LFCS Practice Test 11 — 15 Questions

Question 1

A system administrator needs to identify all available block devices on a Linux server. Which two commands can be used to accomplish this? (Choose two.)

Accepted Answer

lsblk. The `lsblk` command lists all available block devices (e.g., disks, partitions, LVM volumes) by reading the sysfs filesystem, providing a tree-like view of device hierarchy. The `fdisk -l` command displays the partition table for all block devices, showing detailed information about disk geometry and partitions. Both commands are standard tools for identifying block devices on a Linux system.

Answer

blkid

Answer

mount

Answer

df -h

Question 2

A host with this routing table can ping 10.0.2.1 but cannot ping 8.8.8.8. What is the most likely cause?

Accepted Answer

The default gateway 10.0.1.1 does not have internet connectivity. The host can ping 10.0.2.1, which is on the directly connected 10.0.2.0/24 network, confirming that the local interface and link-layer are functional. However, it cannot ping 8.8.8.8, a public internet address. The routing table shows a default route via 10.0.1.1, so the host will forward the packet to that gateway. Since the host has a default route, the most likely cause is that the gateway 10.0.1.1 itself lacks internet connectivity (e.g., no upstream route, NAT misconfiguration, or ISP outage), preventing the packet from reaching 8.8.8.8.

Answer

The default route is missing

Answer

The host has no route to 10.0.2.0/24

Answer

The host has no route to 10.0.1.1

Question 3

An administrator needs to configure a service to run as a non-root user for security reasons. Which systemd unit file directive accomplishes this?

Accepted Answer

User=myuser. The `User=` directive in a systemd unit file specifies the user (by name or UID) under which the service process runs. By setting `User=myuser`, the service executes with the privileges of that non-root user, reducing the attack surface and adhering to the principle of least privilege. This is the standard systemd mechanism for dropping root privileges for a service.

Answer

AmbientCapabilities=CAP_NET_BIND_SERVICE

Answer

DynamicUser=yes

Answer

Group=myuser

Question 4

A system has a process stuck in uninterruptible sleep (D state). The administrator wants to identify which kernel function it is waiting on. Which tool should be used?

Accepted Answer

cat /proc/PID/stack. Reading /proc/PID/stack directly shows the kernel stack trace of the process, revealing the exact kernel function or wait queue the process is blocked on while in uninterruptible sleep (D state). This is the only tool listed that can inspect the kernel-side call stack without attaching a debugger or altering process state.

Answer

gdb -p PID

Answer

perf top -p PID

Answer

strace -p PID

Question 5

Based on the exhibit, which port is listening only on the loopback interface?

Accepted Answer

53. Port 53 (DNS) is configured to listen only on the loopback interface (127.0.0.1) as shown in the exhibit's output of `ss -tlnp`. The listening address `127.0.0.1:53` indicates the service is bound exclusively to the loopback interface, meaning it is not accessible from external network interfaces.

Answer

22

Answer

443

Answer

80

Question 6

A server on a corporate network is intermittently losing connectivity. The administrator runs 'tcpdump -i eth0 icmp' and sees 'ICMP time exceeded in-transit' messages from a router. What is the most likely cause?

Accepted Answer

There is a routing loop or the TTL is too low.. The 'ICMP time exceeded in-transit' message indicates that a packet's TTL (Time to Live) has reached zero before reaching its destination. This is most commonly caused by a routing loop, where packets circulate endlessly between routers, or by an initial TTL value that is too low for the number of hops required. The router that decrements the TTL to zero sends this ICMP Type 11 Code 0 message back to the source, as defined in RFC 792.

Answer

There is a mismatch in MTU size.

Answer

The destination host is down.

Answer

A firewall is blocking the packets.

Question 7

A user needs to view the contents of a large text file one screen at a time. Which command is best for this?

Accepted Answer

less file.txt. `less` is a terminal pager that allows forward and backward navigation through a file, making it ideal for viewing large text files one screen at a time. Unlike `more`, `less` supports scrolling both up and down, and it does not load the entire file into memory, which is efficient for large files.

Answer

nl file.txt

Answer

more file.txt

Answer

cat file.txt

Question 8

A junior administrator issued the command 'usermod -L alice' to lock the account of user alice. However, alice is still able to log in via SSH using a public key. What is the most likely reason?

Accepted Answer

The usermod -L command only locks the password but does not prevent SSH key-based authentication.. The `usermod -L` command locks the user's password by placing an exclamation mark (!) in the second field of the /etc/shadow file, which prevents password-based authentication. However, SSH public key authentication does not rely on the password field; it uses the authorized_keys file and the SSH daemon's public key challenge-response mechanism. Therefore, even with a locked password, the user can still log in via SSH if their public key is present in ~/.ssh/authorized_keys.

Answer

The usermod -L command only changes the user's shell to /sbin/nologin.

Answer

The usermod -L command requires a restart of the SSH service to take effect.

Answer

The usermod -L command is not effective on accounts with a UID less than 1000.

Question 9

A system administrator has a cron job that runs a backup script. The script requires the variable BACKUP_DIR to be set, but the administrator cannot modify the script. Which is the most appropriate place to define the variable for cron?

Accepted Answer

In the crontab file with the line 'BACKUP_DIR=/var/backups' before the command. Cron jobs run in a minimal environment and do not source shell profiles or login scripts. Defining BACKUP_DIR directly in the crontab file before the command ensures the variable is set in the cron execution context, which is the only reliable way to pass environment variables to cron without modifying the script.

Answer

In /etc/profile.d/backup.sh

Answer

In /etc/environment

Answer

In ~/.bash_profile

Question 10

Given the routing table, if the server sends a packet to destination 10.0.1.200, which interface will be used and what is the next hop?

Accepted Answer

eth1 directly to 10.0.1.200. The destination 10.0.1.200 falls within the directly connected network 10.0.1.0/24 on eth1. According to the routing table, this route has a /24 netmask and is marked as directly connected, meaning no next-hop router is needed. The server will ARP for 10.0.1.200 and send the packet directly to that host via eth1.

Answer

eth1 via 10.0.1.1

Answer

eth0 with next hop 10.0.0.1

Answer

eth0 with next hop 10.0.1.200

Question 11

A network engineer needs to temporarily disable a network interface eth1 without bringing it down permanently. Which command?

Accepted Answer

ip link set eth1 down. The `ip link set eth1 down` command temporarily disables the eth1 interface by changing its state to DOWN at the kernel level, without making any persistent changes to configuration files. This is the correct approach for a temporary disable because the interface can be re-enabled with `ip link set eth1 up` and will revert to its configured state upon reboot.

Answer

systemctl stop network

Answer

nmcli device disconnect eth1

Answer

ifdown eth1

Question 12

Based on the iptables-save output, what is the default policy for the FORWARD chain and what happens to a new SSH connection from an external host on eth0?

Accepted Answer

Default policy FORWARD is DROP; SSH connections are accepted.. The default policy for the FORWARD chain is DROP, as shown in the iptables-save output (e.g., `:FORWARD DROP [0:0]`). A new SSH connection from an external host on eth0 is accepted because there is a rule in the FORWARD chain that matches incoming SSH traffic (typically TCP port 22) and has a target of ACCEPT, overriding the default DROP policy for that specific traffic.

Answer

Default policy FORWARD is ACCEPT; SSH connections are dropped.

Answer

Default policy FORWARD is DROP; SSH connections are dropped.

Answer

Default policy FORWARD is ACCEPT; SSH connections are accepted.

Question 13

Which TWO commands can be used to check the status of a service?

Accepted Answer

service status. The `service` command is a legacy SysV init wrapper that can query the status of a service by calling the appropriate init script with the `status` argument. It remains available on many Linux distributions for backward compatibility, making it a valid tool to check service status.

Answer

systemd-analyze

Answer

start stop restart

Answer

initctl status

Question 14

A Linux server hosts a critical web application and is connected to the corporate network via a bonded interface bond0, combining eth0 and eth1 in active-backup mode. The server has a static IP 192.168.1.100/24 and default gateway 192.168.1.1. Recently, users report intermittent connectivity. The administrator runs 'ip link show' and sees that eth0 and eth1 are both state UP, but bond0 shows 'state UP' and 'NO-CARRIER'. The bond primary slave is eth0. Also, 'ping 192.168.1.1' fails. What should the administrator do next?

Accepted Answer

Check the physical cable connection of eth0.. The bond interface showing NO-CARRIER indicates a physical link problem on the active slave. Since eth0 is the primary slave and bond0 has no carrier, the most likely cause is a disconnected or faulty cable on eth0. Checking the physical connection is the appropriate first step. Changing the bond mode or restarting services would not resolve a physical issue, and adding a secondary IP is irrelevant.

Answer

Add a secondary IP address to eth0.

Answer

Restart the NetworkManager service.

Answer

Change the bond mode to balance-rr to load balance traffic.

Question 15

A system administrator notices that the disk space on the root filesystem is at 95% usage. After investigating, they find that a large log file named 'access.log' in /var/log is taking up significant space. The administrator deletes the file using 'rm /var/log/access.log' but the disk usage remains at 95%. Running 'df -h' still shows the same usage. What is the most likely cause and the correct next step?

Accepted Answer

The file is still open by a process. Use 'lsof | grep access.log' to identify the process and restart it.. When a file is deleted with 'rm' while it is still open by a running process, the file's directory entry is removed, but the inode and data blocks remain allocated until the process closes the file descriptor. This causes 'df' to still report the space as used. The correct next step is to use 'lsof' to find the process holding the file open and restart it, which releases the file descriptor and frees the disk space.

Answer

The file is compressed and needs to be decompressed. Use 'gzip -d access.log' first.

Answer

The filesystem is marked as full in the superblock. Use 'fsck' to repair the filesystem.

Answer

The file has multiple hard links. Use 'find / -links +1' to locate all hard links and delete them.