The DevOps Engineer should copy users and groups from an existing environment to another one, except for the 'admin' user. What first action should be taken to build the users package?

The DevOps Engineer should copy users and groups from an existing environment to another one, except for the 'admin' user. What first action should be taken to build the users package?

• A. Add an exclude pattern from "home/users/admin".
• B. Run the query "/jcr:root/home/users//element(*,rep:User)[@rep:userName=\"admin\"]"
• C. Run the query "/jcr:root/home/users//element(*rep:User)[@rep:principalName=\"admin\"]"
• D. Add a filter for "/home/users/admin".

Answer: (C)

When selecting which users to include in a package, use the identity that the repository actually uses for security: the principal name. In AEM, each user node under /home/users is a rep:User and carries both rep:userName and rep:principalName, but rep:principalName is the authoritative identity used for authentication and authorization. By running a query that finds the user node where rep:principalName equals "admin" under /jcr:root/home/users, you precisely identify the admin account to exclude from the package. This approach is robust across environments, even if the login names or paths vary slightly, because it targets the canonical principal rather than a possibly mutable attribute. The other options rely on path exclusion or on rep:userName, which can be less reliable: the user’s login might differ from the principal name in some setups, and hard-coding a path like /home/users/admin can miss accounts or change with environment differences. Using the query that filters rep:User nodes by rep:principalName="admin" is the clear, precise first step to isolate the admin account for exclusion when building the users package.

When selecting which users to include in a package, use the identity that the repository actually uses for security: the principal name. In AEM, each user node under /home/users is a rep:User and carries both rep:userName and rep:principalName, but rep:principalName is the authoritative identity used for authentication and authorization. By running a query that finds the user node where rep:principalName equals "admin" under /jcr:root/home/users, you precisely identify the admin account to exclude from the package. This approach is robust across environments, even if the login names or paths vary slightly, because it targets the canonical principal rather than a possibly mutable attribute.

The other options rely on path exclusion or on rep:userName, which can be less reliable: the user’s login might differ from the principal name in some setups, and hard-coding a path like /home/users/admin can miss accounts or change with environment differences. Using the query that filters rep:User nodes by rep:principalName="admin" is the clear, precise first step to isolate the admin account for exclusion when building the users package.