LFCS Practice Exam 3 — 20 Questions

Question 1

A financial firm requires all internal SSH connections to be encrypted with at least 256-bit ciphers. An administrator is configuring the SSH server. Which configuration line should be added to /etc/ssh/sshd_config?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ciphers aes256-ctr. The Ciphers directive in sshd_config explicitly controls the symmetric encryption algorithms used to encrypt SSH session data. The cipher aes256-ctr provides 256-bit encryption, meeting the firm's requirement for at least 256-bit ciphers. Other directives like MACs, KexAlgorithms, or HostKeyAlgorithms do not directly set the encryption cipher strength.

Answer

MACs hmac-sha2-256

Answer

KexAlgorithms diffie-hellman-group-exchange-sha256

Answer

HostKeyAlgorithms ssh-rsa

Question 2

Which TWO of the following are valid ways to mount a filesystem with the 'noexec' option to prevent execution of binaries?

Accepted Answer

mount -o noexec /dev/sdb1 /mnt/data. Option A is correct because the mount command's -o flag accepts the noexec mount option directly, so 'mount -o noexec /dev/sdb1 /mnt/data' mounts the device /dev/sdb1 at /mnt/data with binary execution disabled. Option E is correct because the fourth field of an /etc/fstab entry holds the mount options, so adding 'noexec' there (e.g., 'defaults,noexec') makes the filesystem mount with noexec persistently at boot or on 'mount -a'. Option B is wrong because 'exec' is the opposite of noexec and explicitly permits execution. Option C is wrong because 'defaults' expands to rw,suid,dev,exec,auto,nouser,async, which includes exec and thus allows binaries to run. Option D is wrong because 'mount --bind' merely mirrors one directory tree onto another and does not itself set the noexec option.

Answer

Add 'exec' to the fourth field of /etc/fstab for the entry.

Answer

Add 'defaults' to the fourth field of /etc/fstab for the entry.

Answer

mount --bind /mnt/data1 /mnt/data2

Question 3

An administrator is troubleshooting a server that runs a critical application. The server has 16 GB of RAM and 8 CPU cores. The administrator notices that the server becomes very slow during peak hours. Analysis of 'iostat -x 1' shows that the average wait time (await) for the main disk (sda) is consistently above 1000 ms, while the average service time (svctm) is around 5 ms. What is the most likely cause?

Accepted Answer

There is a large queue of I/O requests waiting to be serviced.. The 'await' value in iostat represents the average time (in milliseconds) for I/O requests to be serviced, including time spent waiting in the queue. With 'await' at 1000+ ms and 'svctm' at only 5 ms, the vast majority of the time is spent waiting, not being serviced. This indicates a large queue of pending I/O requests, which is the direct cause of the slowdown.

Answer

The CPU is overloaded, causing processes to wait for CPU time.

Answer

The system is using swap space heavily, causing disk I/O.

Answer

The disk is experiencing hardware errors.

Question 4

A system administrator needs to ensure the Apache httpd service starts automatically on system boot. Which command should they use?

Accepted Answer

systemctl enable httpd. The `systemctl enable httpd` command creates the necessary symlinks in the systemd unit configuration directories (typically `/etc/systemd/system/multi-user.target.wants/`) to ensure the Apache httpd service starts automatically at boot time. This is the correct approach because `enable` configures the service to be started on system startup, whereas `start` only runs it immediately without affecting boot behavior.

Answer

systemctl start httpd

Answer

systemctl disable httpd

Answer

systemctl reload httpd

Question 5

Refer to the exhibit. The output of 'ps aux' shows a process named 'process_hog' with PID 1234 consuming 99.5% CPU. The process is stuck in an infinite loop and does not respond to SIGTERM. Which signal should be used to forcefully terminate it?

Accepted Answer

kill -9 1234. SIGKILL (signal 9) cannot be caught, blocked, or ignored by a process, making it the only reliable way to terminate a process that is stuck in an infinite loop and unresponsive to SIGTERM. Since the process does not respond to SIGTERM (signal 15), a forceful kill with kill -9 is necessary.

Answer

kill -2 1234

Answer

kill -15 1234

Answer

kill -19 1234

Question 6

You are managing a Linux server that hosts a critical web application. The server is running low on disk space in the root filesystem, and you need to free up space urgently. You run 'df -h' and see that /dev/sda1 is mounted on / and is 95% full. You also notice that /var/log/messages is over 2 GB in size. The application writes logs to /var/log/app.log, which is also large. The server has a separate /var partition that has plenty of free space. The application must continue running with minimal downtime. You need to compress and rotate logs without losing any data, and ensure that the root filesystem has at least 10% free space. Which of the following actions should you take first to achieve this goal?

Accepted Answer

Use logrotate with the 'copytruncate' option to rotate /var/log/app.log and move the rotated file to /var/old_logs/.. Logrotate with the 'copytruncate' option allows the application to continue writing to the same file descriptor while the current log is copied and then truncated to zero length. This avoids any application downtime and the rotated log can be moved to the separate /var partition (which has free space) for compression or archiving, freeing space on the root filesystem without data loss.

Answer

Delete /var/log/app.log and /var/log/messages to free space quickly.

Answer

Stop the application, truncate /var/log/app.log, then restart the application.

Answer

Compress /var/log/app.log using gzip and keep it in place.

Question 7

A system administrator needs to create a shared group 'projectx' and add existing users 'bob' and 'carol' to it. The users need to collaborate on files in a directory /projectx. What is the correct sequence of commands to set up the group and ensure new files created in /projectx are automatically owned by the group 'projectx'?

Accepted Answer

groupadd projectx; usermod -aG projectx bob; usermod -aG projectx carol; chmod g+s /projectx. It uses `groupadd` to create the group, `usermod -aG` to append users to the group without removing them from other groups, and `chmod g+s` to set the setgid bit on the directory. The setgid bit ensures that new files created in /projectx inherit the group ownership of the directory (projectx), enabling collaboration.

Answer

groupadd projectx; usermod -G projectx bob carol; chmod 2770 /projectx

Answer

addgroup projectx; adduser bob projectx; adduser carol projectx; chmod u+s /projectx

Answer

groupadd projectx; usermod -G projectx bob; usermod -G projectx carol; chmod g+s /projectx

Question 8

A systemd-networkd managed interface enp1s0 needs to be configured with a static IP address 192.168.1.100/24 and a default gateway via 192.168.1.1. Which .network file configuration is correct?

Accepted Answer

[Match]
Name=enp1s0
[Network]
Address=192.168.1.100/24
Gateway=192.168.1.1. Systemd-networkd uses the `[Match]` section with `Name=` to match the interface, and the `[Network]` section with `Address=` to assign a static IP address and `Gateway=` to set the default gateway. The syntax `Address=192.168.1.100/24` is the proper directive for defining a static IP address in a .network file, and `Gateway=192.168.1.1` correctly specifies the default gateway.

Answer

[Match]
Interface=enp1s0
[Network]
StaticIP=192.168.1.100/24
Gateway=192.168.1.1

Answer

[Link]
Name=enp1s0
[Network]
IPAddress=192.168.1.100/24
Gateway=192.168.1.1

Answer

[Match]
Name=enp1s0
[Network]
Address=192.168.1.100/24
DefaultGateway=192.168.1.1

Question 9

Which file stores the encrypted password (or password hash) for user accounts?

Accepted Answer

/etc/shadow. /etc/shadow is correct because it stores encrypted password hashes for user accounts, along with password aging information. It is readable only by root to prevent unauthorized access to password hashes. The /etc/passwd file historically stored passwords but now only contains user account information, with the password field replaced by an 'x' indicating the hash is in /etc/shadow.

Answer

/etc/group

Answer

/etc/passwd

Answer

/etc/gshadow

Question 10

A user wants to find all files in /var/log that have been modified within the last 2 days. Which command should they use?

Accepted Answer

find /var/log -mtime -2. The `find` command with `-mtime -2` searches for files whose content was last modified less than 2 days ago (i.e., within the last 48 hours). The minus sign before the number indicates 'less than' or 'within the last N days', which matches the user's requirement to find files modified within the last 2 days.

Answer

find /var/log -mmin -2880

Answer

find /var/log -mtime +2

Answer

find /var/log -mtime 2

Question 11

A system administrator receives an alert that disk /dev/sda is predicted to fail soon. The server uses LVM, and /dev/sda is part of a volume group named vg_system. Which of the following is the best course of action to replace the failing disk without downtime?

Accepted Answer

Use pvmove to move physical extents to another disk, then remove the old disk.. Pvmove relocates physical extents from /dev/sda to another physical volume in the same volume group while the filesystem remains online and accessible. This allows the failing disk to be removed from vg_system without any downtime, preserving LVM metadata and data integrity.

Answer

Use dd to clone /dev/sda to a new disk and then replace.

Answer

Use ddrescue to copy data, then replace the disk.

Answer

Remove /dev/sda from the volume group and add a new disk.

Question 12

A cron job runs a script every hour but sometimes fails because the script cannot find commands like 'tar' and 'gzip'. The script works when run manually from a terminal. What is the best fix?

Accepted Answer

Use absolute paths for all commands in the script.. Cron jobs run in a minimal environment with a restricted PATH (often just /usr/bin:/bin). When the script uses commands like 'tar' and 'gzip' without absolute paths, the shell cannot locate them. Using absolute paths (e.g., /bin/tar, /bin/gzip) ensures the script always finds the commands regardless of the environment.

Answer

Run the cron job as root.

Answer

Modify the script to source the user's .bashrc.

Answer

Add a PATH statement to the cron job definition.

Question 13

A developer reports that a web application's logs are not being written to /var/log/myapp.log. The service runs as user 'myapp' and the log directory /var/log/myapp/ has permissions 755 owned by root. What is the most likely cause?

Accepted Answer

The service user 'myapp' does not have write permission to the log directory.. The /var/log/myapp/ directory has permissions 755, which grants read and execute access to the 'others' category but not write. Since the service runs as user 'myapp', which is not the owner (root) and not in the root group, it falls under 'others' and thus lacks write permission. Without write permission on the directory, the service cannot create or write to /var/log/myapp.log, even if the file itself might have different permissions.

Answer

AppArmor is denying access.

Answer

SELinux is blocking the write.

Answer

The service is logging to systemd-journald instead of a file.

Question 14

Based on the exhibit, which process will be affected if the root user runs 'kill 5678'?

Accepted Answer

The www-data process with PID 5678. The 'kill 5678' command sends the default SIGTERM (signal 15) to the process with PID 5678. Since the root user has the CAP_KILL capability and is not subject to the ordinary permission checks that restrict non-root users, root can send signals to any process, including those owned by www-data. Therefore, the www-data process with PID 5678 will be terminated.

Answer

The root process (PID 1234)

Answer

All www-data processes

Answer

No process, because root cannot kill www-data processes

Question 15

Refer to the exhibit. A Linux administrator sees that 'myapp.service' is in a failed state with exit status 1. To troubleshoot, which command should the administrator use to view the full error output that the service produced before exiting?

Accepted Answer

journalctl -u myapp.service. journalctl -u myapp.service retrieves the full log output for that systemd unit from the journal, including stdout/stderr captured before the service exited with status 1. This is the correct tool to see the complete error trace, not just the summary. systemctl status only shows a truncated tail and the exit code.

Answer

systemctl status myapp.service

Answer

systemctl reload myapp.service

Answer

systemctl restart myapp.service

Question 16

Match each Linux boot component to its description.

Accepted Answer

BIOS/UEFI: Firmware that initializes hardware and loads the bootloader.. The correct matches are: BIOS/UEFI initializes hardware and loads the bootloader; Initramfs is the temporary root filesystem; Systemd is the init system. Common confusions occur between kernel and bootloader roles.

Answer

Bootloader (GRUB): Core of the OS that manages hardware and processes.

Answer

Kernel: Loads the kernel and initramfs into memory.

Question 17

An administrator needs to add a new 8 GB swap area on a server that already has a 2 GB swap partition. The system has free space in the volume group vg_sys. Which command creates a logical volume named lv_swap of exactly 8 GB and prepares it for swap use?

Accepted Answer

lvcreate -L 8G -n lv_swap vg_sys && mkswap /dev/vg_sys/lv_swap && swapon /dev/vg_sys/lv_swap. The correct procedure is to create the logical volume with lvcreate -L 8G -n lv_swap vg_sys, initialize it with mkswap, and activate it with swapon. The -L option specifies an absolute size in gigabytes, which matches the 8 GB requirement. Persistent activation requires an /etc/fstab entry, but the immediate creation and activation sequence is as shown.

Answer

vgcreate -L 8G -n lv_swap vg_sys && mkswap /dev/vg_sys/lv_swap && swapon /dev/vg_sys/lv_swap

Answer

lvcreate -L 8G -n lv_swap vg_sys && mkfs.swap /dev/vg_sys/lv_swap && swapon /dev/vg_sys/lv_swap

Answer

lvcreate -l 8 -n lv_swap vg_sys && mkswap /dev/vg_sys/lv_swap && swapon -a

Question 18

A system administrator needs to prevent a service named backup.service from starting automatically at boot, while keeping it available for manual start. The service is currently enabled. Which command should the administrator run?

Accepted Answer

systemctl disable backup.service. To prevent automatic startup while retaining the ability to start manually, the service must be disabled. Disabling removes the boot-time symlinks but leaves the unit file intact. Masking would prevent manual start, and stopping or killing only affects the current runtime state.

Answer

systemctl stop backup.service

Answer

systemctl mask backup.service

Answer

systemctl kill backup.service

Question 19

A security audit reveals that a sensitive file '/etc/shadow' has been modified. The file's permissions are set to 600 and owned by root. However, the audit logs show that a service account 'webapp' was able to read the file. The 'webapp' user is not in the root group. Which of the following is the most likely method the 'webapp' user used to read the file?

Accepted Answer

The file has an Access Control List (ACL) granting read permission to 'webapp'.. An Access Control List (ACL) can grant specific permissions to a user or group beyond the traditional Unix permission model. Even though the file's mode is 600 (owner read/write only) and owned by root, a setfacl command could have added an ACL entry (e.g., 'u:webapp:r') that explicitly allows the 'webapp' user to read /etc/shadow. This is a common method to give a service account access to a sensitive file without changing its ownership or group membership.

Answer

The file is a hard link to another file that is readable by 'webapp'.

Answer

The 'webapp' user exploited a SUID binary that reads the file.

Answer

The 'webapp' user used 'sudo' to read the file as root.

Question 20

A system administrator needs to ensure that a custom service named 'myapp.service' starts automatically after a reboot and also restarts automatically no matter how the service stops, even if it exits normally. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Run 'systemctl enable myapp.service' to enable the service.. Option B is correct because 'systemctl enable myapp.service' creates the necessary symlinks (typically under /etc/systemd/system/*.wants/) so systemd starts the unit automatically at boot, satisfying the reboot requirement. Option D is correct because 'Restart=always' in the [Service] section instructs systemd to restart the service regardless of exit status, including a clean exit code 0, which matches the requirement that it restart no matter how it stops. Option C is incorrect because 'Restart=on-failure' only restarts on non-zero exit codes, signals, or timeouts, so a normal exit would not trigger a restart. Option A is incorrect because 'systemctl mask' links the unit to /dev/null and prevents it from being started at all, the opposite of the desired behavior. Option E is incorrect because 'After=network.target' only orders startup relative to the network target and does not enable boot startup or automatic restarts.

Answer

Run 'systemctl mask myapp.service' to prevent manual stops.

Answer

Set 'Restart=on-failure' in the [Service] section of the service file.

Answer

Add 'After=network.target' to the [Unit] section of the service file.