LFCS Practice Exam 2 — 20 Questions

Question 1

A junior administrator needs to create a compressed archive of the /etc directory that preserves file ownership and permissions, and writes it to /backup/etc.tar.gz. Which single command accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

tar -czvf /backup/etc.tar.gz /etc. Creating a gzip-compressed tarball requires the create, gzip, verbose, and file flags together with the source directory. The combination tar -czvf /backup/etc.tar.gz /etc builds the archive in one pass, preserving metadata, and writes it to the specified path. The other commands either attempt extraction, misuse compression tools, or produce non-tar output.

Answer

gzip -r /etc > /backup/etc.tar.gz

Answer

cpio -ov /etc < /backup/etc.tar.gz

Answer

tar -xzvf /backup/etc.tar.gz /etc

Question 2

A user needs to view the contents of a compressed log file /var/log/syslog.gz without first decompressing it. Which command should they use?

Accepted Answer

zcat /var/log/syslog.gz. `zcat` is specifically designed to read the contents of gzip-compressed files without permanently decompressing them. It decompresses the data on the fly and sends the output to stdout, allowing the user to view the log file's contents directly from the terminal.

Answer

gzip -d /var/log/syslog.gz

Answer

gunzip /var/log/syslog.gz

Answer

cat /var/log/syslog.gz

Question 3

You are a system administrator for a company that runs a web server on a Linux system. The web server logs are stored in /var/log/nginx/access.log. The log file grows rapidly and rotates weekly via logrotate. The system has been running for several months. Recently, the development team reported that the web server is responding slowly. You suspect that the disk I/O might be high due to log file activity. You check the disk usage and find that /var/log/nginx/access.log is 4 GB, and the rotated logs (access.log.1.gz, access.log.2.gz, etc.) total another 10 GB. The /var partition has 20 GB total, so it's 70% full. You decide to reduce the disk usage by compressing the current log file and truncating it without stopping the nginx service. Which command sequence should you use to safely achieve this?

Accepted Answer

cp /var/log/nginx/access.log /var/log/nginx/access.log.bak && :> /var/log/nginx/access.log && gzip /var/log/nginx/access.log.bak. It first copies the current log file to a backup, then truncates the original file in place using the shell null command (`:>`) without stopping nginx, and finally compresses the backup. This ensures nginx continues writing to the same inode (file descriptor remains valid) and the disk space is reclaimed after compression.

Answer

:> /var/log/nginx/access.log && cp /var/log/nginx/access.log /var/log/nginx/access.log.bak && gzip /var/log/nginx/access.log.bak

Answer

rm /var/log/nginx/access.log && touch /var/log/nginx/access.log && chmod 644 /var/log/nginx/access.log

Answer

mv /var/log/nginx/access.log /var/log/nginx/access.log.bak && touch /var/log/nginx/access.log && gzip /var/log/nginx/access.log.bak

Question 4

Order the steps to set up a LVM logical volume from a new disk.

Accepted Answer

Create physical volume (pvcreate), then volume group (vgcreate), then logical volume (lvcreate), then format with filesystem (mkfs), then mount.. The correct sequence for setting up an LVM logical volume from a new disk is: first create a physical volume (PV) using pvcreate, then create a volume group (VG) with vgcreate, then create a logical volume (LV) with lvcreate, then format the LV with a filesystem using mkfs, and finally mount it to a directory. This order ensures all dependencies are satisfied: the VG requires the PV, the LV requires the VG, and the filesystem requires the LV.

Answer

Create volume group (vgcreate), then physical volume (pvcreate), then logical volume (lvcreate), then format, then mount.

Answer

Create physical volume (pvcreate), then format (mkfs), then volume group (vgcreate), then logical volume (lvcreate), then mount.

Answer

Create logical volume (lvcreate), then physical volume (pvcreate), then volume group (vgcreate), then format, then mount.

Question 5

An administrator needs to add a new swap space to a running Linux server without rebooting. The server has a free partition /dev/sdc1 and an existing file /swapfile. Which two commands or steps are required to activate the new swap partition /dev/sdc1 immediately? (Choose two.)

Accepted Answer

swapon /dev/sdc1. To activate a new swap partition immediately, you must first initialize it with mkswap, then enable it with swapon. These two commands prepare and activate the swap space without requiring a reboot. Adding an fstab entry is for persistence across reboots, and swapoff or mount are not appropriate for enabling swap.

Answer

swapoff /dev/sdc1

Answer

mount -t swap /dev/sdc1 /mnt

Answer

echo '/dev/sdc1 none swap sw 0 0' >> /etc/fstab

Question 6

A security policy requires that a user's password must expire 90 days after last change, and the user must change it immediately on next login. The last password change was 30 days ago. Which set of commands achieves this?

Accepted Answer

chage -M 90 user1; chage -d 0 user1. `chage -M 90 user1` sets the maximum password age to 90 days, and `chage -d 0 user1` forces the password to expire immediately (setting the last change date to epoch 0), which requires the user to change the password on the next login. This satisfies both requirements: the password will expire 90 days after the forced change, and the user must change it immediately.

Answer

chage -M 90 user1; chage -m 1 user1

Answer

chage -M 90 user1; chage -W 7 user1

Answer

chage -M 90 user1; chage -I 5 user1

Question 7

Refer to the exhibit. The service unit file has Restart=on-failure, but systemctl show displays Restart=no. What is the most likely reason?

Accepted Answer

The unit file was edited but systemctl daemon-reload was not run.. The most likely reason is that the unit file was edited but `systemctl daemon-reload` was not executed. When a service unit file is modified, systemd does not automatically reload the configuration; it continues to use the cached version until `systemctl daemon-reload` is run. This explains why `systemctl show` displays `Restart=no` despite the file containing `Restart=on-failure`.

Answer

The User=backup directive overrides Restart.

Answer

The unit is not enabled.

Answer

The Restart directive is only valid for Type=simple.

Question 8

A service unit has the directive 'ExecStartPre=/bin/true' and 'ExecStart=/usr/bin/myapp'. What is the effect of ExecStartPre?

Accepted Answer

It runs a pre-start script; if it fails, the service is not started.. ExecStartPre is a systemd directive that specifies a command to run before the main ExecStart command. If the ExecStartPre command fails (returns a non-zero exit code), systemd will not proceed to start the service, unless the '-' prefix is used to ignore failure. Here, /bin/true always succeeds (exit code 0), so it does not block the service, but the directive itself is designed to enforce a pre-start check.

Answer

It sets an environment variable.

Answer

It runs a post-start script.

Answer

It runs a pre-start script; if it fails, the service still starts.

Question 9

An administrator is unable to SSH into the server from a remote host at 192.168.1.100. Based on the exhibited iptables rules, what is the most likely reason?

Accepted Answer

The SSH rule only allows connections from 10.0.1.0/24, and 192.168.1.100 is not in that subnet. The exhibited iptables rules show an SSH rule that explicitly accepts incoming TCP traffic on port 22 only from the source subnet 10.0.1.0/24. The remote host at 192.168.1.100 is not within that subnet, so the SSH rule does not match, and the packet will fall through to the next rule or the default policy. Since no other rule permits SSH from 192.168.1.100, the connection is implicitly dropped or rejected, preventing SSH access.

Answer

SSH is not allowed from any source

Answer

The INPUT chain policy is ACCEPT, so SSH should be allowed

Answer

The DROP rule for SSH is not matching because of packet count zero

Question 10

Order the steps to recover a forgotten root password on a Linux system using single-user mode.

Accepted Answer

1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Change root password, 4. Reboot.. To recover a forgotten root password on Linux using single-user mode, you must first boot into single-user mode (e.g., by adding 'single' to the kernel command line). At the root prompt, the filesystem is mounted read-only, so you must remount it as read-write with 'mount -o remount,rw /'. Then use 'passwd root' to set a new password. Finally, reboot the system. Attempting to change the password without remounting or rebooting prematurely will cause the recovery to fail.

Answer

1. Boot into single-user mode, 2. Change root password, 3. Remount filesystem as read-write, 4. Reboot.

Answer

1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Reboot, 4. Change root password.

Answer

1. Change root password, 2. Boot into single-user mode, 3. Remount filesystem as read-write, 4. Reboot.

Question 11

Order the steps to create a systemd service unit that runs a script at boot.

Accepted Answer

Create the unit file, then enable the service for boot, then start the service, then check the status.. Creating the unit file, enabling for boot, starting, and checking status are standard steps.

Answer

Start the service, then create the unit file, then enable for boot, then check status.

Answer

Enable the service for boot, then create the unit file, then start, then check status.

Answer

Create the unit file, then start the service, then enable for boot, then check status.

Question 12

Match each Linux permission type to its symbolic representation.

Accepted Answer

Read: r. In Linux, standard file permissions are represented by symbols: read (r), write (w), and execute (x). Each permission type maps to a unique symbol. Confusion often arises from swapping these symbols.

Answer

Read: w

Answer

Write: x

Answer

Execute: r

Question 13

A custom systemd service unit file has been created but the service fails to start with 'Exec format error'. What is the most likely cause?

Accepted Answer

The ExecStart command path is incorrect or missing shebang. The 'Exec format error' in systemd indicates that the binary or script specified in the ExecStart directive cannot be executed, typically because the path is incorrect, the file is not executable, or (most commonly) the script lacks a valid shebang line (e.g., #!/bin/bash). Without a shebang, the kernel does not know which interpreter to use, causing an execve() failure.

Answer

The unit file has incorrect permissions

Answer

The user does not have permission to start the service

Answer

The service is disabled

Question 14

A junior administrator issued the command 'usermod -L alice' to lock the account of user alice. However, alice is still able to log in via SSH using a public key. What is the most likely reason?

Accepted Answer

The usermod -L command only locks the password but does not prevent SSH key-based authentication.. The `usermod -L` command locks the user's password by placing an exclamation mark (!) in the second field of the /etc/shadow file, which prevents password-based authentication. However, SSH public key authentication does not rely on the password field; it uses the authorized_keys file and the SSH daemon's public key challenge-response mechanism. Therefore, even with a locked password, the user can still log in via SSH if their public key is present in ~/.ssh/authorized_keys.

Answer

The usermod -L command only changes the user's shell to /sbin/nologin.

Answer

The usermod -L command requires a restart of the SSH service to take effect.

Answer

The usermod -L command is not effective on accounts with a UID less than 1000.

Question 15

Which THREE commands can be used to list all users currently logged into the system?

Accepted Answer

w. The w command (A) is correct because it reads /var/run/utmp and displays every user currently logged in along with their terminal, source host, login time, idle time, and current process. The users command (C) is correct because it prints a space-separated list of the login names of all users currently logged into the system, derived from utmp. The who command (E) is correct because it also reads utmp and lists currently logged-in users with their terminal, login time, and remote host. The last command (B) is not correct here because it reads /var/log/wtmp and shows historical login/logout records, including past sessions, not only users currently logged in. The id command (D) is not correct because it displays the UID, GID, and group memberships of a single specified or current user rather than listing all logged-in users.

Answer

last

Answer

id

Question 16

After creating an XFS filesystem on /dev/sdb1, an admin mounts it and writes data. Later, they run 'xfs_info /mnt/data' and see the filesystem was created with default settings. What is the default inode size for XFS on a typical Linux system?

Accepted Answer

256 bytes. The default inode size for XFS on a typical Linux system is 256 bytes. This is set at filesystem creation time and provides a balance between supporting extended attributes (like ACLs and SELinux contexts) and minimizing metadata overhead. The `xfs_info` command confirms the default settings, which include this 256-byte inode size.

Answer

512 bytes

Answer

128 bytes

Answer

4096 bytes

Question 17

Based on the journalctl output, what is the most likely cause of the service failure?

Accepted Answer

Another process is already using port 8080.. The journalctl output shows a bind error on port 8080 with 'Address already in use'. This indicates that another process is already listening on that port, preventing the service from starting. In systemd, such a failure is logged with the specific errno EADDRINUSE, which directly points to a port conflict.

Answer

The service configuration file has a syntax error.

Answer

The system is out of memory.

Answer

The service is trying to write to a read-only filesystem.

Question 18

A service named webserver.service is failing to start. The administrator wants to see the most recent error messages related to this service. Which command provides this information?

Accepted Answer

journalctl -u webserver.service. The `journalctl -u webserver.service` command queries the systemd journal for all log entries associated with the specified unit, showing the most recent error messages in reverse chronological order. This is the standard way to view detailed, time-stamped error logs for a failing service, as `journalctl` provides access to the binary journal that captures stdout, stderr, and syslog messages from the service.

Answer

systemctl status webserver.service --full

Answer

systemctl list-units --type=service | grep webserver

Answer

systemctl is-active webserver.service

Question 19

An e-commerce company runs a critical application on a Linux server that occasionally becomes unresponsive. The server has 64GB RAM and runs a Java application. The operations team notices that during peak hours, the system becomes very slow and eventually the application crashes with 'OutOfMemoryError'. After restart, it works fine for a while. They suspect a memory leak but also want to ensure the system does not go down during peak hours. The system uses systemd to manage the Java service. The administrator needs to implement a solution that: (1) automatically restarts the service if it becomes unresponsive, (2) limits the memory usage of the service to prevent OOM kills on the system, and (3) provides early warning of high memory usage. Which of the following approaches best meets these requirements?

Accepted Answer

Configure systemd service with WatchdogSec=30, Restart=on-failure, MemoryMax=32G. Also set up a log watcher that alerts when memory usage exceeds 28G via journalctl and a custom script.. It uses systemd's WatchdogSec to detect unresponsiveness and Restart=on-failure to automatically restart the service, while MemoryMax=32G enforces a hard memory limit via cgroups to prevent OOM kills. The custom log watcher provides early warning by alerting when memory usage exceeds 28G, satisfying all three requirements.

Answer

Set up a cron job to run every minute that checks memory usage with free and if > 90%, restart the service with systemctl restart. Also configure MemoryMax=32G in the systemd unit.

Answer

Configure sysctl vm.overcommit_memory=2 to prevent overcommit, and allocate huge pages for Java. Also set Restart=always in the systemd unit.

Answer

Use ulimit -v 33554432 in the service script to limit virtual memory, and set Restart=always. Also configure a cron job to send alerts when dmesg shows OOM.

Question 20

A system administrator is setting up a high-availability cluster using shared storage. Which filesystem is best suited for this environment where multiple nodes need simultaneous read-write access to the same filesystem?

Accepted Answer

GFS2. GFS2 (Global File System 2) is a shared-disk cluster filesystem designed for high-availability environments where multiple nodes require simultaneous read-write access to the same filesystem. It uses a distributed lock manager (DLM) to coordinate access across nodes, ensuring data consistency without requiring a single metadata server. This makes it ideal for active-active cluster configurations with shared block storage.

Answer

Btrfs

Answer

XFS

Answer

ext4