Candidates must navigate files, edit text, manage processes, set permissions, mount storage, and configure networking using tools like ls, grep, systemctl, chmod, mount, and ip. The critical thing is correct syntax and paths, since every command runs live and errors cost points.
Start practicing
Essential Commands — choose a session length
Free · No account required
Domain overview
Essential Commands is 20% of the LFCS and covers day-to-day Linux administration at the shell: files, text, processes, permissions, storage and networking. The exam is performance-based, so you work in a live terminal on real systems rather than answering multiple-choice questions, and each task is scored by inspecting the resulting system state.
Exam objectives
Navigating and manipulating files with ls, cp, mv, rm, find and tar
Searching and editing text using grep, sed, awk and vi
Managing processes and jobs with ps, top, kill, systemctl
Handling permissions, ownership, links and basic storage with chmod, chown, mount
Using rm -rf or redirection carelessly and destroying data or config files needed by later exam tasks.
Forgetting that chmod symbolic modes and umask interact, so new files get unexpected permissions.
Editing with sed -i without a backup, then being unable to recover the original file contents.
Click any question to see the full explanation and answer options, or start a focused practice session above.
A user reports that a script fails with 'Permission denied' when executed. The script has permissions -rw-r--r-- and is owned by the user. Which command should the user run to make the script executable for the owner only?
2A system administrator needs to find all files in /var/log that have been modified in the last 7 days. Which command accomplishes this?
3A user wants to find the location of the 'grep' binary. Which command should they use?
4Which THREE commands can be used to view the contents of a file?
5What is the purpose of the chmod 755 command in this exhibit?
6Based on the exhibit, which process will be affected if the root user runs 'kill 5678'?
7A junior administrator needs to display the first 10 lines of a file named 'data.csv'. Which command should they use?
8Which TWO commands can be used to display the current working directory? (Choose exactly two.)
9Which THREE of the following commands can be used to view the contents of a compressed file named 'file.gz' without permanently decompressing it? (Choose exactly three.)
10You are a system administrator for a company that runs a web server on a Linux system. The web server logs are stored in /var/log/nginx/access.log. The log file grows rapidly and rotates weekly via logrotate. The system has been running for several months. Recently, the development team reported that the web server is responding slowly. You suspect that the disk I/O might be high due to log file activity. You check the disk usage and find that /var/log/nginx/access.log is 4 GB, and the rotated logs (access.log.1.gz, access.log.2.gz, etc.) total another 10 GB. The /var partition has 20 GB total, so it's 70% full. You decide to reduce the disk usage by compressing the current log file and truncating it without stopping the nginx service. Which command sequence should you use to safely achieve this?
11You are managing a Linux server that hosts a critical web application. The server is running low on disk space in the root filesystem, and you need to free up space urgently. You run 'df -h' and see that /dev/sda1 is mounted on / and is 95% full. You also notice that /var/log/messages is over 2 GB in size. The application writes logs to /var/log/app.log, which is also large. The server has a separate /var partition that has plenty of free space. The application must continue running with minimal downtime. You need to compress and rotate logs without losing any data, and ensure that the root filesystem has at least 10% free space. Which of the following actions should you take first to achieve this goal?
12A system administrator needs to list all files in the current directory, including hidden files, in a long listing format sorted by modification time (oldest first). Which command achieves this?
13A user wants to find all files in /var/log that have been modified within the last 2 days. Which command should they use?
14A user needs to view the contents of a compressed log file /var/log/syslog.gz without first decompressing it. Which command should they use?
15A developer wants to change the ownership of a directory and all its contents recursively to user 'appuser' and group 'appgroup'. Which command accomplishes this?
16A systems administrator needs to add a new user 'jdoe' with a home directory in /export/home, a UID of 1500, and an expiry date of 2025-12-31. Which command should they use?
17A user wants to set the permissions of a file to 'rwxr-xr--'. Which octal permission value should they use with chmod?
18Match each Linux permission type to its symbolic representation.
19A user reports that a shell script 'backup.sh' in /home/user/scripts fails to execute. What is the most likely cause?
20A process is consuming 99% CPU and is unresponsive to normal shutdown requests. After running 'top', you see the PID is 1234. What is the most appropriate command to stop the process gracefully first?
21A backup script must create a compressed archive of the /etc directory, preserving file permissions and timestamps. Which command should be used?
22A user wants to continuously monitor a log file that is being written to by a running service. Which command achieves this?
23To check the disk usage of the /var/log directory in a human-readable format, which command is appropriate?
24A user needs to view the contents of a large text file one screen at a time. Which command is best for this?
25A cron job runs a script every hour but sometimes fails because the script cannot find commands like 'tar' and 'gzip'. The script works when run manually from a terminal. What is the best fix?
26Which THREE commands can change the priority of an already running process?
27Which TWO commands can display the current environment variables?
28Refer to the exhibit. The output of 'ps aux' shows a process named 'process_hog' with PID 1234 consuming 99.5% CPU. The process is stuck in an infinite loop and does not respond to SIGTERM. Which signal should be used to forcefully terminate it?
29Refer to the exhibit. The /var partition is 100% full. Which command can be used to find the largest files in /var/log to free up space?
30A DevOps engineer wants to measure how long a specific command takes to execute. Which command should be used?
31An administrator runs 'ls -la' and sees the following entry for a file: 'lrwxrwxrwx 1 root root 24 Jan 10 12:00 link -> /etc/passwd'. If the target file /etc/passwd is deleted, what happens to the link file?
32To compress a file while preserving the original file, which command should be used?
33A system administrator wants to display a list of all currently running processes with their parent process IDs. Which command is most appropriate?
34To display the first 10 lines of a file named 'log.txt', which command is correct?
35A user is unable to write to a file. The output of 'ls -l file' shows '-r--r--r--'. Which command will grant write permission to the owner?
36A system administrator needs to change the group ownership of a file to 'developers' and set the setgid bit on a directory. Which two commands accomplish these tasks? (Choose two.)
37A user wants to view the contents of a compressed file file.txt.gz without decompressing it permanently. Which two commands can be used? (Choose two.)
38A DevOps engineer wants to list all running processes sorted by memory usage in descending order. Which command should be used?
39An administrator needs to compress a directory named 'project' into a tarball with maximum compression using gzip. Which command is appropriate?
40A junior admin runs 'ls -l' and sees permissions '-rwxrwxr-x' on a file. What is the octal representation?
41A system administrator wants to kill a process with PID 1234 that is not responding to SIGTERM. Which command will forcefully terminate it?
42A user needs to see the contents of a gzip-compressed file 'data.txt.gz' without decompressing it. Which command is appropriate?
43An administrator wants to print the last field of each line from a CSV file 'data.csv' (comma-separated). Which awk command accomplishes this?
44A user 'dba' tries to login via SSH and fails. Based on the exhibit, what is the most likely cause?
45Which TWO commands can be used to display the contents of a text file page by page? (Select two.)
46A user reports that they cannot run a script because it says 'Permission denied'. The script is owned by root and has permissions -rw-r--r--. Which command would allow the user to execute the script?
47A system administrator has a cron job that runs a backup script. The script requires the variable BACKUP_DIR to be set, but the administrator cannot modify the script. Which is the most appropriate place to define the variable for cron?
48An administrator needs to replace all occurrences of the string 'foo' with 'bar' in all files under /etc/config, but only in files ending with .conf. The replacement must be done in-place, and backup copies should be created with a .bak extension. Which command accomplishes this?
49A user wants to view the contents of a compressed log file /var/log/syslog.2.gz without decompressing it first. Which command should they use?
50Which command displays the amount of free and used memory in the system?
51Which TWO commands can be used to view the last 10 lines of a file and also follow new lines as they are written?
52Which THREE of the following commands can be used to search for a string in multiple files and display the matching lines?
53Which TWO commands can be used to display the current working directory?
54Refer to the exhibit. The administrator receives alerts that the root filesystem is almost full. Which command could free up space by removing old log files?
55A system administrator notices that '/var/log/syslog' has grown very large and is consuming significant disk space. The administrator wants to identify the largest log files in the '/var/log' directory hierarchy. Which command should the administrator use?
56A developer reports that a compiled binary 'app' fails to execute with 'Permission denied' error when run from a mounted directory '/mnt/software'. The binary has execute permissions for all users. What is the most likely cause?
57Which TWO commands can be used to display the contents of a text file that has been compressed with gzip without decompressing it to disk?
58Which THREE of the following statements about Linux file permissions are correct?
59A user reports that they cannot delete a file named 'important.txt' located in their home directory. The file is owned by the user and the user has write permission on the directory. Running 'rm important.txt' produces the error: 'rm: cannot remove 'important.txt': Operation not permitted'. The user has also tried using 'sudo rm' but gets the same error. Which of the following is the most likely cause and correct solution?
60A system administrator notices that the disk space on the root filesystem is at 95% usage. After investigating, they find that a large log file named 'access.log' in /var/log is taking up significant space. The administrator deletes the file using 'rm /var/log/access.log' but the disk usage remains at 95%. Running 'df -h' still shows the same usage. What is the most likely cause and the correct next step?
61A DevOps engineer is writing a continuous integration pipeline that runs a script to deploy an application. The script is stored in a Git repository and is executed on a build server. The script works locally on the engineer's workstation, but when executed on the build server, it fails with '/bin/sh: line 12: somecommand: command not found'. The 'somecommand' is a standard Linux tool that is installed on the build server. The build server uses a minimal Docker container. Which of the following is the most likely cause and solution?
62A security audit reveals that a sensitive file '/etc/shadow' has been modified. The file's permissions are set to 600 and owned by root. However, the audit logs show that a service account 'webapp' was able to read the file. The 'webapp' user is not in the root group. Which of the following is the most likely method the 'webapp' user used to read the file?
63A system administrator configures a new server with multiple disks. After partitioning and formatting, they mount a partition to /data. Several days later, they notice that the /data filesystem is full, but 'du -sh /data' reports only 2 GB used, while the partition is 100 GB. 'df -h' shows /data is 98% full. What is the most likely cause and the correct action?
64A junior administrator needs to create a new empty file named report.txt in the current working directory. They want to ensure that if the file already exists, its contents are not altered. Which command should they run?
65A technician must create a hard link named 'report_link' to an existing file '/data/report.txt'. Which command should be used?
66A system administrator needs to change the ownership of the file /var/www/html/index.html from user alice to user bob, and also change the group to webdev. Which command should they use?
67A junior administrator is troubleshooting a server and needs to inspect the manual page for the 'ip' command, but the system is a minimal install where the man pages for that package were not installed. The administrator still wants the short one-line usage summary for 'ip' printed directly to the terminal. Which command should they run?
68A junior administrator needs to create a compressed archive of the /etc directory that preserves file ownership and permissions, and writes it to /backup/etc.tar.gz. Which single command accomplishes this?
69A junior administrator needs to create a symbolic link named /usr/local/bin/editor that points to /opt/tools/vim.bin. The link must be created without overwriting any existing file at the destination. Which command accomplishes this?
70An administrator must change the ownership of /srv/project and every file and directory beneath it to user alice and group devs, without altering permissions. Which command should be used?
71A support engineer must copy the directory /srv/appdata, including every subdirectory, hidden file, and preserved permission bits and timestamps, to /backup/appdata on the same host. Which command accomplishes this?
72An administrator needs to change the ownership of the directory /srv/www to user webadmin and group webteam, including all existing files and subdirectories. Which command accomplishes this?
73An administrator runs `ls -l` and sees a file entry whose permission string begins with a lowercase `l`. What does this indicate about the entry?
74A support engineer must copy the file /etc/hosts to /tmp/hosts.backup but only if /tmp/hosts.backup does not already exist, so that an existing backup is never overwritten. Which command performs this conditionally?
75A technician must locate every regular file beneath /var that is larger than 100 MB and was modified more than 30 days ago, then list them. Which TWO find expressions achieve this? (Choose two.)
76A system administrator needs to identify the absolute path of the executable that would be run when typing the command 'ls'. Which command should they use?
77A security analyst needs to search for the literal string 'error: failed to connect' in all .log files under /var/log, including subdirectories. The search should be case-insensitive and display line numbers. Which command should they use?
78An administrator needs to inspect the first few lines of a very large log file /var/log/syslog without loading the entire file into memory, and also needs to follow new entries as they are appended in real time. Which TWO commands or command combinations satisfy these requirements? (Choose two.)
79An administrator needs to combine two sorted text files, /tmp/a.txt and /tmp/b.txt, into a single sorted stream on standard output while also removing duplicate lines that appear in both files. Which command should be used?
80A server's root filesystem is filling up. An administrator needs to find the largest regular files under /var, sorted from largest to smallest, while avoiding errors from unreadable directories that are not owned by the administrator. Which command is most appropriate?
81A user needs to locate all regular files under /etc that are larger than 1 MB and have not been accessed in the last 30 days. Which command finds these files?
82An administrator needs to change the group ownership of the directory /srv/project and all of its existing contents to the group developers, without altering the user ownership. Which command should be used?
83A system administrator needs to create a hard link named /home/user/report_hardlink to an existing file /data/reports/report.txt. Which command should be used?
84A storage administrator needs to identify which filesystem is mounted at /mnt/data and display the mount options currently in effect for it, using a single command that reads the kernel mount table. Which command should be used?
85An administrator is diagnosing disk space and wants to see the total size of the /var/log directory and all its contents in human-readable units, without listing every individual file. Which command provides exactly this summary?
86A system administrator needs to identify which processes are consuming the most CPU and memory on a Linux server. Which TWO commands can provide a real-time, interactive view of process resource usage? (Choose two.)
Deep-dive questions
The most-searched questions in this domain — detailed explanations, worked examples, full answer breakdowns.
Candidates must navigate files, edit text, manage processes, set permissions, mount storage, and configure networking using tools like ls, grep, systemctl, chmod, mount, and ip. The critical thing is correct syntax and paths, since every command runs live and errors cost points.
The Courseiva LFCS question bank contains 86 questions in the Essential Commands domain, covering the 20% of the exam attributed to this domain in the official Linux Foundation blueprint. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Essential Commands domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included