You must be able to control services and boot targets, schedule jobs, read logs, and recover a system, all from the command line. The single most important thing: know when to use enable versus start, since persistence across reboots is what most tasks actually require.
Start practicing
Operation of Running Systems — choose a session length
Free · No account required
Domain overview
This domain covers keeping a running Linux system healthy: managing systemd services and targets, scheduling jobs with cron, at, and systemd timers, reading logs with journalctl, controlling boot behavior, and performing recovery tasks like resetting a forgotten root password or assembling LVM storage. LFCS tests these as hands-on performance items, not multiple choice, so you must execute commands correctly on a live system.
Exam objectives
Starting, stopping, enabling, and masking units with systemctl, and reading unit state with systemctl status
Scheduling recurring and one-time jobs using crontab, /etc/cron.d, at, and systemd timer units
Inspecting and filtering logs with journalctl, including by unit, boot, priority, and time range
Managing boot targets, GRUB parameters, and single-user or rescue mode recovery procedures
Using systemctl start instead of systemctl enable when the requirement is automatic startup after reboot or crash recovery
Forgetting that at and batch jobs need the atd service running, or misreading the at time format so the job fires at the wrong hour
Editing /etc/fstab or GRUB without verifying syntax, then rebooting into an unbootable system with no recovery plan
Click any question to see the full explanation and answer options, or start a focused practice session above.
A system administrator wants to view the last 10 lines of the system log file '/var/log/syslog' and continue to watch for new lines as they are appended. Which command should be used?
2An administrator is troubleshooting a server that runs a critical application. The server has 16 GB of RAM and 8 CPU cores. The administrator notices that the server becomes very slow during peak hours. Analysis of 'iostat -x 1' shows that the average wait time (await) for the main disk (sda) is consistently above 1000 ms, while the average service time (svctm) is around 5 ms. What is the most likely cause?
3A systems administrator is troubleshooting a server that runs a database application. The server has 64 GB of RAM and 16 CPU cores. The administrator notices that the system is using a significant amount of swap space even though there is plenty of free memory. The 'free -m' command shows: total memory = 65536, used = 50000, free = 15536, buffers/cache = 10000, swap total = 8192, swap used = 6000. Which of the following is the most likely cause?
4Which TWO of the following are correct statements about systemd journald configuration?
5A system administrator needs to check the current CPU load and memory usage on a Linux server. Which command should be used to display a dynamic, real-time view of running processes and system resource utilization?
6Based on the journalctl output, what is the most likely cause of the service failure?
7Order the steps to set up a LVM logical volume from a new disk.
8Order the steps to recover a forgotten root password on a Linux system using single-user mode.
9Match each file system type to its typical use case.
10A system administrator notices that a process is consuming 100% CPU and is unresponsive. Which command should be used to immediately stop the process if the PID is 2345?
11A system with systemd experiences a service that fails to start due to a 'Failed to start' error with status 203/EXEC. What is the most likely cause?
12A server is running out of disk space. Which command will show the disk usage of the root filesystem in a human-readable format?
13A user reports that they cannot log in via SSH, but other users can. The administrator checks /var/log/auth.log and sees 'Failed password for invalid user'. What is the most likely cause?
14An administrator wants to ensure that a service starts automatically after a system crash. Which systemd command should be used?
15A process is stuck in an uninterruptible sleep (D state) and cannot be killed. What is the most likely cause?
16Refer to the exhibit. What is the most likely security issue?
17A system administrator notices that a web server process (PID 1234) is consuming excessive CPU. They want to trace its system calls to identify the cause. Which command should be used?
18An administrator wants to view the current memory usage in a human-readable format, showing totals for used and free memory. Which command should be used?
19After a kernel update, a service fails to start with 'cannot allocate memory'. The system has 16GB RAM and 8GB swap. Which command should the administrator run first to diagnose potential memory limits?
20A server runs out of inodes. The administrator needs to find which filesystem is exhausted and which directory has the most files. Which command sequence best accomplishes this?
21A system has a process stuck in uninterruptible sleep (D state). The administrator wants to identify which kernel function it is waiting on. Which tool should be used?
22To view the system's default runlevel (target) at boot, which command is used on a systemd-based system?
23Which THREE commands can display the current CPU utilization statistics on a Linux system?
24Based on the exhibit, which process is using the most physical memory (RES)?
25Based on the exhibit, what is the most likely cause of the blocked task?
26A process (PID 1234) is hung and cannot be killed with SIGTERM. To force termination, which signal should be sent?
27Which command shows the default target for systemd?
28An e-commerce company runs a critical application on a Linux server that occasionally becomes unresponsive. The server has 64GB RAM and runs a Java application. The operations team notices that during peak hours, the system becomes very slow and eventually the application crashes with 'OutOfMemoryError'. After restart, it works fine for a while. They suspect a memory leak but also want to ensure the system does not go down during peak hours. The system uses systemd to manage the Java service. The administrator needs to implement a solution that: (1) automatically restarts the service if it becomes unresponsive, (2) limits the memory usage of the service to prevent OOM kills on the system, and (3) provides early warning of high memory usage. Which of the following approaches best meets these requirements?
29A system running RHEL 8 experiences intermittent crashes. After reboot, 'journalctl -p err -b -1' outputs: 'PID 1234 (myapp) ended due to signal: KILL'. Which diagnostic step should the administrator perform next?
30Which TWO commands can be used to display real-time process resource usage on a Linux system? (Choose two.)
31A system administrator is troubleshooting a production web server running CentOS 7 that became unresponsive. The server is still pingable, but SSH connections timeout. The admin performs an out-of-band console login. The server appears frozen; typing commands shows no output. The admin is able to trigger a Magic SysRq key sequence (Alt+SysRq+f) to kill the hung processes. After that, the server resumes normal operation. However, the admin wants to understand the root cause. Upon checking 'dmesg', they see repeated messages: 'NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s!' followed by stack traces from a kernel thread. Which action should the admin take to prevent recurrence while maintaining system stability?
32A user reports that a background process (PID 3456) is consuming 95% of CPU and causing system slowness. The process name is 'crypto-miner'. The administrator needs to immediately stop this process and ensure it does not restart. Which set of commands should the administrator execute?
33An administrator is investigating why the 'tomcat' service fails to start on a RHEL 8 server. The output of 'systemctl status tomcat' shows: 'Loaded: loaded (/etc/systemd/system/tomcat.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since ... Process: 4567 ExecStart=/opt/tomcat/bin/startup.sh (code=exited, status=1/FAILURE)'. The 'journalctl -u tomcat' shows: 'Error: JAVA_HOME is not defined correctly, cannot execute /usr/lib/jvm/java-11-openjdk/bin/java'. The admin checks /opt/tomcat/bin/startup.sh and sees it references JAVA_HOME. The admin verifies that Java 11 is installed at /usr/lib/jvm/java-11-openjdk. Which action should the admin take to fix the service?
34A developer reports that a custom daemon fails to start after a reboot. The daemon's unit file is located in /etc/systemd/system/custom.service. Which of the following is the most likely cause?
35A Linux server's root filesystem is filling up quickly. You suspect that a user's process is writing a large log file and that the file has been deleted, but the space is still held. Which command will show the deleted file and the process holding it open?
36A system administrator needs to ensure that the 'nginx' service starts automatically after a reboot on a system using systemd. The service unit file exists and is currently disabled. Which command should be used?
37A Linux server's boot process fails after a kernel upgrade. The GRUB2 menu appears, but selecting the newest kernel panics. You need to boot the previous kernel temporarily to recover the system. Which command should you use at the GRUB2 menu to edit the selected entry's boot parameters?
38A Linux server is configured to boot into a graphical target, but after a recent kernel update, the system hangs at a black screen after the GRUB menu. You can still access a rescue shell via the installation media. Which command should you use to make the system boot into a multi-user text target by default, allowing you to troubleshoot?
39A junior administrator needs to check the current system time and date on a Linux server. Which command will display this information?
40An administrator needs to ensure that a custom service, /usr/local/bin/monitor.sh, starts automatically at boot and is restarted if it crashes. The service should run as user 'monitor' and should not depend on network being online. Which systemd unit file configuration is most appropriate?
41A junior administrator needs to check the current runlevel and then change the system to runlevel 3 (multi-user, no GUI) on a SysVinit-based system. Which command sequence will accomplish this?
42A system administrator needs to schedule a one-time task that will run at 2:30 AM on July 15. Which command should be used to create this job?
43A Linux server is experiencing performance degradation. The administrator suspects that a process is consuming excessive CPU. Which two commands can be used to identify the top CPU-consuming processes in real-time? (Choose two.)
44A Linux server is experiencing performance issues. You need to identify which processes are consuming the most CPU and memory in real-time. Which two commands can provide this information interactively? (Choose two.)
45A Linux server is configured with a custom systemd service unit for a backup script. After editing /etc/systemd/system/backup.service to add an EnvironmentFile directive, the administrator runs 'systemctl start backup' but systemctl status shows the unit still using the old environment. Which command should the administrator run to apply the unit file changes?
46A Linux server has its time zone set to UTC, but the administrator wants the system clock to be synchronized by an internal NTP server at 10.0.0.10. The system uses systemd and chrony is already installed. Which command should the administrator run to configure the NTP server and make it persistent?
47A server is experiencing high load, and the administrator suspects a runaway process is consuming excessive CPU. The administrator wants to identify the top CPU-consuming processes and then terminate the most resource-intensive one. Which sequence of commands should the administrator use?
48A Linux administrator needs to schedule a backup script to run every day at 2:30 AM. The script is located at /usr/local/bin/backup.sh. Which command should the administrator use to edit the crontab for the root user?
49A Linux server has a filesystem mounted at /data that is running out of space. The administrator needs to identify which directories under /data are consuming the most disk space and then safely remove old log files. Which two commands should the administrator use? (Choose two.)
50A Linux server is experiencing performance issues. The administrator suspects that a process is causing excessive disk I/O. Which command should the administrator use to identify the process with the highest disk I/O usage in real-time?
51A Linux administrator needs to ensure that the 'httpd' service starts automatically at boot and is currently running. The system uses systemd. Which two commands should the administrator use to achieve this? (Choose two.)
52A Linux server's root filesystem is running out of space. The administrator needs to identify which directory under /var is consuming the most disk space. Which command should the administrator use?
You must be able to control services and boot targets, schedule jobs, read logs, and recover a system, all from the command line. The single most important thing: know when to use enable versus start, since persistence across reboots is what most tasks actually require.
The Courseiva LFCS question bank contains 52 questions in the Operation of Running Systems domain, covering the 13% of the exam attributed to this domain in the official Linux Foundation blueprint. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Operation of Running Systems domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included