LFCS Practice Questions 2 — 50 Questions

Question 1

A system administrator receives an alert that disk /dev/sda is predicted to fail soon. The server uses LVM, and /dev/sda is part of a volume group named vg_system. Which of the following is the best course of action to replace the failing disk without downtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use pvmove to move physical extents to another disk, then remove the old disk.. Pvmove relocates physical extents from /dev/sda to another physical volume in the same volume group while the filesystem remains online and accessible. This allows the failing disk to be removed from vg_system without any downtime, preserving LVM metadata and data integrity.

Answer

Use dd to clone /dev/sda to a new disk and then replace.

Answer

Use ddrescue to copy data, then replace the disk.

Answer

Remove /dev/sda from the volume group and add a new disk.

Question 2

A cron job runs a script every hour but sometimes fails because the script cannot find commands like 'tar' and 'gzip'. The script works when run manually from a terminal. What is the best fix?

Accepted Answer

Use absolute paths for all commands in the script.. Cron jobs run in a minimal environment with a restricted PATH (often just /usr/bin:/bin). When the script uses commands like 'tar' and 'gzip' without absolute paths, the shell cannot locate them. Using absolute paths (e.g., /bin/tar, /bin/gzip) ensures the script always finds the commands regardless of the environment.

Answer

Run the cron job as root.

Answer

Modify the script to source the user's .bashrc.

Answer

Add a PATH statement to the cron job definition.

Question 3

A developer reports that a web application's logs are not being written to /var/log/myapp.log. The service runs as user 'myapp' and the log directory /var/log/myapp/ has permissions 755 owned by root. What is the most likely cause?

Accepted Answer

The service user 'myapp' does not have write permission to the log directory.. The /var/log/myapp/ directory has permissions 755, which grants read and execute access to the 'others' category but not write. Since the service runs as user 'myapp', which is not the owner (root) and not in the root group, it falls under 'others' and thus lacks write permission. Without write permission on the directory, the service cannot create or write to /var/log/myapp.log, even if the file itself might have different permissions.

Answer

AppArmor is denying access.

Answer

SELinux is blocking the write.

Answer

The service is logging to systemd-journald instead of a file.

Question 4

Based on the exhibit, which process will be affected if the root user runs 'kill 5678'?

Accepted Answer

The www-data process with PID 5678. The 'kill 5678' command sends the default SIGTERM (signal 15) to the process with PID 5678. Since the root user has the CAP_KILL capability and is not subject to the ordinary permission checks that restrict non-root users, root can send signals to any process, including those owned by www-data. Therefore, the www-data process with PID 5678 will be terminated.

Answer

The root process (PID 1234)

Answer

All www-data processes

Answer

No process, because root cannot kill www-data processes

Question 5

Refer to the exhibit. A Linux administrator sees that 'myapp.service' is in a failed state with exit status 1. To troubleshoot, which command should the administrator use to view the full error output that the service produced before exiting?

Accepted Answer

journalctl -u myapp.service. journalctl -u myapp.service retrieves the full log output for that systemd unit from the journal, including stdout/stderr captured before the service exited with status 1. This is the correct tool to see the complete error trace, not just the summary. systemctl status only shows a truncated tail and the exit code.

Answer

systemctl status myapp.service

Answer

systemctl reload myapp.service

Answer

systemctl restart myapp.service

Question 6

Match each Linux boot component to its description.

Accepted Answer

BIOS/UEFI: Firmware that initializes hardware and loads the bootloader.. The correct matches are: BIOS/UEFI initializes hardware and loads the bootloader; Initramfs is the temporary root filesystem; Systemd is the init system. Common confusions occur between kernel and bootloader roles.

Answer

Bootloader (GRUB): Core of the OS that manages hardware and processes.

Answer

Kernel: Loads the kernel and initramfs into memory.

Question 7

An administrator needs to add a new 8 GB swap area on a server that already has a 2 GB swap partition. The system has free space in the volume group vg_sys. Which command creates a logical volume named lv_swap of exactly 8 GB and prepares it for swap use?

Accepted Answer

lvcreate -L 8G -n lv_swap vg_sys && mkswap /dev/vg_sys/lv_swap && swapon /dev/vg_sys/lv_swap. The correct procedure is to create the logical volume with lvcreate -L 8G -n lv_swap vg_sys, initialize it with mkswap, and activate it with swapon. The -L option specifies an absolute size in gigabytes, which matches the 8 GB requirement. Persistent activation requires an /etc/fstab entry, but the immediate creation and activation sequence is as shown.

Answer

vgcreate -L 8G -n lv_swap vg_sys && mkswap /dev/vg_sys/lv_swap && swapon /dev/vg_sys/lv_swap

Answer

lvcreate -L 8G -n lv_swap vg_sys && mkfs.swap /dev/vg_sys/lv_swap && swapon /dev/vg_sys/lv_swap

Answer

lvcreate -l 8 -n lv_swap vg_sys && mkswap /dev/vg_sys/lv_swap && swapon -a

Question 8

A system administrator needs to prevent a service named backup.service from starting automatically at boot, while keeping it available for manual start. The service is currently enabled. Which command should the administrator run?

Accepted Answer

systemctl disable backup.service. To prevent automatic startup while retaining the ability to start manually, the service must be disabled. Disabling removes the boot-time symlinks but leaves the unit file intact. Masking would prevent manual start, and stopping or killing only affects the current runtime state.

Answer

systemctl stop backup.service

Answer

systemctl mask backup.service

Answer

systemctl kill backup.service

Question 9

A security audit reveals that a sensitive file '/etc/shadow' has been modified. The file's permissions are set to 600 and owned by root. However, the audit logs show that a service account 'webapp' was able to read the file. The 'webapp' user is not in the root group. Which of the following is the most likely method the 'webapp' user used to read the file?

Accepted Answer

The file has an Access Control List (ACL) granting read permission to 'webapp'.. An Access Control List (ACL) can grant specific permissions to a user or group beyond the traditional Unix permission model. Even though the file's mode is 600 (owner read/write only) and owned by root, a setfacl command could have added an ACL entry (e.g., 'u:webapp:r') that explicitly allows the 'webapp' user to read /etc/shadow. This is a common method to give a service account access to a sensitive file without changing its ownership or group membership.

Answer

The file is a hard link to another file that is readable by 'webapp'.

Answer

The 'webapp' user exploited a SUID binary that reads the file.

Answer

The 'webapp' user used 'sudo' to read the file as root.

Question 10

A system administrator needs to ensure that a custom service named 'myapp.service' starts automatically after a reboot and also restarts automatically no matter how the service stops, even if it exits normally. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Run 'systemctl enable myapp.service' to enable the service.. Option B is correct because 'systemctl enable myapp.service' creates the necessary symlinks (typically under /etc/systemd/system/*.wants/) so systemd starts the unit automatically at boot, satisfying the reboot requirement. Option D is correct because 'Restart=always' in the [Service] section instructs systemd to restart the service regardless of exit status, including a clean exit code 0, which matches the requirement that it restart no matter how it stops. Option C is incorrect because 'Restart=on-failure' only restarts on non-zero exit codes, signals, or timeouts, so a normal exit would not trigger a restart. Option A is incorrect because 'systemctl mask' links the unit to /dev/null and prevents it from being started at all, the opposite of the desired behavior. Option E is incorrect because 'After=network.target' only orders startup relative to the network target and does not enable boot startup or automatic restarts.

Answer

Run 'systemctl mask myapp.service' to prevent manual stops.

Answer

Set 'Restart=on-failure' in the [Service] section of the service file.

Answer

Add 'After=network.target' to the [Unit] section of the service file.

Question 11

A user wants to continuously monitor a log file that is being written to by a running service. Which command achieves this?

Accepted Answer

tail -f /var/log/syslog. The `tail -f` command displays the last 10 lines of a file by default and then continues to output new lines as they are appended, making it ideal for real-time monitoring of a growing log file. The `-f` flag (follow) keeps the file open and polls for changes, typically using inotify on Linux, to output new data immediately.

Answer

head -20 /var/log/syslog

Answer

less /var/log/syslog

Answer

cat /var/log/syslog

Question 12

Which TWO commands can be used to display real-time process resource usage on a Linux system? (Choose two.)

Accepted Answer

htop. Option B (htop) is correct because htop is an interactive process viewer that continuously refreshes and displays real-time CPU, memory, and per-process resource usage, updating by default every second. Option E (top) is correct because top is the classic interactive monitor that dynamically refreshes process and resource statistics in real time, also defaulting to a periodic update interval. Option A (vmstat 1) reports virtual memory, CPU, and I/O statistics every 1 second, but it summarizes system-wide counters rather than per-process resource usage, so it does not display process-level real-time usage. Option C (ps -aux) is a snapshot command that lists processes at the moment of execution and then exits, providing no continuous real-time updates. Option D (free -h) only shows current memory and swap utilization in human-readable units and does not display process resource usage at all.

Answer

vmstat 1

Answer

ps -aux

Answer

free -h

Question 13

A system administrator configures a web server using systemd. After creating a custom service unit file, the administrator runs `systemctl daemon-reload` but the service still fails to start with a 'Unit not found' error. What is the most likely cause?

Accepted Answer

The service name was misspelled in the `systemctl start` command.. The 'Unit not found' error after `systemctl daemon-reload` typically indicates that systemd cannot locate a unit with the specified name. While correct placement of unit files is important, systemd scans both /etc/systemd/system/ and /usr/lib/systemd/system/ after a daemon-reload. Therefore, placing a custom unit in /usr/lib/systemd/system/ would not cause this error. The most likely cause is that the service name was misspelled in the `systemctl start` command. A simple typo would lead to a 'Unit not found' message because systemd looks for an exact match. Other options like forgetting `systemctl enable` or group membership do not affect unit discovery at start time.

Answer

The administrator forgot to run `systemctl enable` before starting the service.

Answer

The unit file is placed in /usr/lib/systemd/system/ instead of /etc/systemd/system/.

Answer

The administrator is not in the 'systemd' group.

Question 14

A custom service requires that the network is fully operational before it starts. Which directive should be added to the [Unit] section of the service's unit file to ensure this dependency?

Accepted Answer

After=network-online.target. `After=network-online.target` ensures the service starts only after the network is fully operational, including IP address assignment and connectivity. This target is reached when network managers like systemd-networkd or NetworkManager confirm the network is online, making it suitable for services that require active network interfaces.

Answer

Requires=network.target

Answer

Wants=network-online.target

Answer

After=network.target

Question 15

A user 'dba' tries to login via SSH and fails. Based on the exhibit, what is the most likely cause?

Accepted Answer

The user 'dba' has an invalid login shell.. The exhibit shows that the user 'dba' has an invalid login shell (e.g., /sbin/nologin or /bin/false). When the login shell is set to a non-interactive shell, SSH authentication succeeds but the session immediately closes, preventing the user from logging in. This is a common configuration for system accounts or users who should not have interactive shell access.

Answer

The file /home/dba/file.txt is corrupt.

Answer

The user 'dba' is not in the 'docker' group.

Answer

The home directory /home/dba does not have correct permissions.

Question 16

A DevOps engineer wants to measure how long a specific command takes to execute. Which command should be used?

Accepted Answer

time. The `time` command is specifically designed to measure the execution duration of a command, reporting real time, user CPU time, and system CPU time. It wraps the target command and tracks the elapsed wall-clock time and resource usage, making it the precise tool for benchmarking command performance.

Answer

date

Answer

uptime

Answer

wall

Question 17

A system administrator is troubleshooting a production web server running CentOS 7 that became unresponsive. The server is still pingable, but SSH connections timeout. The admin performs an out-of-band console login. The server appears frozen; typing commands shows no output. The admin is able to trigger a Magic SysRq key sequence (Alt+SysRq+f) to kill the hung processes. After that, the server resumes normal operation. However, the admin wants to understand the root cause. Upon checking 'dmesg', they see repeated messages: 'NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s!' followed by stack traces from a kernel thread. Which action should the admin take to prevent recurrence while maintaining system stability?

Accepted Answer

Update the server's BIOS/firmware and check for kernel updates.. Soft lockup errors on CentOS 7 often indicate kernel bugs or hardware/firmware issues that cause CPUs to stall for extended periods. Updating the BIOS/firmware can resolve underlying hardware timing problems, while kernel updates may include patches for known soft lockup bugs. This approach addresses the root cause without disabling or weakening the watchdog mechanism, preserving system stability.

Answer

Replace the power supply unit to ensure stable power.

Answer

Increase the soft lockup threshold via sysctl to reduce false positives.

Answer

Add 'nosoftlockup' to the kernel boot parameters.

Question 18

A system administrator is troubleshooting network connectivity from a server that can reach internal resources but cannot access the internet. The server's /etc/sysconfig/network-scripts/ifcfg-eth0 file contains: BOOTPROTO=static, IPADDR=10.0.0.10, NETMASK=255.255.255.0, GATEWAY=10.0.0.1. The administrator runs 'ip route show' and sees: default via 10.0.0.1 dev eth0. However, 'ping 8.8.8.8' fails. Which is the most likely cause?

Accepted Answer

The gateway 10.0.0.1 is not configured to forward traffic to the internet (no NAT or upstream route).. The routing table shows a default gateway (10.0.0.1) is present, so the issue is not a missing route. Since the server can reach internal resources but not the internet, the most likely cause is that the gateway itself (10.0.0.1) is not configured to perform NAT or does not have an upstream route to forward traffic beyond the local subnet. Without this, packets destined for 8.8.8.8 are sent to the gateway but are then dropped because the gateway has no path to the internet.

Answer

The default gateway is missing from the routing table.

Answer

DNS resolution is not configured.

Answer

A firewall is blocking outbound ICMP traffic.

Question 19

Which TWO are valid methods to configure a network interface on a Linux system?

Accepted Answer

Editing /etc/network/interfaces. Option C is correct because /etc/network/interfaces is the standard configuration file used by the ifupdown toolset on Debian-based Linux distributions to define network interfaces, their addressing (static or DHCP), and related parameters. Option D is correct because nmcli connection add is the NetworkManager command-line method for creating a new connection profile that configures an interface, including its IP addressing, gateway, and DNS settings. Option A is not a valid interface configuration method because sysctl only tunes kernel runtime parameters such as net.ipv4.conf.eth0.forwarding (packet forwarding), not interface addressing or link settings. Option B is not valid because systemctl enable network.service merely sets the legacy network service to start at boot; it does not itself configure an interface. Option E is not valid because /etc/sysconfig/network is a Red Hat-style file that historically held global hostname and gateway settings, not per-interface configuration.

Answer

Using sysctl to set net.ipv4.conf.eth0.forwarding

Answer

Using systemctl enable network.service

Answer

Editing /etc/sysconfig/network

Question 20

Which TWO of the following are correct statements about systemd journald configuration?

Accepted Answer

The 'MaxRetentionSec' directive sets the maximum time to retain journal entries.. The 'MaxRetentionSec' directive in journald.conf specifies the maximum time (in seconds) that journal entries are retained before they are deleted. This is a time-based retention policy, distinct from size-based limits, and is used to automatically prune old log entries to manage disk usage.

Answer

The 'RuntimeMaxUse' directive applies to the journal stored in /var/log/journal.

Answer

The 'Compress' directive is set to 'no' by default.

Answer

The 'ForwardToSyslog' directive is set to 'yes' by default.