000-221 · Question #228
A system administrator has created a user id using the following command: mkuser sugroups=security gecos="AIX User" aixuser What is the effect of using this command?
The correct answer is B. The sugroups attribute allows members of the security group to su to this id. The sugroups attribute in AIX controls which groups are permitted to su inbound to the specified user account, not which accounts the user can su to.
Question
A system administrator has created a user id using the following command:
mkuser sugroups=security gecos="AIX User" aixuser What is the effect of using this command?
Options
- AThe sugroups attribute allows aixuser to su to users in the security group.
- BThe sugroups attribute allows members of the security group to su to this id.
- CThe aixuser will be created as an administrative user id and only the root user can alter attributes
- DThe aixuser will be created as an administrative user and only security group members can alter
How the community answered
(35 responses)- A9% (3)
- B83% (29)
- C6% (2)
- D3% (1)
Why each option
The sugroups attribute in AIX controls which groups are permitted to su inbound to the specified user account, not which accounts the user can su to.
The sugroups attribute does not grant aixuser permission to su outward to other users - it controls which groups may su to this account, not where this account can su.
In AIX, the sugroups attribute on a user account defines which groups' members are authorized to use su to switch to that user. Setting sugroups=security means only members of the security group can su to aixuser, granting inbound su access to this account, not outbound su privileges for the account.
Administrative user status restricting alteration to root is set via the admin=true attribute, not via sugroups; sugroups has no bearing on who can modify the account.
Restricting account modification to security group members is not a function of sugroups; sugroups controls su access only, and account attribute changes are governed by the admin attribute.
Concept tested: AIX mkuser sugroups attribute inbound su control
Source: https://www.ibm.com/docs/en/aix/7.3?topic=m-mkuser-command
Topics
Community Discussion
6
Sunita A.Dec 27, 2025The correct answer is B. The sugroups attribute on an AIX user account controls which groups are permitted to su INTO that account, not which accounts the user can su out to, so setting sugroups=security means any member of the security group can execute "su aixuser" successfully.
Wesley A.Dec 27, 2025Sunita nailed the core point, but worth adding that sugroups=ALL is the default and leaves it wide open, so explicitly setting it to a named group is one of those small AIX hardening steps that often gets skipped until audit time.
Bao N.Dec 16, 2025Tripped me up the first time too because the wording on sugroups feels backwards from what you expect. So just to nail this down, are you clear on whose perspective sugroups is defined from, meaning is it a property of the account being su'd INTO, or a property of the account doing the su-ing?
Orla P.Dec 18, 2025Sugroups is a property of the target account, the one being su'd into, so the system checks whether the initiating account is listed in that target's allowed groups.
Orla P.Dec 19, 2025The trap on this one is A, because your brain reads "sugroups" and wants it to mean the groups that aixuser herself can su into, which feels intuitive. It is actually the reverse: sugroups defines which groups have permission to su TO this account, so members of the security group can switch into the aixuser context, not the other way around. C and D are trying to bait you toward the admin=true flag, which is a separate attribute you would set explicitly, and nothing in that mkuser command touches administrative status. B is the correct answer, and it helps to remember the attribute as "groups permitted to su here" rather than "groups this user can reach."
Wesley A.Dec 31, 2025Thought A, but sugroups controls who can su TO you, not FROM you. B.