LFCS Practice Test 10 — 10 Questions

Question 1

Match each systemd unit type to its purpose.

Accepted Answer

service: Manages daemon processes that run in the background. Correct matches: service manages processes, socket handles socket activation, timer schedules events, target groups units. Common confusion: mixing socket and timer responsibilities is typical.

Answer

service: Manages IPC or network socket activation

Answer

socket: Manages time-based event scheduling

Question 2

After a kernel update, a service fails to start with 'cannot allocate memory'. The system has 16GB RAM and 8GB swap. Which command should the administrator run first to diagnose potential memory limits?

Accepted Answer

ulimit -a. `ulimit -a` displays all current user-level resource limits, including `max memory size`, `max processes`, and `max locked memory`. After a kernel update, the service may be hitting a newly enforced or reduced `ulimit` (e.g., `RLIMIT_AS` or `RLIMIT_DATA`), which can cause 'cannot allocate memory' even when system memory is abundant. This command is the fastest way to check if a per-process limit is the culprit.

Answer

free -m

Answer

cat /proc/meminfo

Answer

sysctl vm.overcommit_memory

Question 3

A server uses firewalld. Which command permanently allows HTTP traffic?

Accepted Answer

firewall-cmd --add-service=http --permanent. The `--permanent` flag is required to make the rule persist across reboots when using `firewall-cmd`. Without it, the rule is only added to the runtime configuration and will be lost after a firewall reload or system restart. The `--add-service=http` parameter uses the predefined service definition for HTTP (port 80/tcp), which is the proper way to allow HTTP traffic in firewalld.

Answer

firewall-cmd --add-service=http

Answer

firewall-cmd --add-port=80/tcp

Answer

systemctl reload firewalld

Question 4

Refer to the exhibit. What is the most likely security issue?

Accepted Answer

Someone is attempting to brute-force the root password.. The exhibit shows multiple failed SSH login attempts for the root user from the same IP address in quick succession, as seen in the auth.log or secure log entries. This pattern indicates a brute-force attack, where an attacker systematically tries different passwords to gain unauthorized root access. Option C is correct because the repeated 'Failed password for root' messages are the hallmark of a brute-force attempt.

Answer

SSH service is not running.

Answer

The root account is disabled.

Answer

The firewall is blocking SSH.

Question 5

You are a systems administrator for a company that runs a critical application on a Linux server with two network interfaces: eth0 (public IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (private IP 10.0.1.10/24, no gateway). The server must be accessible via SSH (port 22) from the internet, but only from a specific management subnet 198.51.100.0/24. Additionally, the server should be able to access the internet for package updates, but no other inbound traffic from the internet is allowed. The local firewall is iptables. After implementing rules, you find that the server cannot reach the internet (e.g., ping 8.8.8.8 fails), but SSH from the management subnet works. What is the most likely cause?

Accepted Answer

The iptables rules do not include a rule to allow established and related connections. Iptables is stateful: by default, the INPUT chain processes only the first packet of a connection. Without a rule allowing established and related connections (e.g., `-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`), return traffic from the server's outbound internet requests (e.g., ping to 8.8.8.8) is blocked by the INPUT chain, causing the failure. SSH from the management subnet works because the initial SYN packet is allowed, but the server's outbound traffic fails because the response packets are not recognized as part of an allowed flow.

Answer

The server's DNS resolver is not configured

Answer

The SSH rule is misconfigured and accidentally blocks all traffic

Answer

The default policy on the INPUT chain is DROP

Question 6

A system administrator needs to check the firewall rules on a Linux server using firewalld. Which two commands can be used to list the current rules? (Choose two.)

Accepted Answer

firewall-cmd --list-all-zones. `firewall-cmd --list-all-zones` displays the firewall rules for all zones configured in firewalld, showing services, ports, and rules per zone. Option E is correct because `firewall-cmd --list-all` lists the rules for the default zone, providing a concise view of active firewall configuration. Both commands are native to firewalld and directly query its runtime and permanent rules via D-Bus.

Answer

systemctl status firewalld

Answer

iptables -S

Answer

iptables -L

Question 7

A system administrator notices that the disk space on the root filesystem is at 95% usage. After investigating, they find that a large log file named 'access.log' in /var/log is taking up significant space. The administrator deletes the file using 'rm /var/log/access.log' but the disk usage remains at 95%. Running 'df -h' still shows the same usage. What is the most likely cause and the correct next step?

Accepted Answer

The file is still open by a process. Use 'lsof | grep access.log' to identify the process and restart it.. When a file is deleted with 'rm' while it is still open by a running process, the file's directory entry is removed, but the inode and data blocks remain allocated until the process closes the file descriptor. This causes 'df' to still report the space as used. The correct next step is to use 'lsof' to find the process holding the file open and restart it, which releases the file descriptor and frees the disk space.

Answer

The file is compressed and needs to be decompressed. Use 'gzip -d access.log' first.

Answer

The filesystem is marked as full in the superblock. Use 'fsck' to repair the filesystem.

Answer

The file has multiple hard links. Use 'find / -links +1' to locate all hard links and delete them.

Question 8

A junior administrator needs to display the first 10 lines of a file named 'data.csv'. Which command should they use?

Accepted Answer

head data.csv. The `head` command is specifically designed to display the first 10 lines of a file by default. Running `head data.csv` will output the first 10 lines of the CSV file, making it the correct choice for this task.

Answer

less data.csv

Answer

tail data.csv

Answer

cat data.csv

Question 9

A Linux server hosts a shared project workspace at /srv/design. The directory is owned by root and currently has permissions 0775 with group ownership set to the 'designers' group. A new file was just created inside /srv/design by user 'mira' (a member of designers), and the file's group is showing as 'mira' instead of 'designers'. The team lead wants every NEW file and subdirectory created under /srv/design to automatically inherit the 'designers' group, while leaving existing files untouched. Which command should the administrator run?

Accepted Answer

chmod g+s /srv/design. The setgid bit on a directory is the standard mechanism for group inheritance: any file or subdirectory created inside the directory takes the directory's group as its own group. Using chmod g+s on /srv/design applies this behavior without touching existing files or changing individual user group memberships.

Answer

chgrp -R designers /srv/design

Answer

setfacl -R -m g:designers:rwx /srv/design

Answer

chmod +t /srv/design

Question 10

Which THREE of the following commands can be used to view the contents of a compressed file named 'file.gz' without permanently decompressing it? (Choose exactly three.)

Accepted Answer

zmore file.gz. Option B (zmore file.gz) is correct because zmore is a filter that pipes the decompressed output of gzip-compressed files through more, letting you page through the contents without writing a decompressed file to disk. Option D (zcat file.gz) is correct because zcat decompresses the file to standard output, displaying its contents on screen while leaving the original file.gz intact. Option E (zless file.gz) is correct because zless uses less to page through the decompressed stream of a gzip file, again without permanently decompressing it. Option A (gzip file.gz) is wrong because gzip is used to compress files (and would actually try to compress file.gz further), not to view contents. Option C (gunzip file.gz) is wrong because gunzip permanently decompresses the file, replacing file.gz with an uncompressed file, which is exactly what the question excludes.

Answer

gzip file.gz

Answer

gunzip file.gz