LFCS Practice Test 36 — 15 Questions

Question 1

You are managing a Linux server that hosts web applications. Developers often need to access the server via SSH using their personal accounts. You have been asked to create a new user 'devops' who will have sudo privileges to restart services. The user 'devops' should be a member of the 'sudo' group and also have a secondary group 'devs' for file access. The user's home directory should be /home/devops. You need to create this user with a password that is set to expire immediately so that the user must choose a new password upon first login. Which command would you use to accomplish this?

Accepted Answer

useradd -m -g devs -G sudo devops && chage -d 0 devops. Option D is correct. useradd -m creates home, -g devs sets primary group to devs, -G sudo sets supplementary groups, and chage -d 0 forces immediate password change. Option A: -e 0 sets account expiry. Option B: -p '' sets empty password, not secure. Option C: passwd -e is not a standard command.

Answer

useradd -m -g sudo -G devs devops && passwd -e devops

Answer

useradd -m -G sudo,devs -p '' devops && passwd -d devops

Answer

useradd -m -g sudo -G devs -p $(openssl passwd -1 temp) -e 0 devops

Question 2

You are a system administrator for a financial firm. One of your users, 'alice', has forgotten her password and is locked out of the system. The security policy requires that all passwords must be changed every 30 days. Alice's account was disabled due to inactivity; the account has been inactive for 45 days. You need to unlock the account and ensure that Alice must change her password at the next login. You have root access. Which set of commands should you run?

Accepted Answer

usermod -U alice; chage -d 0 alice. Option A is correct. usermod -U unlocks the account, and chage -d 0 forces password change. Option B: passwd -u is not standard on all distros; chage -M 30 sets max days but does not force immediate change. Option C: usermod -e '' sets no account expiry but may not unlock; passwd alice sets a new password but does not force change. Option D: chage -E -1 sets no account expiry but also uses usermod -L which locks the account.

Answer

passwd -u alice; chage -M 30 alice

Answer

usermod -e '' alice; passwd alice

Answer

chage -E -1 alice; usermod -L alice

Question 3

A Linux server hosts a critical web application and is connected to the corporate network via a bonded interface bond0, combining eth0 and eth1 in active-backup mode. The server has a static IP 192.168.1.100/24 and default gateway 192.168.1.1. Recently, users report intermittent connectivity. The administrator runs 'ip link show' and sees that eth0 and eth1 are both state UP, but bond0 shows 'state UP' and 'NO-CARRIER'. The bond primary slave is eth0. Also, 'ping 192.168.1.1' fails. What should the administrator do next?

Accepted Answer

Check the physical cable connection of eth0.. The bond interface showing NO-CARRIER indicates a physical link problem on the active slave. Since eth0 is the primary slave and bond0 has no carrier, the most likely cause is a disconnected or faulty cable on eth0. Checking the physical connection is the appropriate first step. Changing the bond mode or restarting services would not resolve a physical issue, and adding a secondary IP is irrelevant.

Answer

Add a secondary IP address to eth0.

Answer

Restart the NetworkManager service.

Answer

Change the bond mode to balance-rr to load balance traffic.

Question 4

A company runs an Apache HTTP server hosting multiple virtual hosts on a single server. The server is managed by systemd. After editing the configuration file for one of the virtual hosts, the administrator notices that the entire Apache service fails to start with a syntax error. Other virtual hosts are currently down because the service failed. The administrator must resolve the issue with minimal downtime and without affecting the configuration of the working virtual hosts. Which course of action is most appropriate?

Accepted Answer

Run 'apachectl configtest' to validate all configurations, fix any reported errors, then run 'systemctl reload httpd'.. Using apachectl configtest to validate the configuration before restarting is the safest approach. It identifies syntax errors without affecting running services. Then the fix can be applied and a reload (or restart) performed. Option A ignores validation and restarts, causing potential additional downtime if the error persists. Option B also restarts without validation. Option D disables the problematic site, but that may not be desired if the site is needed.

Answer

Check the Apache error log to identify the syntax error, fix the configuration, and run 'systemctl restart httpd'.

Answer

Run 'systemctl restart httpd' immediately to apply the change; the error will be logged.

Answer

Disable the problematic virtual host file by renaming it, then restart Apache to bring up the other sites.

Question 5

A Linux server at a hosting provider uses a software RAID 5 array with three 2 TB disks (sda, sdb, sdc) configured as /dev/md0, hosting a large ext4 filesystem. The server experiences a performance degradation and I/O errors. The administrator checks /proc/mdstat and sees that /dev/sda is marked as failed. The remaining two disks are still active. The administrator has a spare disk /dev/sdd of the same size. The filesystem is sparse and can tolerate downtime. What is the most appropriate course of action to restore the array to a fully functional state with redundancy?

Accepted Answer

Run 'mdadm --manage /dev/md0 --fail /dev/sda --remove /dev/sda', then 'mdadm --manage /dev/md0 --add /dev/sdd'.. Option B is correct because the proper procedure is to first mark the failed disk as failed in the MD array, remove it, then add the new disk, which triggers a rebuild. Option A is wrong because simply adding the new disk without removing the failed one will not work; the array still has a failed disk. Option C is wrong because recreating the array destroys existing data. Option D is wrong because LVM does not have native RAID capabilities and this would not utilize the existing RAID metadata.

Answer

Recreate the RAID 5 array from scratch using all three healthy disks (sdb, sdc, sdd) and restore data from backup.

Answer

Run 'mdadm --manage /dev/md0 --add /dev/sdd' to directly add the new disk and let the array rebuild automatically.

Answer

Use LVM to mirror the two healthy disks and ignore the failed one, ensuring data redundancy.

Question 6

A security audit reveals that a sensitive file '/etc/shadow' has been modified. The file's permissions are set to 600 and owned by root. However, the audit logs show that a service account 'webapp' was able to read the file. The 'webapp' user is not in the root group. Which of the following is the most likely method the 'webapp' user used to read the file?

Accepted Answer

The file has an Access Control List (ACL) granting read permission to 'webapp'.. Option C is correct because an Access Control List (ACL) can grant specific permissions to a user or group beyond the traditional Unix permission model. Even though the file's mode is 600 (owner read/write only) and owned by root, a setfacl command could have added an ACL entry (e.g., 'u:webapp:r') that explicitly allows the 'webapp' user to read /etc/shadow. This is a common method to give a service account access to a sensitive file without changing its ownership or group membership.

Answer

The file is a hard link to another file that is readable by 'webapp'.

Answer

The 'webapp' user exploited a SUID binary that reads the file.

Answer

The 'webapp' user used 'sudo' to read the file as root.

Question 7

A system administrator notices that the disk space on the root filesystem is at 95% usage. After investigating, they find that a large log file named 'access.log' in /var/log is taking up significant space. The administrator deletes the file using 'rm /var/log/access.log' but the disk usage remains at 95%. Running 'df -h' still shows the same usage. What is the most likely cause and the correct next step?

Accepted Answer

The file is still open by a process. Use 'lsof | grep access.log' to identify the process and restart it.. When a file is deleted with 'rm' while it is still open by a running process, the file's directory entry is removed, but the inode and data blocks remain allocated until the process closes the file descriptor. This causes 'df' to still report the space as used. The correct next step is to use 'lsof' to find the process holding the file open and restart it, which releases the file descriptor and frees the disk space.

Answer

The file is compressed and needs to be decompressed. Use 'gzip -d access.log' first.

Answer

The filesystem is marked as full in the superblock. Use 'fsck' to repair the filesystem.

Answer

The file has multiple hard links. Use 'find / -links +1' to locate all hard links and delete them.

Question 8

A user reports that they cannot delete a file named 'important.txt' located in their home directory. The file is owned by the user and the user has write permission on the directory. Running 'rm important.txt' produces the error: 'rm: cannot remove 'important.txt': Operation not permitted'. The user has also tried using 'sudo rm' but gets the same error. Which of the following is the most likely cause and correct solution?

Accepted Answer

The file has the immutable attribute set. Use 'lsattr important.txt' and if the 'i' attribute is present, remove it with 'chattr -i important.txt'.. The error 'Operation not permitted' despite the user owning the file and having write permission on the directory indicates a filesystem-level restriction rather than a permission or ACL issue. The immutable attribute (i) on the file prevents any modification, including deletion, even by the root user. Running 'lsattr' reveals the attribute, and 'chattr -i' removes it, allowing deletion.

Answer

The file has an ACL that denies deletion. Use 'setfacl -b important.txt' to remove ACLs.

Answer

The file is currently in use by another process. Use 'lsof' to find the process and kill it.

Answer

The directory has the sticky bit set, preventing deletion. Use 'chmod o-t .' to remove the sticky bit.

Question 9

A system administrator configures a new server with multiple disks. After partitioning and formatting, they mount a partition to /data. Several days later, they notice that the /data filesystem is full, but 'du -sh /data' reports only 2 GB used, while the partition is 100 GB. 'df -h' shows /data is 98% full. What is the most likely cause and the correct action?

Accepted Answer

There are deleted files still held open by processes. Use 'lsof /data' to find and restart those processes.. Option D is correct because when a file is deleted but still held open by a running process, the filesystem does not release the disk blocks until the process closes the file descriptor. This causes 'df' to report the space as used, while 'du' cannot see the deleted file's data, leading to the discrepancy. Using 'lsof /data' identifies the processes holding the deleted files, and restarting them frees the space.

Answer

The filesystem is fragmented. Run 'e4defrag' to defragment.

Answer

The filesystem has reserved blocks for root. Reduce the reserved percentage with 'tune2fs -m 0'.

Answer

The 'du' command is not counting hidden files (dot files). Use 'du -sh .*' to include them.

Question 10

You are a systems administrator for a company that runs a web application on a Linux server with 16 GB of RAM and 4 CPU cores. The application uses Apache with mod_php and PostgreSQL. Recently, the server has been experiencing high load average (above 10) and the website is responding slowly. The 'top' command shows that many 'httpd' processes are in 'D' (uninterruptible sleep) state. The 'iostat -x 1' output shows high disk utilization (over 90%) and high average wait times (await > 200 ms) on the disk where PostgreSQL data is stored. The database is write-heavy, and you suspect that disk I/O is the bottleneck. Which of the following actions is most likely to improve the performance?

Accepted Answer

Increase the PostgreSQL shared_buffers setting to 4 GB.. The high disk utilization (over 90%) and high await times (>200 ms) on the PostgreSQL data disk indicate that the database is I/O-bound. Increasing PostgreSQL's shared_buffers to 4 GB (25% of 16 GB RAM) allows more data to be cached in memory, reducing the frequency of disk writes and reads for write-heavy workloads. This directly alleviates the disk I/O bottleneck, lowering the load average and the number of httpd processes in 'D' state.

Answer

Enable the PostgreSQL query cache by setting 'query_cache_type' to 'on'.

Answer

Increase the PostgreSQL max_connections setting to 200.

Answer

Decrease the Apache MaxClients setting to 50.

Question 11

A systems administrator is responsible for a production Linux server running CentOS 7 that provides SSH access to users. The administrator decides to tighten security by restricting SSH access to a specific management subnet 10.0.0.0/24. While connected to the server via SSH from a workstation on 10.0.0.50, the administrator adds the following iptables rule: iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/24 -j ACCEPT followed by iptables -P INPUT DROP. Immediately after the rule change, the administrator loses all connectivity to the server, including SSH. The administrator suspects that the new default policy dropped the existing SSH session. What is the most reliable method for the administrator to regain access to the server without rebooting?

Accepted Answer

Use IPMI or iDRAC to access the server's console and remove or modify the iptables rules.. Option C is correct because IPMI (Intelligent Platform Management Interface) or iDRAC (Integrated Dell Remote Access Controller) provides out-of-band management access to the server's console, independent of the operating system's network stack. This allows the administrator to log in locally, remove or modify the iptables rules that dropped the SSH session, and restore connectivity without rebooting. Since the default INPUT policy was set to DROP, all new and existing SSH packets are blocked, but out-of-band management bypasses iptables entirely.

Answer

Use netcat to send a TCP reset packet to the SSH server.

Answer

Use iptables-save and iptables-restore from another host on the same subnet.

Answer

Boot the server into single-user mode and flush iptables rules.

Question 12

An administrator is configuring network bonding on a RHEL 7 server with two physical NICs (eth0 and eth1) to provide redundancy. The bond interface bond0 is configured with mode 1 (active-backup). The administrator uses the following configuration in /etc/sysconfig/network-scripts/ifcfg-bond0: BONDING_OPTS="miimon=100 mode=1". The slave interfaces are configured with MASTER=bond0 and SLAVE=yes. After restarting the network service, the bond interface comes up with the active link on eth0. To test failover, the administrator disconnects the cable from eth0. The bond interface does not fail over to eth1. The administrator checks /proc/net/bonding/bond0 and sees that both slaves are listed but eth0 is still marked as active even though the cable is disconnected. What is the most likely reason for the failover failure?

Accepted Answer

Add arp_interval=1000 and arp_ip_target=192.168.1.1 to BONDING_OPTS.. Option A is correct because in mode 1 (active-backup), the bonding driver uses MII monitoring (miimon) to detect link state changes via the physical carrier signal. However, some switches or NICs do not properly report carrier loss when a cable is disconnected, causing miimon to miss the failure. Adding arp_interval and arp_ip_target forces the bonding driver to use ARP-based monitoring, which actively probes a target IP to verify link availability, thus detecting failures that miimon cannot see.

Answer

Change bonding mode to mode 4 (802.3ad load balancing).

Answer

Remove one slave and re-add it to force a failover.

Answer

Check /var/log/messages for bonding driver errors.

Question 13

A Linux system administrator is troubleshooting a DNS resolution issue on a Ubuntu 20.04 server. The server is configured with a static IP address on interface eth0 via /etc/netplan/01-netcfg.yaml. The administrator set the DNS servers to 8.8.8.8 and 8.8.4.4 in the cloud-config file. After applying the netplan configuration, the server can resolve hostnames correctly. However, after a few days, users report that the server can no longer resolve external hostnames. The administrator checks /etc/resolv.conf and sees that it contains only a local DNS server (127.0.0.53) and no references to the public DNS servers. The administrator wants to ensure that the public DNS servers are always used and that local DNS is bypassed. What is the best course of action?

Accepted Answer

Modify the netplan configuration to set dns servers and set 'dhcp4-overrides: {use-dns: false}' then apply.. Option A is correct because in Ubuntu 20.04, netplan uses systemd-resolved by default, which listens on 127.0.0.53. Setting 'dhcp4-overrides: {use-dns: false}' in the netplan configuration prevents DHCP from overriding the manually specified DNS servers, ensuring that only the public DNS servers (8.8.8.8 and 8.8.4.4) are used for resolution. After applying with 'netplan apply', systemd-resolved will forward queries to those public servers, bypassing the local stub resolver.

Answer

Directly edit /etc/resolv.conf to add the public DNS servers and make it immutable using chattr +i.

Answer

Use the 'host' command to force DNS queries to use a specific server.

Answer

Stop and disable the systemd-resolved service using systemctl.

Question 14

You are a Linux administrator for a small company. A developer has deployed a web application on a server with IP 192.168.1.50. The application needs to connect to a database server at 10.0.0.100 on TCP port 3306. Both servers are on the same physical network but different subnets (192.168.1.0/24 and 10.0.0.0/24) connected by a router. The default gateway for the app server is 192.168.1.1, and for the DB server is 10.0.0.1. You have verified that the app server can ping the DB server by IP address successfully. However, the application fails to connect to the database. You have used telnet from the app server to test connectivity on port 3306 and it fails (connection refused). On the DB server, you check that the MySQL service is listening on 0.0.0.0:3306 and that the local firewall (firewalld) allows incoming connections on port 3306. What is the most likely cause of the connection failure?

Accepted Answer

The router does not have a route to 192.168.1.0/24 from the DB server's subnet, so return packets are dropped.. The app server can ping the DB server, confirming Layer 3 connectivity, but telnet fails on port 3306, indicating a Layer 4 issue. Since the DB server's MySQL is listening on 0.0.0.0:3306 and firewalld allows the port, the most likely cause is that the router lacks a return route from the 10.0.0.0/24 subnet to the 192.168.1.0/24 subnet, causing return packets from the DB server to be dropped. This asymmetric routing prevents the TCP handshake from completing, even though ICMP (ping) may work if the router forwards it differently.

Answer

The network cable is faulty.

Answer

The app server's firewall is blocking outgoing connections to port 3306.

Answer

The database service is only listening on the loopback interface (127.0.0.1).

Question 15

You administer a Linux server that acts as a network gateway. It has two network interfaces: eth0 (external, with IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (internal, with IP 192.168.1.1/24). The server is running firewalld and has IP forwarding enabled. Internal hosts (192.168.1.0/24) can access the internet through NAT, which is configured using firewalld's masquerade on the external zone. However, you need to allow a specific internal server (192.168.1.100) to be reachable from the internet on TCP port 443 (HTTPS). You add a port forwarding rule using firewall-cmd: 'firewall-cmd --zone=external --add-forward-port=port=443:proto=tcp:toport=443:toaddr=192.168.1.100'. After reloading the firewall, external users still cannot connect to 203.0.113.10:443. You verify that the internal server is running HTTPS and that its local firewall allows port 443. What is the most likely reason the port forwarding is not working?

Accepted Answer

The rule needs to include masquerade for the destination address; use a rich rule with 'masquerade'.. Option C is correct because a simple port forward rule in firewalld does not automatically rewrite the source IP address for return traffic. Without masquerade on the forwarded traffic, the internal server sees the original external source IP and sends its response directly to that IP, bypassing the gateway. Adding a rich rule with 'masquerade' for the destination address ensures that the gateway performs SNAT on the forwarded packets, so the internal server sees the gateway as the source and returns traffic through it.

Answer

The port forwarding rule should be added to the internal zone instead of the external zone.

Answer

The internal server has a different default gateway.

Answer

IP forwarding is not enabled on the system.