LFCS Essential Commands — 25 Questions

Question 1

An administrator wants to ensure that a background process continues running after logout. Which command should be used to start the process?

Accepted Answer

nohup sleep 100 &. `nohup` allows a process to ignore the SIGHUP signal that is sent to background processes when the parent shell exits, ensuring it continues running after logout. The `&` places the command in the background, and `nohup` redirects output to `nohup.out` by default, making it the standard way to run a process immune to hangups.

Answer

runproc sleep 100 &

Answer

sleep 100 &

Answer

sleep 100 & disown

Question 2

A technician needs to display the contents of a compressed file named archive.tar.gz without extracting it. Which command should be used?

Accepted Answer

zcat archive.tar.gz | tar -t. It uses `zcat` to decompress the `.gz` layer on the fly and pipes the resulting uncompressed tar archive into `tar -t`, which lists the contents without extracting. This allows viewing the file listing without first decompressing to disk, satisfying the requirement to display contents without extraction.

Answer

tar -tf archive.tar

Answer

tar -xzf archive.tar.gz

Answer

zcat archive.tar.gz

Question 3

Which TWO commands can be used to create a new empty file?

Accepted Answer

touch file. The `touch` command is specifically designed to create an empty file if it does not already exist, or update its timestamps if it does. Option D is correct because using the shell redirection operator `>` with no command before it (or with a null command) creates an empty file by truncating any existing content or creating a new zero-byte file.

Answer

mkdir file

Answer

cat file

Answer

echo 'text' > file

Question 4

A developer accidentally deleted a critical file /var/log/app.log. The system administrator knows that the file was recently backed up using a cron job that runs 'tar -czf /backup/logs.tar.gz /var/log/'. Which command should the administrator use to restore the file from the backup without extracting the entire archive?

Accepted Answer

tar -xzf /backup/logs.tar.gz --to-stdout var/log/app.log > /var/log/app.log. `tar -xzf` extracts the specified file (`var/log/app.log`) from the compressed archive and `--to-stdout` sends its content to standard output, which is then redirected to recreate the file at `/var/log/app.log`. This restores the single file without extracting the entire archive, matching the requirement precisely.

Answer

tar -xf /backup/logs.tar.gz var/log/app.log

Answer

tar -tf /backup/logs.tar.gz | grep app.log

Answer

cp /backup/logs.tar.gz:/var/log/app.log /var/log/app.log

Question 5

A system administrator needs to find all files in /home that are owned by user 'alice' and have been modified in the last 7 days. The administrator then wants to compress those files into a single archive named alice_recent.tar.gz. Which of the following commands accomplishes this?

Accepted Answer

tar -czf alice_recent.tar.gz -T <(find /home -user alice -mtime -7). It uses `tar -czf` with process substitution to compress the files found by `find` into a gzipped tar archive named alice_recent.tar.gz. The `-z` flag enables gzip compression, and `-T <(...)` reads the list of files from the process substitution, which runs `find` to locate files owned by alice modified within the last 7 days. Options A, B, and D either do not compress or use incompatible formats.

Answer

find /home -user alice -mtime -7 -exec tar -rf alice_recent.tar.gz {} +

Answer

find /home -user alice -mtime -7 -print | cpio -o > alice_recent.tar.gz

Answer

find /home -user alice -mtime -7 | tar -cvf alice_recent.tar.gz

Question 6

A system administrator is troubleshooting a user's report that a command 'myapp' is not found. The administrator checks the PATH variable and sees it includes /usr/local/bin. The administrator verifies that the binary 'myapp' exists in /usr/local/bin with permissions 755. However, running 'myapp' still fails with 'command not found'. What is the most likely cause?

Accepted Answer

The shell's hash table is stale; run 'hash -r'. The shell caches the locations of executables in a hash table to avoid searching PATH repeatedly. When a new binary is added to a directory already in PATH, the shell may still have a stale entry (or no entry) for that command, causing it to report 'command not found' even though the binary exists. Running 'hash -r' clears the entire hash table, forcing the shell to re-scan PATH on the next invocation.

Answer

The user's PATH does not include /usr/local/bin

Answer

The binary is a shell script missing a shebang

Answer

The binary does not have execute permission for the user

Question 7

A user with uid 1000 tries to read /etc/shadow and gets 'Permission denied'. The user is not in the shadow group. Which of the following actions would allow the user to read the file without changing the file's group or permissions?

Accepted Answer

Add user1 to the shadow group using usermod -aG shadow user1. Adding user1 to the shadow group grants group-level read access to /etc/shadow without altering the file's permissions or group ownership. The file is typically owned by root:shadow with permissions 640 (rw-r-----), so members of the shadow group can read it. The usermod -aG command appends the user to the supplementary group, preserving existing group memberships.

Answer

Set an ACL using setfacl to grant user1 read access

Answer

Use chmod o+r /etc/shadow as root

Answer

Change the file owner to user1 using chown

Question 8

A system administrator runs 'grep -r 'error' /var/log' and gets many false positives. They want to search only for the exact word 'error' as a whole word, case-insensitively, and display line numbers. Which command should they use?

Accepted Answer

grep -rwin 'error' /var/log. It combines all required flags: `-r` for recursive search, `-w` for whole-word matching (using word boundaries), `-i` for case-insensitive search, and `-n` for displaying line numbers. The `-w` flag ensures that only the exact word 'error' is matched, not substrings like 'error404' or 'error-prone', which eliminates false positives.

Answer

grep -rwi 'error' /var/log

Answer

grep -rin 'error' /var/log

Answer

grep -rwn 'error' /var/log

Question 9

Order the steps to mount an ext4 filesystem from an external USB drive automatically at boot.

Accepted Answer

Identify the UUID using blkid, create the mount point directory, add an entry to /etc/fstab using the UUID with options defaults and dump/pass values, then run mount -a to test.. Using UUID in fstab ensures persistent mounting; testing with mount -a verifies no errors.

Answer

Plug in the USB drive, create the mount point, add an entry to /etc/fstab using the device name (e.g., /dev/sdb1), then reboot without testing.

Answer

Run mount -a first, then edit /etc/fstab to add the entry using UUID, and finally create the mount point.

Answer

Add an entry to /etc/fstab using the device name, manually mount with mount command, then create the mount point after mounting.

Question 10

A system administrator needs to find all files under /var/log that have been modified within the last 7 days. Which command accomplishes this task?

Accepted Answer

find /var/log -mmin -10080. Options B and C are both correct because the `find` command can search for files modified within the last 7 days using either `-mtime -7` (modification time in days) or `-mmin -10080` (modification time in minutes, where 10080 minutes equals 7 days). Option A checks access time (`-atime`), not modification time. Option D checks change time (`-ctime`), which includes metadata changes. Therefore, both B and C achieve the task.

Answer

find /var/log -atime -7

Answer

find /var/log -ctime -7

Question 11

A system administrator needs to replace all occurrences of 'oldhost' with 'newhost' in /etc/hosts, but only on lines that contain the string 'domain'. Which sed command accomplishes this?

Accepted Answer

sed -i '/domain/s/oldhost/newhost/g' /etc/hosts. Options A and D are correct because they use `-i` for in-place editing, restrict substitution to lines containing 'domain' with `/domain/`, and use the `g` flag to replace all occurrences on each line. Option B is incorrect because it only outputs lines containing 'domain' to stdout but does not edit the file. Option C is incorrect because it lacks the `g` flag, replacing only the first occurrence per line. Option E is incorrect because `-n` suppresses default output and `p` prints only lines where substitution occurred, but the file is not modified.

Answer

sed 's/oldhost/newhost/g' /etc/hosts | grep domain

Answer

sed -i '/domain/s/oldhost/newhost/' /etc/hosts

Answer

sed -ne '/domain/s/oldhost/newhost/gp' /etc/hosts

Question 12

Which TWO commands can be used to list the contents of a tar archive without extracting it?

Accepted Answer

tar -tvf archive.tar. Option A, tar -tvf archive.tar, is correct because the -t flag lists the contents of the archive, -v provides verbose output showing file details, and -f specifies the archive file, all without extracting anything. Option B, tar -ztvf archive.tar.gz, is correct because it adds the -z flag to handle gzip-compressed archives while still using -t to list contents without extraction. Option C is not marked correct because although --list is a valid long form of -t, it is not one of the designated correct answers here. Option D, tar -xjf archive.tar.bz2, is wrong because -x extracts the archive rather than listing it. Option E, tar -xvf archive.tar, is also wrong because -x performs extraction, not listing.

Answer

tar --list archive.tar

Answer

tar -xjf archive.tar.bz2

Answer

tar -xvf archive.tar

Question 13

Refer to the exhibit. The file script.sh has permissions -rwxr-x--- and is owned by root with group 'developers'. A user named 'alice' is a member of the 'developers' group. Which command allows alice to execute the script without changing the file's group ownership?

Accepted Answer

usermod -aG developers alice. The question contains a logical twist: Alice is already a member of the developers group, and the file's group permission is r-x, so she already has execute permission. Therefore, no command is needed to allow execution. However, among the given choices, `usermod -aG developers alice` is the only command that does not alter the file itself (it merely reaffirms her group membership without changing the file's permissions or ownership). The other options modify the file, which is unnecessary and violates the requirement to not change the file's group ownership (or the file in any way). Thus, while redundant, option A is the best answer according to the question's constraints.

Answer

chmod o+x script.sh

Answer

chmod u+x script.sh

Answer

chown alice script.sh

Question 14

A system administrator needs to find all files in /var/log that have been modified in the last 24 hours. Which command accomplishes this?

Accepted Answer

find /var/log -mtime -1. `find /var/log -mtime -1` finds files modified less than 1 day ago (i.e., within the last 24 hours). The `-mtime` option with a negative number (`-1`) matches files whose content was modified less than n*24 hours ago, which is exactly what the question requires.

Answer

find /var/log -mtime 0

Answer

find /var/log -newer /var/log/syslog

Answer

find /var/log -mtime 1

Question 15

An administrator runs 'df -h' and notices that /dev/sda1 is 95% full. The administrator needs to identify the largest files in the filesystem. Which command sequence is most efficient?

Accepted Answer

du -sh /* | sort -rh. It efficiently identifies the largest directories and files at the top level of the filesystem using `du -sh /*` to summarize disk usage per top-level item, then pipes to `sort -rh` to sort by human-readable sizes in descending order. This avoids scanning every single file recursively, making it the fastest approach for a full filesystem.

Answer

find / -type f -size +100M

Answer

ls -lR / | sort -k5 -rn

Answer

find / -type f -exec du -sh {} \;

Question 16

An administrator needs to find the process ID of the cron daemon. Which combination of commands is most effective?

Accepted Answer

pidof cron. `pidof cron` directly returns the numeric process ID(s) of the cron daemon by searching the process name in the `/proc` filesystem. It is the most straightforward command for this specific task, as it outputs only the PID without additional formatting or filtering.

Answer

top -p $(pgrep cron)

Answer

pgrep cron

Answer

ps -C cron -o pid=

Question 17

An administrator wants to find all files larger than 100MB in the /home directory. Which two commands or command sequences achieve this? (Choose two.)

Accepted Answer

find /home -type f -size +100M. Option A is correct because GNU find's -size +100M uses the M suffix to mean 1,048,576-byte units (MiB), so +100M matches regular files strictly larger than 100 MiB in /home. Option D is correct because the k suffix means 1,024-byte units, so +102400k equals 102400 × 1024 = 104,857,600 bytes, the same threshold as 100 MiB, and -type f restricts results to regular files. Option B is wrong because +100000000c compares against 100,000,000 bytes (about 95.4 MiB), not 100 MiB. Option C is wrong because find does not accept the MB suffix; valid size suffixes are b, c, w, k, M, and G. Option E is wrong because the size 100M (without +) matches files of exactly 100 MiB, not files larger than 100MB.

Answer

find /home -type f -size +100000000c

Answer

find /home -type f -size +100MB

Answer

find /home -type f -size 100M

Question 18

Refer to the exhibit.

A user attempts to read /etc/passwd and receives "Permission denied". What is the most likely reason?

Accepted Answer

The user does not have execute permission on the /etc directory.. To read a file, a user needs both read permission on the file itself and execute permission on every directory in the path leading to it. The /etc directory typically has permissions 755 (drwxr-xr-x), which grants execute permission to the owner and group but not to others. If the user is not the owner and not in the group, they lack execute (x) on /etc, which prevents them from traversing into the directory to access /etc/passwd, even if the file's permissions would otherwise allow reading.

Answer

The user is not in the root group.

Answer

The file has the immutable attribute set.

Answer

The user does not have read permission on the file.

Question 19

Refer to the exhibit.

A user attempts to create a file in /backup/snapshots/ but receives an error. What is the most likely cause?

Accepted Answer

The /backup filesystem is mounted read-only.. The error occurs because the /backup filesystem is mounted read-only, which prevents any write operations, including file creation, regardless of directory permissions or available space. This is a common scenario when a filesystem is intentionally mounted with the 'ro' option in /etc/fstab or via the mount command to protect data integrity.

Answer

The /backup directory does not exist.

Answer

The user does not have write permission on /backup.

Answer

The /backup filesystem is full.

Question 20

Refer to the exhibit.

The /data directory needs to be resized to 15GB. What is the first step?

Accepted Answer

Unmount the filesystem.. The first step to resize a filesystem is to unmount it, because most filesystem resizing tools (such as resize2fs for ext4) require the filesystem to be unmounted to safely modify the underlying block device without risking data corruption. Attempting to resize a mounted filesystem can lead to inconsistent metadata and data loss. Unmounting ensures no processes are actively writing to the filesystem during the resize operation.

Answer

Resize the partition using fdisk.

Answer

Create a new partition and copy data.

Answer

Resize the filesystem using resize2fs.