000-221 · Question #22
A new security policy dictates that unnecessary default user accounts be removed. Which default user IDs are most eligible for removal?
The correct answer is D. nuucp. Ipd, and guest. Accounts tied to legacy or optional services such as UUCP, line printing, and guest access are the safest candidates for removal under a least-privilege security policy.
Question
A new security policy dictates that unnecessary default user accounts be removed. Which default user IDs are most eligible for removal?
Options
- Anobody and adm
- Broot, sys and system
- Cdaemon, Ipd, adm and guest
- Dnuucp. Ipd, and guest
How the community answered
(45 responses)- A7% (3)
- B9% (4)
- C2% (1)
- D82% (37)
Why each option
Accounts tied to legacy or optional services such as UUCP, line printing, and guest access are the safest candidates for removal under a least-privilege security policy.
nobody is actively used by NFS and other services for unprivileged process isolation, and adm is used for system log and administrative tasks - both serve ongoing OS functions.
root, sys, and system are foundational system accounts required for normal OS operation and must not be removed.
daemon is a required system account that runs background OS processes; removing it would disrupt critical system services regardless of the security policy.
nuucp is associated with the Unix-to-Unix Copy Protocol, a legacy dial-up transfer service not used on modern systems; lpd supports a legacy line printer daemon; and guest provides unauthenticated access - none of these are required for standard AIX operation, making them the most appropriate accounts to disable or remove to reduce attack surface.
Concept tested: AIX default user account security hardening
Source: https://www.ibm.com/docs/en/aix/7.3?topic=security-user-accounts
Topics
Community Discussion
No community discussion yet for this question.