LFCS Practice Test 4 — 25 Questions

Question 1

An administrator needs to replace all occurrences of the string 'foo' with 'bar' in all files under /etc/config, but only in files ending with .conf. The replacement must be done in-place, and backup copies should be created with a .bak extension. Which command accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

find /etc/config -name '*.conf' -exec sed -i.bak 's/foo/bar/g' {} +. It uses `sed -i.bak` which creates a backup file with the .bak extension before performing the in-place substitution, and the `find -exec ... +` variant efficiently processes multiple files at once. The `-i` option with an argument (no space) specifies the backup suffix directly, satisfying the requirement for backup copies.

Answer

find /etc/config -name '*.conf' -exec sed -i .bak 's/foo/bar/g' {} +

Answer

find /etc/config -name '*.conf' -exec sed 's/foo/bar/g' {} \;

Answer

find /etc/config -name '*.conf' -exec sed -i 's/foo/bar/g' {} +

Question 2

Which nmcli command creates a VLAN interface with tag 10 on device eth0?

Accepted Answer

nmcli connection add type vlan con-name vlan10 dev eth0 id 10. The `nmcli connection add` command with `type vlan` requires the `dev` option to specify the parent interface (eth0) and the `id` option to set the VLAN tag (10). The `con-name` assigns a name to the connection profile, and the resulting interface will be named automatically (e.g., eth0.10) unless overridden by `ifname`. This creates a VLAN interface that tags frames with ID 10 on the parent device eth0.

Answer

nmcli connection add type vlan con-name vlan10 ifname eth0 id 10

Answer

nmcli device add vlan con-name vlan10 dev eth0 id 10

Answer

nmcli connection add type vlan con-name vlan10 ifname eth0.10

Question 3

Refer to the exhibit.

A user attempts to create a file in /backup/snapshots/ but receives an error. What is the most likely cause?

Accepted Answer

The /backup filesystem is mounted read-only.. The error occurs because the /backup filesystem is mounted read-only, which prevents any write operations, including file creation, regardless of directory permissions or available space. This is a common scenario when a filesystem is intentionally mounted with the 'ro' option in /etc/fstab or via the mount command to protect data integrity.

Answer

The /backup directory does not exist.

Answer

The user does not have write permission on /backup.

Answer

The /backup filesystem is full.

Question 4

A system administrator needs to ensure that a Linux server can communicate with other hosts on the same subnet. Which command should be used to verify the IP address and netmask configuration?

Accepted Answer

ip addr show. The `ip addr show` command is the modern, recommended tool in Linux for viewing IP addresses and netmasks (prefix lengths) assigned to network interfaces. It directly displays the configuration needed to verify subnet communication, unlike legacy tools that may not show the netmask clearly or mix routing information.

Answer

netstat -rn

Answer

route -n

Answer

ifconfig

Question 5

A Linux server is unable to resolve the hostname 'app.internal.example.com' but can resolve other names. The /etc/nsswitch.conf file contains: hosts: files mdns4_minimal [NOTFOUND=return] dns. The /etc/hosts file does not list the hostname. Which configuration change would most likely resolve the issue?

Accepted Answer

Remove the mdns4_minimal entry or change it to 'mdns4' without the NOTFOUND=return. The issue is that mdns4_minimal with [NOTFOUND=return] causes the resolver to stop after a failed mDNS query, preventing it from falling back to DNS. Since the hostname is not in /etc/hosts and not reachable via mDNS, the resolver returns 'not found' immediately without querying DNS. Removing the mdns4_minimal entry or changing it to 'mdns4' (without the NOTFOUND=return) allows the resolver to proceed to DNS if mDNS fails.

Answer

Change the hosts line to: hosts: dns files mdns4_minimal

Answer

Configure /etc/resolv.conf to use a different DNS server

Answer

Add the hostname to the local multicast DNS configuration

Question 6

A Linux administrator needs to configure VLAN tagging on a network bridge to isolate traffic from different virtual machines. The physical interface is eth0, and VLAN ID 100 should be accessible via the bridge br0. Which set of commands correctly creates this configuration using the ip command?

Accepted Answer

ip link add link eth0 name eth0.100 type vlan id 100; ip link add br0 type bridge; ip link set eth0.100 master br0; ip link set br0 up. It first creates a VLAN interface (eth0.100) on top of physical interface eth0 with VLAN ID 100 using `ip link add link eth0 name eth0.100 type vlan id 100`. It then creates a bridge (br0) with `ip link add br0 type bridge`, attaches the VLAN interface to the bridge as a port with `ip link set eth0.100 master br0`, and finally brings the bridge up. This sequence ensures that traffic tagged with VLAN 100 on eth0 is properly forwarded through the bridge to virtual machines, while untagged or other VLAN traffic is isolated.

Answer

ip link add br0 type bridge; ip link set eth0 master br0; ip link set br0 up

Answer

ip link add eth0.100 link eth0 type vlan id 100; ip link set eth0.100 master br0; ip link add br0 type bridge

Answer

ip link add name br0 type bridge; ip link add link br0 name vlan100 type vlan id 100; ip link set eth0 master br0

Question 7

A system administrator runs 'ss -tuln' and sees that port 80 is listening. What does the 'u' option represent?

Accepted Answer

UDP. In the `ss` command, the `-u` option filters output to show only UDP sockets. Since the question shows `ss -tuln`, which combines `-t` (TCP), `-u` (UDP), `-l` (listening), and `-n` (numeric), the `u` specifically represents UDP. This is confirmed by the `ss` man page and standard Linux networking tools.

Answer

User

Answer

Unix sockets

Answer

Unicast

Question 8

After editing /etc/resolv.conf to set a custom DNS server, the changes are reverted after reboot. What is the most likely cause?

Accepted Answer

NetworkManager manages DNS and overwrites manual changes. NetworkManager actively manages network interfaces and DNS settings by default on many Linux distributions. When a user manually edits /etc/resolv.conf, NetworkManager detects the change and overwrites it with its own configuration, especially after a reboot or network restart, because it treats the file as a managed resource. This is the most common reason for DNS changes being reverted.

Answer

The DHCP client overwrites resolv.conf on lease renewal

Answer

SELinux reinitializes the file from defaults

Answer

systemd-resolved regenerates the file from configuration

Question 9

Which TWO methods can be used to set a static IPv4 address on a CentOS 7 system? (Choose two.)

Accepted Answer

Use the nmtui utility. Nmtui is a text-based user interface for NetworkManager, which is the default networking service on CentOS 7. It allows you to interactively configure network interfaces, including setting a static IPv4 address, without needing to manually edit configuration files. Option E is correct because the ifcfg-eth0 file in /etc/sysconfig/network-scripts is the traditional, direct configuration method for network interfaces on CentOS 7, where you can set BOOTPROTO=static and define IPADDR, PREFIX, and GATEWAY.

Answer

Run the command 'systemctl set-static-ip eth0 192.168.1.100/24'

Answer

Use 'ip addr add 192.168.1.100/24 dev eth0'

Answer

Edit the /etc/network/interfaces file

Question 10

Which THREE conditions can cause an 'RTNETLINK answers: File exists' error when adding a static route?

Accepted Answer

The route exists with a different metric but same destination and netmask.. The Linux kernel's routing table uses the destination and netmask as a unique key for route entries. When adding a route with 'ip route add', if a route already exists with the same destination and netmask but a different metric, the kernel returns 'RTNETLINK answers: File exists' because the metric is not part of the uniqueness check — only the destination prefix and netmask are considered. The metric is a per-route property that does not disambiguate routes in the FIB (Forwarding Information Base).

Answer

The gateway is unreachable.

Answer

The interface is down.

Question 11

Refer to the exhibit. An administrator wants to bring up the eth1 interface using the existing connection. Which command should be used?

Accepted Answer

nmcli connection up eth1. `nmcli connection up eth1` activates the existing NetworkManager connection profile associated with the eth1 interface. This command ensures that the interface is brought up using the stored configuration (e.g., IP addressing, DNS, routes) rather than just setting the link state. NetworkManager manages connections as profiles, and `nmcli connection up` is the proper way to apply a profile to an interface.

Answer

nmcli device connect eth1

Answer

ifup eth1

Answer

ip link set eth1 up

Question 12

Based on the tcpdump output in the exhibit, what can be concluded about the TCP handshake?

Accepted Answer

The TCP three-way handshake completed successfully.. The TCP three-way handshake completes successfully when three packets are exchanged: SYN, SYN-ACK, and ACK. The tcpdump output shows exactly these three packets, confirming a successful handshake. The presence of the final ACK from the client to the server's SYN-ACK indicates that the connection is established.

Answer

The connection attempt failed because only three packets are shown.

Answer

The connection was reset by the remote host.

Answer

The handshake is incomplete because there is no ACK from the server.

Question 13

A user reports that they cannot reach a remote server by hostname but can reach it by IP address. Which configuration file is most likely misconfigured?

Accepted Answer

/etc/resolv.conf. The /etc/resolv.conf file configures the system's DNS resolver, specifying the nameservers to query for hostname-to-IP resolution. If a user can reach a server by IP but not by hostname, it indicates that DNS resolution is failing, which is most commonly due to a missing or incorrect nameserver entry in /etc/resolv.conf.

Answer

/etc/sysconfig/network

Answer

/etc/hosts

Answer

/etc/nsswitch.conf

Question 14

A system administrator notices that a web server process (PID 1234) is consuming excessive CPU. They want to trace its system calls to identify the cause. Which command should be used?

Accepted Answer

strace -p 1234. The correct command is `strace -p 1234`, which attaches to the running process (PID 1234) and intercepts all system calls (e.g., read, write, open) made by that process. This allows the administrator to see exactly what the web server is doing at the kernel level, such as excessive file I/O or network operations, which can pinpoint the cause of high CPU usage. Other tools like ltrace, perf, or gdb serve different purposes (library calls, profiling, debugging) and do not directly trace system calls.

Answer

ltrace -p 1234

Answer

perf record -p 1234

Answer

gdb -p 1234

Question 15

Refer to the exhibit. What is the most likely security issue?

Accepted Answer

Someone is attempting to brute-force the root password.. The exhibit shows multiple failed SSH login attempts for the root user from the same IP address in quick succession, as seen in the auth.log or secure log entries. This pattern indicates a brute-force attack, where an attacker systematically tries different passwords to gain unauthorized root access. Option C is correct because the repeated 'Failed password for root' messages are the hallmark of a brute-force attempt.

Answer

SSH service is not running.

Answer

The root account is disabled.

Answer

The firewall is blocking SSH.

Question 16

After editing a service unit file, which command must be run for changes to take effect?

Accepted Answer

systemctl daemon-reload. When a service unit file is edited, systemd must be notified to reload its configuration from disk. The `systemctl daemon-reload` command instructs systemd to re-read all unit files, applying any changes to the unit definitions without requiring a full system reboot. This is necessary because systemd caches unit file contents in memory, and only a daemon-reload will update that cache.

Answer

systemctl restart <service>

Answer

systemctl reenable <service>

Answer

systemctl reload <service>

Question 17

A junior admin runs 'systemctl restart httpd' but the httpd service fails to start. Which command should the admin use first to diagnose the problem?

Accepted Answer

systemctl status httpd. `systemctl status httpd` provides a concise summary of the service's current state, including whether it is active, the last log entries, and the exit code or failure reason. This is the first diagnostic step recommended by systemd documentation to quickly identify common issues like configuration errors, missing dependencies, or permission problems.

Answer

journalctl -u httpd

Answer

systemctl show httpd

Answer

systemctl list-units --type=service

Question 18

A Linux administrator needs to view the UUID and filesystem type of all block devices. Which command provides this information?

Accepted Answer

blkid. The `blkid` command is the correct tool because it directly queries the kernel's block device attributes via the libblkid library, displaying the UUID, filesystem type (e.g., ext4, xfs), and other metadata (like LABEL or PARTUUID) for all block devices. It reads from the `/dev/disk/by-uuid/` symlinks and the kernel's device mapper, making it the standard utility for this specific task.

Answer

/proc/partitions

Answer

ls -l /dev

Answer

fdisk -l

Question 19

An administrator has added a new disk (/dev/sdb) to a Linux system. The disk is to be used as a physical volume in an existing volume group 'vg_data'. Which sequence of commands should be executed to make the disk available to the volume group?

Accepted Answer

pvcreate /dev/sdb; vgextend vg_data /dev/sdb. It first initializes the disk as a physical volume using `pvcreate`, which writes LVM metadata to /dev/sdb, and then extends the existing volume group 'vg_data' with `vgextend`, adding the new PV to the VG. This is the standard two-step process for adding a new disk to an existing LVM volume group.

Answer

fdisk /dev/sdb; pvcreate /dev/sdb; vgextend vg_data /dev/sdb

Answer

pvcreate /dev/sdb; vgcreate vg_data /dev/sdb

Answer

vgcreate /dev/sdb; vgextend vg_data /dev/sdb

Question 20

A service named webserver.service is failing to start. The administrator wants to see the most recent error messages related to this service. Which command provides this information?

Accepted Answer

journalctl -u webserver.service. The `journalctl -u webserver.service` command queries the systemd journal for all log entries associated with the specified unit, showing the most recent error messages in reverse chronological order. This is the standard way to view detailed, time-stamped error logs for a failing service, as `journalctl` provides access to the binary journal that captures stdout, stderr, and syslog messages from the service.

Answer

systemctl status webserver.service --full

Answer

systemctl list-units --type=service | grep webserver

Answer

systemctl is-active webserver.service