LFCS Practice Test 2 — 25 Questions

Question 1

A security policy requires that a user's password must expire 90 days after last change, and the user must change it immediately on next login. The last password change was 30 days ago. Which set of commands achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

chage -M 90 user1; chage -d 0 user1. `chage -M 90 user1` sets the maximum password age to 90 days, and `chage -d 0 user1` forces the password to expire immediately (setting the last change date to epoch 0), which requires the user to change the password on the next login. This satisfies both requirements: the password will expire 90 days after the forced change, and the user must change it immediately.

Answer

chage -M 90 user1; chage -m 1 user1

Answer

chage -M 90 user1; chage -W 7 user1

Answer

chage -M 90 user1; chage -I 5 user1

Question 2

Refer to the exhibit. The service unit file has Restart=on-failure, but systemctl show displays Restart=no. What is the most likely reason?

Accepted Answer

The unit file was edited but systemctl daemon-reload was not run.. The most likely reason is that the unit file was edited but `systemctl daemon-reload` was not executed. When a service unit file is modified, systemd does not automatically reload the configuration; it continues to use the cached version until `systemctl daemon-reload` is run. This explains why `systemctl show` displays `Restart=no` despite the file containing `Restart=on-failure`.

Answer

The User=backup directive overrides Restart.

Answer

The unit is not enabled.

Answer

The Restart directive is only valid for Type=simple.

Question 3

A service unit has the directive 'ExecStartPre=/bin/true' and 'ExecStart=/usr/bin/myapp'. What is the effect of ExecStartPre?

Accepted Answer

It runs a pre-start script; if it fails, the service is not started.. ExecStartPre is a systemd directive that specifies a command to run before the main ExecStart command. If the ExecStartPre command fails (returns a non-zero exit code), systemd will not proceed to start the service, unless the '-' prefix is used to ignore failure. Here, /bin/true always succeeds (exit code 0), so it does not block the service, but the directive itself is designed to enforce a pre-start check.

Answer

It sets an environment variable.

Answer

It runs a post-start script.

Answer

It runs a pre-start script; if it fails, the service still starts.

Question 4

An administrator is unable to SSH into the server from a remote host at 192.168.1.100. Based on the exhibited iptables rules, what is the most likely reason?

Accepted Answer

The SSH rule only allows connections from 10.0.1.0/24, and 192.168.1.100 is not in that subnet. The exhibited iptables rules show an SSH rule that explicitly accepts incoming TCP traffic on port 22 only from the source subnet 10.0.1.0/24. The remote host at 192.168.1.100 is not within that subnet, so the SSH rule does not match, and the packet will fall through to the next rule or the default policy. Since no other rule permits SSH from 192.168.1.100, the connection is implicitly dropped or rejected, preventing SSH access.

Answer

SSH is not allowed from any source

Answer

The INPUT chain policy is ACCEPT, so SSH should be allowed

Answer

The DROP rule for SSH is not matching because of packet count zero

Question 5

Order the steps to recover a forgotten root password on a Linux system using single-user mode.

Accepted Answer

1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Change root password, 4. Reboot.. To recover a forgotten root password on Linux using single-user mode, you must first boot into single-user mode (e.g., by adding 'single' to the kernel command line). At the root prompt, the filesystem is mounted read-only, so you must remount it as read-write with 'mount -o remount,rw /'. Then use 'passwd root' to set a new password. Finally, reboot the system. Attempting to change the password without remounting or rebooting prematurely will cause the recovery to fail.

Answer

1. Boot into single-user mode, 2. Change root password, 3. Remount filesystem as read-write, 4. Reboot.

Answer

1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Reboot, 4. Change root password.

Answer

1. Change root password, 2. Boot into single-user mode, 3. Remount filesystem as read-write, 4. Reboot.

Question 6

Order the steps to create a systemd service unit that runs a script at boot.

Accepted Answer

Create the unit file, then enable the service for boot, then start the service, then check the status.. Creating the unit file, enabling for boot, starting, and checking status are standard steps.

Answer

Start the service, then create the unit file, then enable for boot, then check status.

Answer

Enable the service for boot, then create the unit file, then start, then check status.

Answer

Create the unit file, then start the service, then enable for boot, then check status.

Question 7

Match each Linux permission type to its symbolic representation.

Accepted Answer

Read: r. In Linux, standard file permissions are represented by symbols: read (r), write (w), and execute (x). Each permission type maps to a unique symbol. Confusion often arises from swapping these symbols.

Answer

Read: w

Answer

Write: x

Answer

Execute: r

Question 8

A custom systemd service unit file has been created but the service fails to start with 'Exec format error'. What is the most likely cause?

Accepted Answer

The ExecStart command path is incorrect or missing shebang. The 'Exec format error' in systemd indicates that the binary or script specified in the ExecStart directive cannot be executed, typically because the path is incorrect, the file is not executable, or (most commonly) the script lacks a valid shebang line (e.g., #!/bin/bash). Without a shebang, the kernel does not know which interpreter to use, causing an execve() failure.

Answer

The unit file has incorrect permissions

Answer

The user does not have permission to start the service

Answer

The service is disabled

Question 9

A junior administrator issued the command 'usermod -L alice' to lock the account of user alice. However, alice is still able to log in via SSH using a public key. What is the most likely reason?

Accepted Answer

The usermod -L command only locks the password but does not prevent SSH key-based authentication.. The `usermod -L` command locks the user's password by placing an exclamation mark (!) in the second field of the /etc/shadow file, which prevents password-based authentication. However, SSH public key authentication does not rely on the password field; it uses the authorized_keys file and the SSH daemon's public key challenge-response mechanism. Therefore, even with a locked password, the user can still log in via SSH if their public key is present in ~/.ssh/authorized_keys.

Answer

The usermod -L command only changes the user's shell to /sbin/nologin.

Answer

The usermod -L command requires a restart of the SSH service to take effect.

Answer

The usermod -L command is not effective on accounts with a UID less than 1000.

Question 10

Which THREE commands can be used to list all users currently logged into the system?

Accepted Answer

w. The w command (A) is correct because it reads /var/run/utmp and displays every user currently logged in along with their terminal, source host, login time, idle time, and current process. The users command (C) is correct because it prints a space-separated list of the login names of all users currently logged into the system, derived from utmp. The who command (E) is correct because it also reads utmp and lists currently logged-in users with their terminal, login time, and remote host. The last command (B) is not correct here because it reads /var/log/wtmp and shows historical login/logout records, including past sessions, not only users currently logged in. The id command (D) is not correct because it displays the UID, GID, and group memberships of a single specified or current user rather than listing all logged-in users.

Answer

last

Answer

id

Question 11

After creating an XFS filesystem on /dev/sdb1, an admin mounts it and writes data. Later, they run 'xfs_info /mnt/data' and see the filesystem was created with default settings. What is the default inode size for XFS on a typical Linux system?

Accepted Answer

256 bytes. The default inode size for XFS on a typical Linux system is 256 bytes. This is set at filesystem creation time and provides a balance between supporting extended attributes (like ACLs and SELinux contexts) and minimizing metadata overhead. The `xfs_info` command confirms the default settings, which include this 256-byte inode size.

Answer

512 bytes

Answer

128 bytes

Answer

4096 bytes

Question 12

Based on the journalctl output, what is the most likely cause of the service failure?

Accepted Answer

Another process is already using port 8080.. The journalctl output shows a bind error on port 8080 with 'Address already in use'. This indicates that another process is already listening on that port, preventing the service from starting. In systemd, such a failure is logged with the specific errno EADDRINUSE, which directly points to a port conflict.

Answer

The service configuration file has a syntax error.

Answer

The system is out of memory.

Answer

The service is trying to write to a read-only filesystem.

Question 13

A service named webserver.service is failing to start. The administrator wants to see the most recent error messages related to this service. Which command provides this information?

Accepted Answer

journalctl -u webserver.service. The `journalctl -u webserver.service` command queries the systemd journal for all log entries associated with the specified unit, showing the most recent error messages in reverse chronological order. This is the standard way to view detailed, time-stamped error logs for a failing service, as `journalctl` provides access to the binary journal that captures stdout, stderr, and syslog messages from the service.

Answer

systemctl status webserver.service --full

Answer

systemctl list-units --type=service | grep webserver

Answer

systemctl is-active webserver.service

Question 14

An e-commerce company runs a critical application on a Linux server that occasionally becomes unresponsive. The server has 64GB RAM and runs a Java application. The operations team notices that during peak hours, the system becomes very slow and eventually the application crashes with 'OutOfMemoryError'. After restart, it works fine for a while. They suspect a memory leak but also want to ensure the system does not go down during peak hours. The system uses systemd to manage the Java service. The administrator needs to implement a solution that: (1) automatically restarts the service if it becomes unresponsive, (2) limits the memory usage of the service to prevent OOM kills on the system, and (3) provides early warning of high memory usage. Which of the following approaches best meets these requirements?

Accepted Answer

Configure systemd service with WatchdogSec=30, Restart=on-failure, MemoryMax=32G. Also set up a log watcher that alerts when memory usage exceeds 28G via journalctl and a custom script.. It uses systemd's WatchdogSec to detect unresponsiveness and Restart=on-failure to automatically restart the service, while MemoryMax=32G enforces a hard memory limit via cgroups to prevent OOM kills. The custom log watcher provides early warning by alerting when memory usage exceeds 28G, satisfying all three requirements.

Answer

Set up a cron job to run every minute that checks memory usage with free and if > 90%, restart the service with systemctl restart. Also configure MemoryMax=32G in the systemd unit.

Answer

Configure sysctl vm.overcommit_memory=2 to prevent overcommit, and allocate huge pages for Java. Also set Restart=always in the systemd unit.

Answer

Use ulimit -v 33554432 in the service script to limit virtual memory, and set Restart=always. Also configure a cron job to send alerts when dmesg shows OOM.

Question 15

A system administrator is setting up a high-availability cluster using shared storage. Which filesystem is best suited for this environment where multiple nodes need simultaneous read-write access to the same filesystem?

Accepted Answer

GFS2. GFS2 (Global File System 2) is a shared-disk cluster filesystem designed for high-availability environments where multiple nodes require simultaneous read-write access to the same filesystem. It uses a distributed lock manager (DLM) to coordinate access across nodes, ensuring data consistency without requiring a single metadata server. This makes it ideal for active-active cluster configurations with shared block storage.

Answer

Btrfs

Answer

XFS

Answer

ext4

Question 16

A financial firm requires all internal SSH connections to be encrypted with at least 256-bit ciphers. An administrator is configuring the SSH server. Which configuration line should be added to /etc/ssh/sshd_config?

Accepted Answer

Ciphers aes256-ctr. The Ciphers directive in sshd_config explicitly controls the symmetric encryption algorithms used to encrypt SSH session data. The cipher aes256-ctr provides 256-bit encryption, meeting the firm's requirement for at least 256-bit ciphers. Other directives like MACs, KexAlgorithms, or HostKeyAlgorithms do not directly set the encryption cipher strength.

Answer

MACs hmac-sha2-256

Answer

KexAlgorithms diffie-hellman-group-exchange-sha256

Answer

HostKeyAlgorithms ssh-rsa

Question 17

Which TWO of the following are valid ways to mount a filesystem with the 'noexec' option to prevent execution of binaries?

Accepted Answer

mount -o noexec /dev/sdb1 /mnt/data. Option A is correct because the mount command's -o flag accepts the noexec mount option directly, so 'mount -o noexec /dev/sdb1 /mnt/data' mounts the device /dev/sdb1 at /mnt/data with binary execution disabled. Option E is correct because the fourth field of an /etc/fstab entry holds the mount options, so adding 'noexec' there (e.g., 'defaults,noexec') makes the filesystem mount with noexec persistently at boot or on 'mount -a'. Option B is wrong because 'exec' is the opposite of noexec and explicitly permits execution. Option C is wrong because 'defaults' expands to rw,suid,dev,exec,auto,nouser,async, which includes exec and thus allows binaries to run. Option D is wrong because 'mount --bind' merely mirrors one directory tree onto another and does not itself set the noexec option.

Answer

Add 'exec' to the fourth field of /etc/fstab for the entry.

Answer

Add 'defaults' to the fourth field of /etc/fstab for the entry.

Answer

mount --bind /mnt/data1 /mnt/data2

Question 18

An administrator is troubleshooting a server that runs a critical application. The server has 16 GB of RAM and 8 CPU cores. The administrator notices that the server becomes very slow during peak hours. Analysis of 'iostat -x 1' shows that the average wait time (await) for the main disk (sda) is consistently above 1000 ms, while the average service time (svctm) is around 5 ms. What is the most likely cause?

Accepted Answer

There is a large queue of I/O requests waiting to be serviced.. The 'await' value in iostat represents the average time (in milliseconds) for I/O requests to be serviced, including time spent waiting in the queue. With 'await' at 1000+ ms and 'svctm' at only 5 ms, the vast majority of the time is spent waiting, not being serviced. This indicates a large queue of pending I/O requests, which is the direct cause of the slowdown.

Answer

The CPU is overloaded, causing processes to wait for CPU time.

Answer

The system is using swap space heavily, causing disk I/O.

Answer

The disk is experiencing hardware errors.

Question 19

A system administrator needs to ensure the Apache httpd service starts automatically on system boot. Which command should they use?

Accepted Answer

systemctl enable httpd. The `systemctl enable httpd` command creates the necessary symlinks in the systemd unit configuration directories (typically `/etc/systemd/system/multi-user.target.wants/`) to ensure the Apache httpd service starts automatically at boot time. This is the correct approach because `enable` configures the service to be started on system startup, whereas `start` only runs it immediately without affecting boot behavior.

Answer

systemctl start httpd

Answer

systemctl disable httpd

Answer

systemctl reload httpd

Question 20

Refer to the exhibit. The output of 'ps aux' shows a process named 'process_hog' with PID 1234 consuming 99.5% CPU. The process is stuck in an infinite loop and does not respond to SIGTERM. Which signal should be used to forcefully terminate it?

Accepted Answer

kill -9 1234. SIGKILL (signal 9) cannot be caught, blocked, or ignored by a process, making it the only reliable way to terminate a process that is stuck in an infinite loop and unresponsive to SIGTERM. Since the process does not respond to SIGTERM (signal 15), a forceful kill with kill -9 is necessary.

Answer

kill -2 1234

Answer

kill -15 1234

Answer

kill -19 1234