LPI 102-500 Practice Test 20
Question 190
On a production Linux workstation or server, a technician observes: An offboarded user is still able to authenticate by an unrelated SSH key after only password-based access was disabled. Which TWO complementary steps provide the best corrective action and its most direct diagnostic verification? Select TWO answers.
- Assume locking a password always disables every public-key or existing session and that deleting a home immediately is required for temporary suspension.
- Review passwd status, chage or usermod lock fields, SSH key access, active sessions and retention or account-removal records.
- Compare `id` and getent group output before and after changes and test a fresh login for access to both old and new groups.
- Apply the appropriate account lock or expiration, disable alternate authentication paths when needed, then remove the user and files only under approved retention policy.
- Review and apply the appropriate /etc/cron.allow and /etc/at.allow or deny policies with the scheduler's supported access rules.
Explanation
Correct Answers
B:Most direct verification evidence: Review passwd status, chage or usermod lock fields, SSH key access, active sessions and retention or account-removal records. Linux principle: Locking a password is not necessarily identical to disabling every authentication method, and deprovisioning accounts differs from deleting all associated data.
D:Recommended administrative action: Apply the appropriate account lock or expiration, disable alternate authentication paths when needed, then remove the user and files only under approved retention policy. Linux principle: Locking a password is not necessarily identical to disabling every authentication method, and deprovisioning accounts differs from deleting all associated data.
Incorrect Answers
A:This shortcut is unsafe for the present Linux issue: Assume locking a password always disables every public-key or existing session and that deleting a home immediately is required for temporary suspension. Locking a password is not necessarily identical to disabling every authentication method, and deprovisioning accounts differs from deleting all associated data.
C:This alternative addresses Supplementary group membership and primary GID, not the specific issue of Account locking suspension and safe removal: Compare `id` and getent group output before and after changes and test a fresh login for access to both old and new groups.
E:That option would review and apply the appropriate /etc/cron.allow and /etc/at.allow or deny policies with the scheduler's supported access rules, but it addresses a different concern. Locking a password is not necessarily identical to disabling every authentication method, and deprovisioning accounts differs from deleting all associated data.
Question 191
During an LPIC-1 practice lab, the operator encounters this condition: A network daemon receives a full administrator login account with a home, interactive shell and unrestricted sudo despite needing only one writable state directory. Which administrative step is the MOST appropriate way to resolve this issue? Select ONE best answer.
- Provide explicit executable paths and required environment variables in the crontab or wrapper, avoiding assumptions about interactive startup files.
- Submit the one-off command with `at`, inspect scheduled items using `atq`, and remove an unwanted job using `atrm`.
- Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
Explanation
Correct Answer
C:Recommended administrative action: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Incorrect Answers
A:This alternative addresses Cron execution environment and absolute paths, not the specific issue of System service accounts and least privilege: Provide explicit executable paths and required environment variables in the crontab or wrapper, avoiding assumptions about interactive startup files. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
B:This alternative addresses One-time at jobs and queue management, not the specific issue of System service accounts and least privilege: Submit the one-off command with `at`, inspect scheduled items using `atq`, and remove an unwanted job using `atrm`. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
D:This shortcut is unsafe for the present Linux issue: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. It cannot establish a safe correction. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
Question 192
A helpdesk escalation describes this Linux behavior: A network daemon receives a full administrator login account with a home, interactive shell and unrestricted sudo despite needing only one writable state directory. Which Linux behavior or technical principle BEST explains why the issue occurs? Select ONE best answer.
- Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
- Name Service Switch may combine local passwd, group and directory sources; local text files do not necessarily describe all recognized accounts.
- Locale category variables can override LANG for specific behaviors; LC_ALL overrides category settings, affecting messages, sorting and number formats.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
Explanation
Correct Answer
A:Relevant Linux operating principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Incorrect Answers
B:This alternative addresses Name service lookups and account database integrity, not the specific issue of System service accounts and least privilege: Name Service Switch may combine local passwd, group and directory sources; local text files do not necessarily describe all recognized accounts. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
C:This alternative addresses Locale category precedence and stable parsing, not the specific issue of System service accounts and least privilege: Locale category variables can override LANG for specific behaviors; LC_ALL overrides category settings, affecting messages, sorting and number formats. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
D:This shortcut is unsafe for the present Linux issue: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Question 193
An operations handoff identifies this problem: A network daemon receives a full administrator login account with a home, interactive shell and unrestricted sudo despite needing only one writable state directory. Which evidence or command result MOST directly tests the suspected root cause? Select ONE best answer.
- Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible.
- Inspect the at queue and service status, verify the planned timestamp and run a safe one-time test.
- Inspect `getent passwd`, controlled `chage -l` output, shadow permissions and test behavior at the next authorized login.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
Explanation
Correct Answer
A:Most direct verification evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Incorrect Answers
B:That option would inspect the at queue and service status, verify the planned timestamp and run a safe one-time test, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
C:That option would inspect `getent passwd`, controlled `chage -l` output, shadow permissions and test behavior at the next authorized login, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
D:This shortcut is unsafe for the present Linux issue: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Question 194
A team maintaining a Linux host reports: A network daemon receives a full administrator login account with a home, interactive shell and unrestricted sudo despite needing only one writable state directory. Which observed outcome BEST confirms a successful and properly scoped correction? Select ONE best answer.
- The required service is triggered at the intended calendar time and recovers eligible missed occurrences according to policy.
- The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
- Only authorized identities can add or change the intended recurring or one-time jobs under the documented policy.
Explanation
Correct Answer
B:Observable acceptance criterion: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Incorrect Answers
A:This alternative addresses Systemd timers and persistent missed schedules, not the specific issue of System service accounts and least privilege: The required service is triggered at the intended calendar time and recovers eligible missed occurrences according to policy. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
C:This shortcut is unsafe for the present Linux issue: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. It cannot establish a safe correction. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
D:This alternative addresses Cron and at user-access allow deny policies, not the specific issue of System service accounts and least privilege: Only authorized identities can add or change the intended recurring or one-time jobs under the documented policy. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
Question 195
While verifying a Linux change request, an engineer finds: A network daemon receives a full administrator login account with a home, interactive shell and unrestricted sudo despite needing only one writable state directory. Which misleading assumption MOST directly contributes to this failure and should be rejected? Select ONE best answer.
- Assume every Linux user must appear literally in /etc/passwd and that grepping a local file is equivalent to a Name Service Switch lookup.
- Assume the sixth username column is mandatory in both per-user crontabs and system-wide cron definitions.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
- Assume cron automatically sources every user's interactive ~/.bashrc and inherits the login terminal's exported desktop variables.
Explanation
Correct Answer
C:Reject this specific misconception: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. It incorrectly assumes behavior that conflicts with the observed Linux conditions.
Incorrect Answers
A:That option would assume every Linux user must appear literally in /etc/passwd and that grepping a local file is equivalent to a Name Service Switch lookup, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
B:That option would assume the sixth username column is mandatory in both per-user crontabs and system-wide cron definitions, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
D:That option would assume cron automatically sources every user's interactive ~/.bashrc and inherits the login terminal's exported desktop variables, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Question 196
A Linux administrator investigates the following system incident: A backup application has no human operator, but its account is created with standard interactive login defaults and shared credentials. Which administrative step is the MOST appropriate way to resolve this issue? Select ONE best answer.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
- Use `getent` and supported user or group administration tools to inspect the effective NSS account database without assuming all identities exist in local files.
- Submit the one-off command with `at`, inspect scheduled items using `atq`, and remove an unwanted job using `atrm`.
- Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs.
Explanation
Correct Answer
D:Recommended administrative action: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Incorrect Answers
A:This shortcut is unsafe for the present Linux issue: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. It cannot establish a safe correction. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
B:That option would use `getent` and supported user or group administration tools to inspect the effective NSS account database without assuming all identities exist in local files, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
C:This alternative addresses One-time at jobs and queue management, not the specific issue of System service accounts and least privilege: Submit the one-off command with `at`, inspect scheduled items using `atq`, and remove an unwanted job using `atrm`. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
Question 197
On a production Linux workstation or server, a technician observes: A backup application has no human operator, but its account is created with standard interactive login defaults and shared credentials. Which Linux behavior or technical principle BEST explains why the issue occurs? Select ONE best answer.
- Primary GID and supplementary groups serve distinct access and ownership roles; setting a replacement `-G` list without `-a` removes omitted supplementary memberships.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
- Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
- Systemd timers activate associated units on configured events; Persistent applies to OnCalendar timer events and can recover missed activations after the timer was inactive.
Explanation
Correct Answer
C:Relevant Linux operating principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Incorrect Answers
A:This alternative addresses Supplementary group membership and primary GID, not the specific issue of System service accounts and least privilege: Primary GID and supplementary groups serve distinct access and ownership roles; setting a replacement `-G` list without `-a` removes omitted supplementary memberships. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
B:This shortcut is unsafe for the present Linux issue: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
D:This alternative addresses Systemd timers and persistent missed schedules, not the specific issue of System service accounts and least privilege: Systemd timers activate associated units on configured events; Persistent applies to OnCalendar timer events and can recover missed activations after the timer was inactive. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
Question 198
During an LPIC-1 practice lab, the operator encounters this condition: A backup application has no human operator, but its account is created with standard interactive login defaults and shared credentials. Which evidence or command result MOST directly tests the suspected root cause? Select ONE best answer.
- Inspect getent passwd for the account, stat the home directory and review useradd defaults, ownership and login shell.
- Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible.
- Inspect timedatectl status, /etc/localtime target, the process TZ value and sample `date` output in both intended zones.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
Explanation
Correct Answer
B:Most direct verification evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Incorrect Answers
A:That option would inspect getent passwd for the account, stat the home directory and review useradd defaults, ownership and login shell, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
C:That option would inspect timedatectl status, /etc/localtime target, the process TZ value and sample `date` output in both intended zones, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
D:This shortcut is unsafe for the present Linux issue: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. It cannot establish a safe correction. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Question 199
A helpdesk escalation describes this Linux behavior: A backup application has no human operator, but its account is created with standard interactive login defaults and shared credentials. Which observed outcome BEST confirms a successful and properly scoped correction? Select ONE best answer.
- The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
- The deactivated account cannot start unauthorized sessions, and retained data is handled according to approved policy.
- The intended user executes the scheduled command at the chosen time with no stray username token.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
Explanation
Correct Answer
A:Observable acceptance criterion: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Incorrect Answers
B:This alternative addresses Account locking suspension and safe removal, not the specific issue of System service accounts and least privilege: The deactivated account cannot start unauthorized sessions, and retained data is handled according to approved policy. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
C:This alternative addresses User crontab versus system crontab fields, not the specific issue of System service accounts and least privilege: The intended user executes the scheduled command at the chosen time with no stray username token. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon. Appropriate response: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Root-cause evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Independent acceptance: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
D:This shortcut is unsafe for the present Linux issue: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Question 200
An operations handoff identifies this problem: A backup application has no human operator, but its account is created with standard interactive login defaults and shared credentials. Which THREE elements together give the appropriate corrective action, direct diagnostic evidence and observable acceptance result? Select THREE answers.
- The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login.
- Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account.
- Configure the system timezone with `timedatectl set-timezone` or supported zoneinfo linkage and use TZ for deliberate per-process overrides.
- Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs.
- Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible.
- Compare `getent passwd username`, `getent group groupname`, `id` and the nsswitch database configuration, checking authoritative sources.
Explanation
Correct Answers
A:Observable acceptance criterion: The service starts with only the required effective permissions and the identity cannot be used for ordinary unauthorized interactive login. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
D:Recommended administrative action: Use a distinct appropriately limited service or system account, choose a non-login shell and limit filesystem and group rights to the daemon's needs. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
E:Most direct verification evidence: Inspect account UID and shell, service unit User setting, writable paths, group membership and whether interactive authentication is possible. Linux principle: Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
Incorrect Answers
B:This shortcut is unsafe for the present Linux issue: Give every daemon root-level sudo and a shared interactive password because background processes cannot run under a restricted system account. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
C:That option would configure the system timezone with `timedatectl set-timezone` or supported zoneinfo linkage and use TZ for deliberate per-process overrides, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
F:That option would compare `getent passwd username`, `getent group groupname`, `id` and the nsswitch database configuration, checking authoritative sources, but it addresses a different concern. Nonhuman service identities reduce the blast radius of background processes; human interactive login and unrestricted privilege are not prerequisites for a daemon.
