands in the task.
Option
Purpose
usermod
Modifies an existing user account
-a
Appends to existing supplementary group memberships
-G commander
Specifies the supplementary group
james
Specifies the target user
The combination -aG adds commander to the user's supplementary memberships without changing the primary group.
The official usermod(8) manual confirms this behavior.
Linux manual page
Step 12: Understand why -aG is required.
Compare these commands:
sudo usermod -aG commander james
This is correct because it appends commander to the supplementary groups.
sudo usermod -G commander james
This can replace the user's existing supplementary group list with the specified list, removing memberships that were not included.
sudo usermod -g commander james
This would change the primary group to commander.
The last command is incorrect at this stage because the task explicitly states:
Do not change user james's primary group.
Therefore, use:
sudo usermod -aG commander james
Step 13: Verify supplementary group membership.
Execute:
id james
An illustrative result is:
uid=1001(james) gid=1001(james) groups=1001(james),15002(commander)
This confirms that commander was added as a supplementary group.
Check the group entry:
getent group commander
Expected:
commander:x:15002:james
Step 14: Verify that the primary group has not changed.
Execute:
id -gn james
Compare its output against the primary group recorded in Step 10.
The value must remain unchanged at this stage.
For example, if the original primary group was james, the output should remain:
james
Also check:
id -g james
This should return the original primary GID.
Do not proceed until both conditions are met: james belongs to commander, and the original primary group is unchanged.
Step 15: Check whether the group pilot already exists.
Execute:
getent group pilot
Check whether GID 15001 is available:
getent group 15001
The group name and numerical GID should be available for the requested group creation.
Step 16: Create group pilot with GID 15001.
Execute:
sudo groupadd -g 15001 pilot
groupadd creates a new group.
-g 15001 sets its numerical GID to 15001.
pilot is the requested group name.
The exact GID matters. Do not allow Linux to choose an automatically assigned GID.
Step 17: Verify group pilot.
Execute:
getent group pilot
Expected:
pilot:x:15001:
This verifies the group name and assigned numerical identifier.
At this stage, the group has been created, but the user's primary group has not yet been changed.
Step 18: Set pilot as the primary group for james.
Execute:
sudo usermod -g pilot james
This is the final account-modification command required by the task.
usermod modifies the existing user account.
-g pilot sets the primary login group to pilot.
james identifies the account being modified.
Unlike uppercase -G, which controls supplementary groups, lowercase -g specifies the primary group.
The official usermod(8) documentation distinguishes these options explicitly.
Linux manual page
The new primary group must already exist, which is why pilot was created first.
Step 19: Verify the user's new primary group.
Execute:
id -gn james
Expected output:
pilot
Verify the numerical GID:
id -g james
Expected:
15001
These commands establish that the account's primary group is now pilot.
Step 20: Verify that commander remains a supplementary group.
Execute:
id james
An illustrative final result is:
uid=1001(james) gid=15001(pilot) groups=15001(pilot),15002(commander)
The UID and any additional supplementary groups may differ.
The important conditions are:
Primary GID: 15001, belonging to pilot.
Supplementary membership: commander, GID 15002.
Changing the primary group with usermod -g should not remove the existing supplementary commander membership.
Step 21: Inspect the final account database entry.
Execute:
getent passwd james
An illustrative entry is:
james:x:1001:15001::/home/james:/bin/sh
The fourth field is the primary GID, which must be 15001.
The login shell and other fields may vary according to the system defaults.
Step 22: Verify the group definitions.
Execute:
getent group commander
getent group pilot
Expected group definitions:
commander:x:15002:james
pilot:x:15001:
It is normal for the pilot group entry not to list james explicitly in its final member field. A user's primary group is determined by the GID stored in the user-account record, while /etc/group lists explicit supplementary group membership.
The id james command is the most convenient way to verify both kinds of group membership together.
Linux manual page
Step 23: Verify the password status again.
Execute:
sudo passwd -S james
Confirm that the account still reports a usable password with status P.
The group modifications should not change the password.
Step 24: Perform the final verification.
Execute:
id james
id -gn james
id -g james
id -Gn james
getent group commander
getent group pilot
sudo passwd -S james
The required final configuration is:
Requirement
Expected result
User exists
james
Password configured
Foundation
commander exists
Yes
commander GID
15002
commander membership
Supplementary
pilot exists
Yes
pilot GID
15001
pilot membership
Primary
Other supplementary memberships
Preserved
Final Solution
Execute the following commands in order.
# Connect to the required server
ssh lfcs00091
# Create user james with a home directory
sudo useradd -m james
# Set password interactively to Foundation
sudo passwd james
# Create commander with GID 15002
sudo groupadd -g 15002 commander
# Add james to commander as a supplementary group
sudo usermod -aG commander james
# Verify primary group has not changed
id -gn james
# Create pilot with GID 15001
sudo groupadd -g 15001 pilot
# Change james's primary group to pilot
sudo usermod -g pilot james
# Verify the complete user configuration
id james
id -gn james
id -g james
# Verify the created groups
getent group commander
getent group pilot
# Verify the account has a usable password
sudo passwd -S james
When executing:
sudo passwd james
enter Foundation twice when prompted.
Expected final result:
uid=1001(james) gid=15001(pilot) groups=15001(pilot),15002(commander)
The UID is illustrative. The required group names, GIDs, and memberships must match exactly.
Technical Verification and References
The commands have been checked against the Linux account-management manuals:
Linux useradd(8)
- Creating user accounts.
Linux passwd(1)
- Assigning and checking user passwords.
Linux groupadd(8)
- Creating groups with specified GIDs.
Linux usermod(8)
- Managing primary and supplementary group memberships.
Linux id(1)
- Verifying user and group identities.
Video verification finding: Question 15 is visible at approximately 32:14-32:18 of the recording. Its full task statement and target host lfcs00091 are readable. The candidate moves to the next task without demonstrating these account-management commands, so the solution is independently documentation-verified rather than confirmed through successful execution in the video.
Expected result: User james has password Foundation, belongs to commander (GID 15002) as a supplementary group, and uses pilot (GID 15001) as the primary group.
next now
Worked for 4m 23s

Correct Answer: B,D  🗳️

Correct Answer:

See the complete solution in Explanation.
Explanation:
Step 1: Connect to the correct Linux server.
The video specifies that this task must be performed on host lfcs00073.
From the candidate terminal, execute:
ssh candidate@lfcs00073
This establishes an SSH connection to the designated Linux server.
All subsequent configuration changes must be performed on this host.
Step 2: Verify that user jack exists.
Execute:
id jack
This displays the user's UID, primary group and supplementary groups.
An example of valid output is:
uid=1001(jack) gid=1001(jack) groups=1001(jack)
The numerical IDs may differ.
You can also verify the account through the system user database:
getent passwd jack
The task requires modifying SSH authentication, not creating or modifying the user account.
Do not execute passwd jack or change the user's existing password.
Step 3: Identify the OpenSSH daemon configuration file.
The primary OpenSSH server configuration file on Ubuntu is:
/etc/ssh/sshd_config
Additionally, OpenSSH may load configuration fragments from:
/etc/ssh/sshd_config.d/
Inspect the primary configuration file:
sudo cat /etc/ssh/sshd_config
Check whether additional configuration files exist:
sudo ls -la /etc/ssh/sshd_config.d/
The effective OpenSSH configuration may depend on directives in both locations.
Step 4: Identify the existing authentication settings.
Execute:
sudo grep -RniE \
'KbdInteractiveAuthentication|ChallengeResponseAuthentication|UsePAM|AuthenticationMethods|Match' \
/etc/ssh/sshd_config /etc/ssh/sshd_config.d/ 2 > /dev/null
This searches for authentication-related directives.
The most important directive is:
KbdInteractiveAuthentication
It controls whether the SSH daemon permits keyboard-interactive authentication.
Possible values:
Configuration
Meaning
KbdInteractiveAuthentication yes
Permits keyboard-interactive authentication
KbdInteractiveAuthentication no
Disables keyboard-interactive authentication
On Ubuntu 22.04, the packaged OpenSSH configuration commonly disables keyboard-interactive authentication globally while enabling PAM.
OpenSSH daemon configuration file
However, the task requires the method to be enabled specifically for jack, without changing other users' login ability.
Therefore, simply changing the global directive from no to yes is not the appropriate solution.
Step 5: Examine the effective configuration before changing anything.
Execute:
sudo sshd -T \
-C user=jack,host=localhost,addr=127.0.0.1
This displays the effective SSH daemon configuration for a connection matching user jack.
To filter the relevant settings:
sudo sshd -T \
-C user=jack,host=localhost,addr=127.0.0.1 \
| grep -E 'kbdinteractiveauthentication|usepam|authenticationmethods'
For example, an initial configuration might show:
kbdinteractiveauthentication no
usepam yes
authenticationmethods any
This is an illustrative output. The actual values must be checked on the server.
Also record the same settings for another existing user, such as candidate:
sudo sshd -T \
-C user=candidate,host=localhost,addr=127.0.0.1 \
| grep -E 'kbdinteractiveauthentication|usepam|authenticationmethods'
These baseline values will be useful when verifying that other users remain unaffected.
Step 6: Back up the existing OpenSSH configuration.
Before modifying the daemon configuration, execute:
sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
* cp copies the configuration file.
* -a preserves ownership, permissions and other file metadata.
* /etc/ssh/sshd_config.bak is the backup copy.
If a configuration error occurs, the original file can be restored.
Keep the existing SSH session open while making these changes.
Step 7: Edit the OpenSSH daemon configuration.
Open the configuration file:
sudo nano /etc/ssh/sshd_config
Alternatively, use Vim:
sudo vim /etc/ssh/sshd_config
Review any existing Match directives before adding the required configuration.
Step 8: Configure keyboard-interactive authentication specifically for jack.
Provided no earlier matching block takes precedence, append the following configuration at the end of /etc/ssh
/sshd_config:
Match User jack
KbdInteractiveAuthentication yes
This is the central configuration required for the task.
Match User jack
The Match directive begins a conditional configuration section.
The User jack condition means that the directives inside this section apply to connections authenticating as jack.
KbdInteractiveAuthentication yes
This enables keyboard-interactive authentication for connections satisfying the preceding Match condition.
Other users do not match User jack, so they retain their existing global or user-specific settings.
OpenSSH's official documentation permits KbdInteractiveAuthentication inside a Match section.
OpenSSH daemon configuration file
Important: If the existing configuration already contains a matching Match User jack or Match All block setting this option, edit the appropriate existing rule instead. OpenSSH generally uses the first occurrence of a directive among satisfied Match blocks. Simply appending a later block may not override an earlier matching rule.
Step 9: Save the configuration file.
If using Nano:
* Press Ctrl + O to save.
* Press Enter to confirm.
* Press Ctrl + X to exit.
If using Vim, press Esc, type :wq, and press Enter.
The modified file should contain the user-specific rule:
Match User jack
KbdInteractiveAuthentication yes
Do not add a global AllowUsers jack rule. That could prevent other users from logging in and would violate the task.
Step 10: Verify the PAM authentication setting.
Execute:
sudo sshd -T \
-C user=jack,host=localhost,addr=127.0.0.1 \
| grep usepam
For the normal Ubuntu PAM-based authentication setup, the expected configuration is:
usepam yes
UsePAM yes allows OpenSSH to use PAM for keyboard-interactive authentication.
On Ubuntu, this directive normally appears in the global configuration.
Do not place UsePAM inside the Match User jack block. It is not a valid Match-specific directive in the relevant OpenSSH configuration.
If PAM is globally disabled, investigate the existing authentication design before changing it. Enabling PAM globally could affect other users, contrary to the task's constraints.
Step 11: Validate the SSH configuration syntax.
Before reloading the daemon, execute:
sudo sshd -t
* sshd is the OpenSSH server daemon.
* -t validates the configuration and checks relevant server key requirements.
A successful validation normally produces no output and returns exit code 0.
Check the result:
echo $?
Expected:
0
If errors are displayed, correct them before proceeding.
Do not restart or reload SSH with an invalid configuration.
Step 12: Verify that keyboard-interactive authentication is enabled for jack.
Execute:
sudo sshd -T \
-C user=jack,host=localhost,addr=127.0.0.1 \
| grep kbdinteractiveauthentication
Expected output:
kbdinteractiveauthentication yes
This confirms the effective server configuration for the specified user and connection context.
Unlike simply inspecting the configuration file, sshd -T -C evaluates applicable Match rules.
OpenSSH daemon
Step 13: Confirm that other users' authentication settings have not changed.
Execute:
sudo sshd -T \
-C user=candidate,host=localhost,addr=127.0.0.1 \
| grep -E 'kbdinteractiveauthentication|usepam|authenticationmethods'
Compare the output with the baseline recorded in Step 5.
If the original configuration had keyboard-interactive authentication disabled for candidate, it should remain disabled.
For example:
kbdinteractiveauthentication no
usepam yes
authenticationmethods any
The important requirement is that other users retain their original effective authentication settings, not that every server necessarily produces these example values.
Also verify any existing AuthenticationMethods policy. If it requires a method sequence that excludes standalone keyboard-interactive authentication, simply enabling KbdInteractiveAuthentication may not permit a keyboard-interactive-only login. Any necessary adjustment must remain specific to jack.
Step 14: Reload the OpenSSH daemon.
After verifying the configuration, execute:
sudo systemctl reload ssh
On Ubuntu, the systemd service is normally named ssh.
Reloading causes the daemon to apply its updated configuration without unnecessarily terminating established SSH sessions.
Step 15: Verify the SSH service is operational.
Execute:
sudo systemctl status ssh --no-pager
Expected active status:
Active: active (running)
You can also execute:
systemctl is-active ssh
Expected:
active
Step 16: Test keyboard-interactive authentication for jack.
From a separate SSH session, execute:
ssh -o PreferredAuthentications=keyboard-interactive \
-o PubkeyAuthentication=no \
-o PasswordAuthentication=no \
jack@localhost
* PreferredAuthentications=keyboard-interactive selects keyboard-interactive authentication.
* PubkeyAuthentication=no prevents the client from authenticating using a public key.
* PasswordAuthentication=no disables the separate SSH password authentication method, without disabling keyboard-interactive prompts.
* jack@localhost attempts to connect as user jack.
If PAM supports the account and the user supplies the correct existing credentials, the server should permit keyboard-interactive authentication.
If the server uses a multi-factor AuthenticationMethods policy, adapt the test to that policy and confirm keyboard-interactive authentication is offered at the appropriate stage.
Do not modify jack's password to perform the test.
Step 17: Perform final configuration checks.
Execute:
sudo sshd -t
Verify the setting for jack:
sudo sshd -T \
-C user=jack,host=localhost,addr=127.0.0.1 \
| grep kbdinteractiveauthentication
Expected:
kbdinteractiveauthentication yes
Verify another user's setting:
sudo sshd -T \
-C user=candidate,host=localhost,addr=127.0.0.1 \
| grep kbdinteractiveauthentication
The value must remain consistent with that user's original configuration.
Finally:
systemctl is-active ssh
Expected:
active
Final Solution
1. Connect to the correct host.
ssh candidate@lfcs00073
2. Back up the SSH configuration.
sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
3. Edit the configuration file.
sudo nano /etc/ssh/sshd_config
4. Add the required configuration at the appropriate location, after checking existing Match rules.
Match User jack
KbdInteractiveAuthentication yes
5. Validate the SSH configuration.
sudo sshd -t
6. Verify the effective setting for jack.
sudo sshd -T \
-C user=jack,host=localhost,addr=127.0.0.1 \
| grep kbdinteractiveauthentication
Expected:
kbdinteractiveauthentication yes
7. Reload the SSH daemon.
sudo systemctl reload ssh
8. Confirm that SSH remains active.
systemctl is-active ssh
Expected:
active
Technical Verification and References
The solution has been checked against the official OpenSSH documentation for Ubuntu.
* Match User applies specified configuration directives to connections matching a particular username.
* KbdInteractiveAuthentication controls whether keyboard-interactive authentication is permitted.
* UsePAM enables PAM integration used for keyboard-interactive authentication on typical Ubuntu systems.
* sshd -t validates server configuration syntax.
* sshd -T -C evaluates effective configuration settings for a particular connection, including applicable Match sections.
Official references:
* Ubuntu OpenSSH sshd_config(5)
* Ubuntu OpenSSH sshd(8)
* OpenSSH Configuration Reference
Expected result: Keyboard-interactive authentication is persistently permitted for user jack, without changing the user's password or altering other users' existing login settings. Successful end-to-end authentication must also be confirmed with a valid login test.

Correct Answer:

/etc/cups, /etc/cups/