LFCS Practice Questions 2 — 50 Questions

Question 1

An administrator created a new user 'john' with the default settings, but 'john' cannot log in. The error message indicates an invalid shell. Which command should the administrator use to fix this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

usermod -s /bin/bash john. The correct command is `usermod -s /bin/bash john` because it modifies an existing user's login shell in the `/etc/passwd` file. The error 'invalid shell' indicates the user's current shell is either missing or not listed in `/etc/shells`, and `usermod` is the proper tool to change a user's attributes after account creation.

Answer

passwd -s john

Answer

useradd -s /bin/bash john

Answer

chsh -s /bin/bash john

Question 2

An administrator created an LVM snapshot of a logical volume to perform a backup. During the backup, the snapshot runs out of space. What will happen to the original logical volume?

Accepted Answer

The snapshot becomes invalid and must be recreated.. When an LVM snapshot runs out of space, it becomes invalid and cannot track changes made to the original logical volume during the backup. The snapshot is automatically dropped by the device-mapper, and any attempt to mount or read it will fail. The original logical volume remains fully functional and unaffected, but the snapshot must be recreated to perform a new backup.

Answer

The original volume becomes read-only.

Answer

The backup completes successfully but data may be inconsistent.

Answer

The original volume is automatically extended.

Question 3

A system administrator wants to view the last 10 lines of the system log file '/var/log/syslog' and continue to watch for new lines as they are appended. Which command should be used?

Accepted Answer

tail -n 10 -f /var/log/syslog. The `tail -n 10 -f /var/log/syslog` command first displays the last 10 lines of the file and then uses the `-f` (follow) flag to continuously monitor the file for new appended lines, outputting them in real time. This matches the requirement to both view the last 10 lines and watch for new entries.

Answer

tail -n 10 /var/log/syslog

Answer

less /var/log/syslog

Answer

head -n 10 /var/log/syslog

Question 4

A Linux system reports 'Out of memory' errors frequently. The administrator checks memory usage with 'free -m' and notices that most memory is used by file cache. Which command can the administrator run to immediately free up the cache without affecting running processes?

Accepted Answer

sysctl vm.drop_caches=1. Both options A and C are correct methods to free pagecache (file cache) without terminating processes. Writing to /proc/sys/vm/drop_caches via echo or using the sysctl command achieve the same result. The administrator can use either command to immediately reclaim memory used by file cache. Option B disables swap but does not free cache, and option D kills a process unnecessarily.

Answer

swapoff -a

Answer

kill -9 $(pidof some_process)

Question 5

Refer to the exhibit. Which filesystem is mounted using the XFS filesystem type?

Accepted Answer

/home. (/home) because the exhibit shows that /home is mounted with the XFS filesystem type, as indicated in the output of the 'df -hT' or similar command. XFS is a high-performance 64-bit journaling filesystem commonly used in Linux for large files and scalability, and it is the default filesystem in RHEL/CentOS 7 and later.

Answer

/boot

Answer

/proc

Answer

/

Question 6

Which THREE commands can show the current system time and date?

Accepted Answer

timedatectl. B is correct because `timedatectl` is the primary command in systemd-based Linux distributions (e.g., RHEL 7+, Ubuntu 16.04+) for querying and configuring system time, date, time zone, and NTP synchronization. It displays the current local time, UTC time, RTC time, and time zone status in a structured output.

Answer

time

Answer

ntpdate

Question 7

A server with two network interfaces (eth0 and eth1) needs to be configured as a bridge (br0) to allow KVM virtual machines to share the host's physical network. Which steps are correct?

Accepted Answer

Create bridge br0, add eth0 as port, assign IP to br0, remove IP from eth0.. Bridging requires the physical interface (eth0) to be added as a port to the bridge (br0) without an IP address, while the bridge itself gets the IP address to act as the network layer endpoint. This allows KVM virtual machines connected to br0 to communicate through eth0, which operates at layer 2. Removing the IP from eth0 prevents IP conflicts and ensures all traffic is handled by the bridge.

Answer

Create bridge br0, add eth0 as port, assign IP to eth0, do not assign IP to br0.

Answer

Create bond0 from eth0 and eth1, then add bond0 to bridge br0.

Answer

Create bridge br0, add eth0 and eth1 as bridge ports, assign IP to br0, remove IP from eth0 and eth1.

Question 8

A company follows the principle of least privilege. Several developers need sudo access to run specific commands like systemctl and journalctl. What is the best practice for granting this access?

Accepted Answer

Create a new group 'devops', add developers to it, and create a sudoers drop-in file with rules for specific commands. It follows the principle of least privilege by creating a dedicated 'devops' group and using a sudoers drop-in file (e.g., /etc/sudoers.d/devops) to grant only specific commands like systemctl and journalctl. This avoids modifying the main /etc/sudoers file directly, which is error-prone, and ensures that developers have no more privileges than necessary. The drop-in file approach is the recommended best practice for maintainability and security.

Answer

Use 'usermod -a -G sudo' for each developer and edit /etc/sudoers manually with visudo

Answer

Add all developers to the 'wheel' group and configure %wheel ALL=(ALL) ALL

Answer

Edit /etc/sudoers directly to add each developer username with command restrictions

Question 9

You are a systems administrator for a company that runs a critical web application on a Linux server. The server has two network interfaces: eth0 (public IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (private IP 10.0.0.10/24). The web server listens on port 443 (HTTPS) and must be accessible from the internet. The server also needs to connect to an internal database server at 10.0.0.50/24 on port 3306. Recently, users reported that the website is intermittently unreachable. You SSH into the server and run 'ss -tln' and see that the web server is listening on 0.0.0.0:443. You check the routing table with 'ip route show' and see: default via 203.0.113.1 dev eth0; 10.0.0.0/24 dev eth1 proto kernel scope link src 10.0.0.10. You also run 'iptables -L -n -v' and see: Chain INPUT (policy ACCEPT), with no rules. However, you notice that the server's default gateway is unreachable from the server itself when you run 'ping 203.0.113.1' (100% packet loss). What is the most likely cause of the intermittent unreachability?

Accepted Answer

The default gateway is unreachable, preventing return traffic from the internet.. The server's default gateway (203.0.113.1) is unreachable, as confirmed by the 100% packet loss on ping. This means that although the web server is listening on 0.0.0.0:443 and the firewall allows traffic, any response packets from the server to internet clients must be routed through the default gateway. Without a working gateway, return traffic cannot reach the clients, causing intermittent unreachability from the internet.

Answer

The web server is not listening on the public IP address.

Answer

A firewall rule is blocking incoming HTTPS traffic.

Answer

The private interface eth1 has a misconfigured IP address.

Question 10

Given the routing table output in the exhibit, what will happen when the system tries to send a packet to 10.1.1.1?

Accepted Answer

The packet is sent to 192.168.1.1 via eth0.. The routing table shows a specific route for the 10.0.0.0/8 network via gateway 192.168.1.1 on eth0. Since 10.1.1.1 falls within this subnet, the packet is forwarded to 192.168.1.1 via eth0, not through the default route or any other interface.

Answer

The packet is sent via eth1.

Answer

The packet is sent via default route.

Answer

The packet is dropped because there is no subnet matching 10.1.1.1.

Question 11

A user reports that they cannot delete a file named 'important.txt' located in their home directory. The file is owned by the user and the user has write permission on the directory. Running 'rm important.txt' produces the error: 'rm: cannot remove 'important.txt': Operation not permitted'. The user has also tried using 'sudo rm' but gets the same error. Which of the following is the most likely cause and correct solution?

Accepted Answer

The file has the immutable attribute set. Use 'lsattr important.txt' and if the 'i' attribute is present, remove it with 'chattr -i important.txt'.. The error 'Operation not permitted' despite the user owning the file and having write permission on the directory indicates a filesystem-level restriction rather than a permission or ACL issue. The immutable attribute (i) on the file prevents any modification, including deletion, even by the root user. Running 'lsattr' reveals the attribute, and 'chattr -i' removes it, allowing deletion.

Answer

The file has an ACL that denies deletion. Use 'setfacl -b important.txt' to remove ACLs.

Answer

The file is currently in use by another process. Use 'lsof' to find the process and kill it.

Answer

The directory has the sticky bit set, preventing deletion. Use 'chmod o-t .' to remove the sticky bit.

Question 12

A security policy requires that all users in the 'admin' group must have a umask of 027 set automatically upon login. An administrator adds 'umask 027' to /etc/profile. However, users report that the umask is still 022. What is a likely cause?

Accepted Answer

The umask in /etc/profile is overridden by user-specific .bash_profile or .bashrc files.. User-specific shell configuration files (like ~/.bash_profile, ~/.bash_login, or ~/.profile for login shells, and ~/.bashrc for interactive non-login shells) are sourced after /etc/profile. These files can override the system-wide umask setting with a user-defined value, such as the default 022. Since the administrator only modified /etc/profile, any existing user-specific umask command in their personal dotfiles will take precedence.

Answer

The umask command in /etc/profile has a syntax error that is silently ignored.

Answer

The admin placed the umask command after the call to /etc/bash.bashrc which resets it.

Answer

The admin forgot to run 'source /etc/profile' on each user's session.

Question 13

After deleting user 'alice', the system administrator wants to also remove the home directory and mail spool. Which command should be used?

Accepted Answer

userdel -r alice. The correct option is B, userdel -r alice. The -r flag removes the user's home directory and mail spool, along with the user account. This is the standard flag for removing user data along with the account.

Answer

userdel -Z alice

Answer

userdel -f alice

Answer

userdel --remove alice

Question 14

An administrator receives a report that a specific directory /var/log is consuming too much disk space. Which command should be used to determine the total disk space used by that directory?

Accepted Answer

du -sh /var/log. The `du -sh /var/log` command calculates the total disk space used by the specified directory. The `-s` flag summarizes the total size, `-h` provides human-readable output (e.g., in KB, MB, GB), and the path `/var/log` targets the directory in question. This is the standard Linux command for determining directory disk usage.

Answer

df -h /var/log

Answer

ls -la /var/log

Answer

fdisk /var/log

Question 15

A technician needs to display the contents of a compressed file named archive.tar.gz without extracting it. Which command should be used?

Accepted Answer

zcat archive.tar.gz | tar -t. It uses `zcat` to decompress the `.gz` layer on the fly and pipes the resulting uncompressed tar archive into `tar -t`, which lists the contents without extracting. This allows viewing the file listing without first decompressing to disk, satisfying the requirement to display contents without extraction.

Answer

tar -tf archive.tar

Answer

tar -xzf archive.tar.gz

Answer

zcat archive.tar.gz

Question 16

After attempting to log in as user 'alice', the system rejects the password. The admin checks /etc/passwd and sees 'alice:x:1001:1001::/home/alice:/bin/bash'. The /etc/shadow shows 'alice:!!:18200:0:99999:7:::', indicating the account is locked. Which command will unlock the account?

Accepted Answer

usermod -U alice. The `usermod -U alice` command unlocks the user account by removing the `!` from the password hash field in `/etc/shadow`. The `!!` in the shadow file indicates the account is locked (password disabled), and `-U` explicitly unlocks it, restoring the password hash to an active state.

Answer

passwd -S alice

Answer

passwd -u alice

Answer

chage -d 0 alice

Question 17

Based on the exhibit, which process is using the most physical memory (RES)?

Accepted Answer

mysqld (PID 9101). The exhibit shows the output of the `top` command, where the RES column indicates the resident memory (physical RAM) used by each process. mysqld (PID 9101) has a RES value of 2.5g, which is significantly higher than nginx (PID 5678) with 128m and systemd (PID 1234) with 48m, making it the process using the most physical memory.

Answer

Not determinable from exhibit

Answer

nginx (PID 5678)

Answer

systemd (PID 1234)

Question 18

A user reports that a shell script 'backup.sh' in /home/user/scripts fails to execute. What is the most likely cause?

Accepted Answer

The script does not have execute permission for the user.. The most likely cause is that the script lacks execute permission for the user. In Linux, a file must have the execute bit set (e.g., `chmod +x backup.sh`) to be run as a script. Without it, the shell will refuse to execute the file, even if the user has read access and the script is syntactically correct.

Answer

The script is not in the user's PATH.

Answer

The script must be owned by root.

Answer

The script does not have a shebang line (#!/bin/bash) at the top.

Question 19

The backup script fails to run as user 'backup' with sudo. What is the issue?

Accepted Answer

The script does not have execute permission for the 'backup' user.. For a script to be executed via sudo, the user (backup) must have execute permission on the script file. Even if sudo is configured to allow the user to run the script, the operating system enforces file permission checks at execution time. Without the execute bit set for the backup user (or for others, depending on the sudo runas context), the kernel will refuse to execve() the script, resulting in a 'Permission denied' error.

Answer

The script has a restrictive umask.

Answer

The script is not owned by 'backup'.

Answer

The 'backup' user is not in the sudoers file.

Question 20

An administrator needs to create a system user that runs a service (no login, no home directory). Which command is appropriate?

Accepted Answer

useradd -r -M myservice. The `-r` flag creates a system user (UID below SYSTEM_UID_MIN, typically 1000) without a home directory by default, and `-M` explicitly overrides any default that might create a home directory, ensuring no home directory is created. This matches the requirement for a service account that does not need login or a home directory.

Answer

useradd -r myservice

Answer

useradd -r -m myservice

Answer

useradd -M myservice