LFCS Practice Test 5 — 25 Questions

Question 1

A system administrator needs to identify all available block devices on a Linux server. Which two commands can be used to accomplish this? (Choose two.)

Accepted Answer

lsblk. The `lsblk` command lists all available block devices (e.g., disks, partitions, LVM volumes) by reading the sysfs filesystem, providing a tree-like view of device hierarchy. The `fdisk -l` command displays the partition table for all block devices, showing detailed information about disk geometry and partitions. Both commands are standard tools for identifying block devices on a Linux system.

Answer

blkid

Answer

mount

Answer

df -h

Question 2

A host with this routing table can ping 10.0.2.1 but cannot ping 8.8.8.8. What is the most likely cause?

Accepted Answer

The default gateway 10.0.1.1 does not have internet connectivity. The host can ping 10.0.2.1, which is on the directly connected 10.0.2.0/24 network, confirming that the local interface and link-layer are functional. However, it cannot ping 8.8.8.8, a public internet address. The routing table shows a default route via 10.0.1.1, so the host will forward the packet to that gateway. Since the host has a default route, the most likely cause is that the gateway 10.0.1.1 itself lacks internet connectivity (e.g., no upstream route, NAT misconfiguration, or ISP outage), preventing the packet from reaching 8.8.8.8.

Answer

The default route is missing

Answer

The host has no route to 10.0.2.0/24

Answer

The host has no route to 10.0.1.1

Question 3

An administrator needs to configure a service to run as a non-root user for security reasons. Which systemd unit file directive accomplishes this?

Accepted Answer

User=myuser. The `User=` directive in a systemd unit file specifies the user (by name or UID) under which the service process runs. By setting `User=myuser`, the service executes with the privileges of that non-root user, reducing the attack surface and adhering to the principle of least privilege. This is the standard systemd mechanism for dropping root privileges for a service.

Answer

AmbientCapabilities=CAP_NET_BIND_SERVICE

Answer

DynamicUser=yes

Answer

Group=myuser

Question 4

A system has a process stuck in uninterruptible sleep (D state). The administrator wants to identify which kernel function it is waiting on. Which tool should be used?

Accepted Answer

cat /proc/PID/stack. Reading /proc/PID/stack directly shows the kernel stack trace of the process, revealing the exact kernel function or wait queue the process is blocked on while in uninterruptible sleep (D state). This is the only tool listed that can inspect the kernel-side call stack without attaching a debugger or altering process state.

Answer

gdb -p PID

Answer

perf top -p PID

Answer

strace -p PID

Question 5

Based on the exhibit, which port is listening only on the loopback interface?

Accepted Answer

53. Port 53 (DNS) is configured to listen only on the loopback interface (127.0.0.1) as shown in the exhibit's output of `ss -tlnp`. The listening address `127.0.0.1:53` indicates the service is bound exclusively to the loopback interface, meaning it is not accessible from external network interfaces.

Answer

22

Answer

443

Answer

80

Question 6

A server on a corporate network is intermittently losing connectivity. The administrator runs 'tcpdump -i eth0 icmp' and sees 'ICMP time exceeded in-transit' messages from a router. What is the most likely cause?

Accepted Answer

There is a routing loop or the TTL is too low.. The 'ICMP time exceeded in-transit' message indicates that a packet's TTL (Time to Live) has reached zero before reaching its destination. This is most commonly caused by a routing loop, where packets circulate endlessly between routers, or by an initial TTL value that is too low for the number of hops required. The router that decrements the TTL to zero sends this ICMP Type 11 Code 0 message back to the source, as defined in RFC 792.

Answer

There is a mismatch in MTU size.

Answer

The destination host is down.

Answer

A firewall is blocking the packets.

Question 7

A user needs to view the contents of a large text file one screen at a time. Which command is best for this?

Accepted Answer

less file.txt. `less` is a terminal pager that allows forward and backward navigation through a file, making it ideal for viewing large text files one screen at a time. Unlike `more`, `less` supports scrolling both up and down, and it does not load the entire file into memory, which is efficient for large files.

Answer

nl file.txt

Answer

more file.txt

Answer

cat file.txt

Question 8

A junior administrator issued the command 'usermod -L alice' to lock the account of user alice. However, alice is still able to log in via SSH using a public key. What is the most likely reason?

Accepted Answer

The usermod -L command only locks the password but does not prevent SSH key-based authentication.. The `usermod -L` command locks the user's password by placing an exclamation mark (!) in the second field of the /etc/shadow file, which prevents password-based authentication. However, SSH public key authentication does not rely on the password field; it uses the authorized_keys file and the SSH daemon's public key challenge-response mechanism. Therefore, even with a locked password, the user can still log in via SSH if their public key is present in ~/.ssh/authorized_keys.

Answer

The usermod -L command only changes the user's shell to /sbin/nologin.

Answer

The usermod -L command requires a restart of the SSH service to take effect.

Answer

The usermod -L command is not effective on accounts with a UID less than 1000.

Question 9

A system administrator has a cron job that runs a backup script. The script requires the variable BACKUP_DIR to be set, but the administrator cannot modify the script. Which is the most appropriate place to define the variable for cron?

Accepted Answer

In the crontab file with the line 'BACKUP_DIR=/var/backups' before the command. Cron jobs run in a minimal environment and do not source shell profiles or login scripts. Defining BACKUP_DIR directly in the crontab file before the command ensures the variable is set in the cron execution context, which is the only reliable way to pass environment variables to cron without modifying the script.

Answer

In /etc/profile.d/backup.sh

Answer

In /etc/environment

Answer

In ~/.bash_profile

Question 10

Given the routing table, if the server sends a packet to destination 10.0.1.200, which interface will be used and what is the next hop?

Accepted Answer

eth1 directly to 10.0.1.200. The destination 10.0.1.200 falls within the directly connected network 10.0.1.0/24 on eth1. According to the routing table, this route has a /24 netmask and is marked as directly connected, meaning no next-hop router is needed. The server will ARP for 10.0.1.200 and send the packet directly to that host via eth1.

Answer

eth1 via 10.0.1.1

Answer

eth0 with next hop 10.0.0.1

Answer

eth0 with next hop 10.0.1.200

Question 11

A network engineer needs to temporarily disable a network interface eth1 without bringing it down permanently. Which command?

Accepted Answer

ip link set eth1 down. The `ip link set eth1 down` command temporarily disables the eth1 interface by changing its state to DOWN at the kernel level, without making any persistent changes to configuration files. This is the correct approach for a temporary disable because the interface can be re-enabled with `ip link set eth1 up` and will revert to its configured state upon reboot.

Answer

systemctl stop network

Answer

nmcli device disconnect eth1

Answer

ifdown eth1

Question 12

Based on the iptables-save output, what is the default policy for the FORWARD chain and what happens to a new SSH connection from an external host on eth0?

Accepted Answer

Default policy FORWARD is DROP; SSH connections are accepted.. The default policy for the FORWARD chain is DROP, as shown in the iptables-save output (e.g., `:FORWARD DROP [0:0]`). A new SSH connection from an external host on eth0 is accepted because there is a rule in the FORWARD chain that matches incoming SSH traffic (typically TCP port 22) and has a target of ACCEPT, overriding the default DROP policy for that specific traffic.

Answer

Default policy FORWARD is ACCEPT; SSH connections are dropped.

Answer

Default policy FORWARD is DROP; SSH connections are dropped.

Answer

Default policy FORWARD is ACCEPT; SSH connections are accepted.

Question 13

Which TWO commands can be used to check the status of a service?

Accepted Answer

service status. The `service` command is a legacy SysV init wrapper that can query the status of a service by calling the appropriate init script with the `status` argument. It remains available on many Linux distributions for backward compatibility, making it a valid tool to check service status.

Answer

systemd-analyze

Answer

start stop restart

Answer

initctl status

Question 14

A Linux server hosts a critical web application and is connected to the corporate network via a bonded interface bond0, combining eth0 and eth1 in active-backup mode. The server has a static IP 192.168.1.100/24 and default gateway 192.168.1.1. Recently, users report intermittent connectivity. The administrator runs 'ip link show' and sees that eth0 and eth1 are both state UP, but bond0 shows 'state UP' and 'NO-CARRIER'. The bond primary slave is eth0. Also, 'ping 192.168.1.1' fails. What should the administrator do next?

Accepted Answer

Check the physical cable connection of eth0.. The bond interface showing NO-CARRIER indicates a physical link problem on the active slave. Since eth0 is the primary slave and bond0 has no carrier, the most likely cause is a disconnected or faulty cable on eth0. Checking the physical connection is the appropriate first step. Changing the bond mode or restarting services would not resolve a physical issue, and adding a secondary IP is irrelevant.

Answer

Add a secondary IP address to eth0.

Answer

Restart the NetworkManager service.

Answer

Change the bond mode to balance-rr to load balance traffic.

Question 15

A system administrator notices that the disk space on the root filesystem is at 95% usage. After investigating, they find that a large log file named 'access.log' in /var/log is taking up significant space. The administrator deletes the file using 'rm /var/log/access.log' but the disk usage remains at 95%. Running 'df -h' still shows the same usage. What is the most likely cause and the correct next step?

Accepted Answer

The file is still open by a process. Use 'lsof | grep access.log' to identify the process and restart it.. When a file is deleted with 'rm' while it is still open by a running process, the file's directory entry is removed, but the inode and data blocks remain allocated until the process closes the file descriptor. This causes 'df' to still report the space as used. The correct next step is to use 'lsof' to find the process holding the file open and restart it, which releases the file descriptor and frees the disk space.

Answer

The file is compressed and needs to be decompressed. Use 'gzip -d access.log' first.

Answer

The filesystem is marked as full in the superblock. Use 'fsck' to repair the filesystem.

Answer

The file has multiple hard links. Use 'find / -links +1' to locate all hard links and delete them.

Question 16

You are managing a Linux server that hosts a critical web application. The server is running low on disk space in the root filesystem, and you need to free up space urgently. You run 'df -h' and see that /dev/sda1 is mounted on / and is 95% full. You also notice that /var/log/messages is over 2 GB in size. The application writes logs to /var/log/app.log, which is also large. The server has a separate /var partition that has plenty of free space. The application must continue running with minimal downtime. You need to compress and rotate logs without losing any data, and ensure that the root filesystem has at least 10% free space. Which of the following actions should you take first to achieve this goal?

Accepted Answer

Use logrotate with the 'copytruncate' option to rotate /var/log/app.log and move the rotated file to /var/old_logs/.. Logrotate with the 'copytruncate' option allows the application to continue writing to the same file descriptor while the current log is copied and then truncated to zero length. This avoids any application downtime and the rotated log can be moved to the separate /var partition (which has free space) for compression or archiving, freeing space on the root filesystem without data loss.

Answer

Delete /var/log/app.log and /var/log/messages to free space quickly.

Answer

Stop the application, truncate /var/log/app.log, then restart the application.

Answer

Compress /var/log/app.log using gzip and keep it in place.

Question 17

A system administrator notices that logrotate did not rotate the /var/log/messages file on a CentOS 7 server despite having a configuration at /etc/logrotate.d/syslog. The admin runs 'logrotate -d /etc/logrotate.conf' and sees that the syslog file is excluded due to 'olddir' option, but the olddir does not exist. Additionally, the logrotate status file (/var/lib/logrotate/logrotate.status) shows that /var/log/messages was last rotated 30 days ago. The logrotate cron job is scheduled daily. What is the most likely reason the rotation fails?

Accepted Answer

The olddir specified in the config does not exist, causing logrotate to error out before rotation.. The `logrotate -d` (debug) output explicitly states the file is excluded due to the 'olddir' option, and the admin confirmed the olddir does not exist. When logrotate is configured with an 'olddir' directive, it attempts to move the rotated log file to that directory before performing the rotation. If the directory does not exist, logrotate fails with an error and aborts the rotation for that log file, leaving it unrotated. This is a common misconfiguration that prevents rotation even when all other conditions (e.g., age, size) are met.

Answer

The log file size has not exceeded the configured maxsize threshold.

Answer

The logrotate script does not have read permission on /var/log/messages.

Answer

The 'compress' option is missing, so logrotate skips the file.

Question 18

Which TWO configuration files are commonly used to set DNS resolver settings on a Linux system?

Accepted Answer

/etc/nsswitch.conf. /etc/nsswitch.conf controls the order of name resolution sources (e.g., files, dns, mdns) via the 'hosts' database line. Option E is correct because /etc/resolv.conf directly specifies the DNS resolver settings, including nameserver IP addresses, search domains, and options, as defined by RFC 1035.

Answer

/etc/hostname

Answer

/etc/sysconfig/network

Answer

/etc/hosts

Question 19

A security policy requires that a user's password must expire 90 days after last change, and the user must change it immediately on next login. The last password change was 30 days ago. Which set of commands achieves this?

Accepted Answer

chage -M 90 user1; chage -d 0 user1. `chage -M 90 user1` sets the maximum password age to 90 days, and `chage -d 0 user1` forces the password to expire immediately (setting the last change date to epoch 0), which requires the user to change the password on the next login. This satisfies both requirements: the password will expire 90 days after the forced change, and the user must change it immediately.

Answer

chage -M 90 user1; chage -m 1 user1

Answer

chage -M 90 user1; chage -W 7 user1

Answer

chage -M 90 user1; chage -I 5 user1

Question 20

You are a system administrator for a company that runs a web server on a Linux system. The web server logs are stored in /var/log/nginx/access.log. The log file grows rapidly and rotates weekly via logrotate. The system has been running for several months. Recently, the development team reported that the web server is responding slowly. You suspect that the disk I/O might be high due to log file activity. You check the disk usage and find that /var/log/nginx/access.log is 4 GB, and the rotated logs (access.log.1.gz, access.log.2.gz, etc.) total another 10 GB. The /var partition has 20 GB total, so it's 70% full. You decide to reduce the disk usage by compressing the current log file and truncating it without stopping the nginx service. Which command sequence should you use to safely achieve this?

Accepted Answer

cp /var/log/nginx/access.log /var/log/nginx/access.log.bak && :> /var/log/nginx/access.log && gzip /var/log/nginx/access.log.bak. It first copies the current log file to a backup, then truncates the original file in place using the shell null command (`:>`) without stopping nginx, and finally compresses the backup. This ensures nginx continues writing to the same inode (file descriptor remains valid) and the disk space is reclaimed after compression.

Answer

:> /var/log/nginx/access.log && cp /var/log/nginx/access.log /var/log/nginx/access.log.bak && gzip /var/log/nginx/access.log.bak

Answer

rm /var/log/nginx/access.log && touch /var/log/nginx/access.log && chmod 644 /var/log/nginx/access.log

Answer

mv /var/log/nginx/access.log /var/log/nginx/access.log.bak && touch /var/log/nginx/access.log && gzip /var/log/nginx/access.log.bak