LFCS Essential Commands Practice Test 3 — 15 Questions

Question 1

An administrator wants to terminate a process with PID 1234 and all its child processes. Which command should be used?

Accepted Answer

kill -9 -1234. The `kill` command with a negative PID (e.g., `kill -9 -1234`) sends the signal to the process group identified by the absolute value of the PID. Since process group IDs typically equal the PID of the group leader, using `-1234` targets the entire process group, terminating PID 1234 and all its child processes. The `-9` (SIGKILL) ensures immediate termination without cleanup.

Answer

pkill -P 1234

Answer

kill -15 1234

Answer

kill -9 1234

Question 2

Refer to the exhibit. The nginx service failed to start. What is the most likely immediate next step to diagnose the issue?

Accepted Answer

Run nginx -t to test configuration. `nginx -t` tests the configuration file syntax and validity before attempting to start the service. Since nginx failed to start, a configuration error is a common cause, and this command immediately identifies syntax errors or missing directives without restarting the service.

Answer

Run journalctl -u nginx.service -x -n 50

Answer

Run apt-get install nginx

Answer

Run systemctl restart nginx

Question 3

A system administrator is managing a production web server running CentOS 7. The server hosts a critical application that depends on the 'httpd' package. Recently, the administrator attempted to install an updated version of httpd using 'yum update httpd', but the update failed with a dependency error: 'Error: Package: httpd-2.4.6-97.el7.centos.x86_64 requires libapr-1.so.0()(64bit)'. The administrator verifies that the apr package is installed (apr-1.5.2-6.el7.x86_64) and that the required library file exists at /usr/lib64/libapr-1.so.0. Despite this, yum continues to fail with the same error. After checking the yum repository configuration, the administrator notices that the base repository lists 'mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os' and the 'baseurl' is commented out. The system's /etc/yum.conf has 'keepcache=1'. What is the most likely cause of the dependency error, and which command should the administrator run to resolve it?

Accepted Answer

The repository metadata is stale; run 'yum clean all' then 'yum update'.. The dependency error persists despite the library being present because yum's metadata is stale. Running 'yum clean all' clears the local cache, forcing yum to download fresh metadata from the repository, which resolves the false dependency conflict. Option C is correct. Option A is not necessary as 'yum clean all' handles cache clearing properly. Option B bypasses dependency checks and is unsafe. Option D is incorrect because the installed apr version does provide the required library.

Answer

The yum cache is corrupted; delete /var/cache/yum manually and run 'yum makecache'.

Answer

The dependency is satisfied but yum's dependency resolver has a bug; use 'rpm -Uvh httpd.rpm --nodeps' to bypass dependency check.

Answer

The installed apr package is from a different version than what httpd expects; install a newer apr from a different repository.

Question 4

A system administrator needs to stop a misbehaving process gracefully, allowing it to clean up resources. The process is unresponsive to the standard SIGTERM signal. What should the administrator do next?

Accepted Answer

Use 'kill -15' again, wait a few seconds, then use 'kill -9' if still unresponsive.. The standard escalation path for terminating an unresponsive process is to first send SIGTERM (signal 15) to request a graceful shutdown, then after a brief wait, send SIGKILL (signal 9) if the process has not terminated. This allows the process a chance to clean up resources before being forcibly killed, which is the recommended practice in Linux process management.

Answer

Wait for the process to finish on its own.

Answer

Use 'kill -9' immediately.

Answer

Send SIGTERM again with a higher priority.

Question 5

A database administrator wants to compress a large directory of log files for archival. The administrator uses the command: tar -cvf logs.tar.gz logs/. The command completes successfully but the resulting archive is only 10 MB while the original directory is 100 MB. What is the most likely reason?

Accepted Answer

The 'z' flag was omitted, so the archive is not compressed.. The command `tar -cvf logs.tar.gz logs/` does not include the `-z` flag, which is required to invoke gzip compression. Without `-z`, `tar` creates an uncompressed archive, and the `.gz` extension is misleading—the file is actually a plain tar archive. The resulting 10 MB size is simply the tarred version of the logs directory, not a compressed one, which explains why it is much smaller than the original 100 MB of uncompressed files.

Answer

The 'tar' command used relative paths and missed some files.

Answer

The logs directory contains many small files, causing high tar overhead.

Answer

The log files are already compressed individually.

Question 6

A system administrator monitors a server that periodically becomes unresponsive for a few seconds. Investigation reveals that the kernel OOM killer is being invoked, but standard memory usage monitoring tools like 'free' and 'top' show less than 50% memory usage. The server runs a web server and a database. Which of the following is the most likely cause and diagnostic step?

Accepted Answer

The kernel is using a large amount of memory for slab caches. Use 'slabtop' to examine kernel memory allocations.. The kernel OOM killer can be triggered by high slab cache usage, which is memory allocated for kernel data structures like inode and dentry caches. Standard tools like 'free' and 'top' may show low overall memory usage because they report only user-space memory, while slab caches are accounted separately. Using 'slabtop' allows the administrator to identify which kernel slab caches are consuming excessive memory, often due to a large number of small files or heavy filesystem metadata operations.

Answer

The server is experiencing a fork bomb. Use 'ps -ef | wc -l' to count processes.

Answer

The database is using swap space excessively. Use 'swapon -s' to check swap usage.

Answer

The web server is leaking file descriptors. Use 'lsof -n' to check open files.

Question 7

A system administrator needs to ensure that a new file created in the directory /shared inherits the group 'team' and that all files created there by any user are group-readable and group-writable. Which two commands should be used? (Choose two.)

Accepted Answer

chmod g+s /shared. To ensure new files inherit the group 'team', the setgid bit on the directory is needed, which is accomplished with chmod g+s. To enforce group read and write permissions on new files, a default ACL with setfacl -d is appropriate. Together, these two commands provide the required inheritance and permissions. The other options either affect only existing files or are not persistent.

Answer

chown -R team /shared

Answer

umask 002

Answer

chmod g+r,g+w /shared

Question 8

A system administrator needs to create a hard link named backup.txt to an existing file /data/report.txt on the same ext4 filesystem. Which command should they use?

Accepted Answer

ln /data/report.txt backup.txt. The ln command is the standard utility for creating hard links. Without -s, it creates a hard link, sharing the same inode. The -s option creates a symbolic link, which is different. cp -l and link can also create hard links but are less conventional. Therefore, ln /data/report.txt backup.txt is the correct and expected command.

Answer

ln -s /data/report.txt backup.txt

Answer

cp -l /data/report.txt backup.txt

Answer

link /data/report.txt backup.txt

Question 9

A junior administrator needs to create a new empty configuration file at /etc/nginx/conf.d/site.conf before pasting content into it with a text editor. Which command should they run to create the file without altering its timestamp on subsequent runs?

Accepted Answer

touch /etc/nginx/conf.d/site.conf. Creating an empty file for later editing is the classic use of touch, which creates the file if absent and otherwise just refreshes timestamps. Commands that make directories, symlinks to device nodes, or unbounded data streams do not yield a normal empty regular file, so they fail the stated goal of preparing a writable config file.

Answer

ln -s /dev/null /etc/nginx/conf.d/site.conf

Answer

cat > /etc/nginx/conf.d/site.conf < /dev/zero

Answer

mkdir -p /etc/nginx/conf.d/site.conf

Question 10

A storage administrator notices that a newly attached disk appears as /dev/sdb but has no partition table or filesystem. Before creating anything on it, the administrator wants to confirm the exact capacity in bytes and the logical sector size that the kernel detected for that block device. Which command provides this information directly?

Accepted Answer

lsblk -b -o NAME,SIZE,LOG-SEC /dev/sdb. lsblk pulls its data from sysfs, so it can describe a block device's size and logical sector size even when the device has no partition table or filesystem. The -b flag forces byte units instead of human-readable suffixes, and selecting LOG-SEC exposes the logical sector size, which is precisely the pre-format inspection the administrator needs.

Answer

fdisk -l /dev/sdb

Answer

df -h /dev/sdb

Answer

blkid /dev/sdb

Question 11

A system administrator needs to view the first 10 lines of a large log file /var/log/syslog and also monitor it in real time as new entries are appended. Which TWO commands or command combinations should they use? (Choose two.)

Accepted Answer

tail -f /var/log/syslog. To view the first 10 lines, head is the correct command as it defaults to 10 lines. To monitor a log in real time, tail -f is the standard tool that follows file appends. Other options either show the wrong portion of the file or lack real-time following. Thus, head and tail -f together meet the requirements.

Answer

cat /var/log/syslog | less

Answer

watch -n 2 head /var/log/syslog

Answer

tail -n 10 /var/log/syslog

Question 12

A junior administrator needs to create a new empty file named 'report.txt' in the current working directory. The file must not exist beforehand, and the command should fail with an error if the file already exists. Which command accomplishes this?

Accepted Answer

set -o noclobber; > report.txt. The noclobber shell option causes the redirection operator to fail when the target file already exists, while still creating the file when it is absent. This gives the exact create-if-absent and error-if-present behaviour requested. The other approaches either silently overwrite existing content or decline to create the file at all, so they do not satisfy both conditions.

Answer

touch -c report.txt

Answer

echo -n > report.txt

Answer

touch report.txt

Question 13

A junior administrator needs to create a compressed archive named project.tar.gz containing all files and subdirectories within /home/dev/project. The archive must be created in the current working directory, /home/dev. Which command should they use?

Accepted Answer

tar -czf project.tar.gz -C /home/dev/project .. Creating a gzip-compressed tarball requires tar with -c, -z, and -f. To include the contents of /home/dev/project without embedding absolute paths, use -C to change directory and then specify the dot. This yields an archive that extracts cleanly into the current directory, preserving relative structure.

Answer

tar -czf project.tar.gz /home/dev/project

Answer

tar -xzf project.tar.gz /home/dev/project

Answer

tar -cjf project.tar.gz /home/dev/project

Question 14

An administrator must archive the entire /etc directory into a single gzip-compressed tar file named etc-backup.tar.gz while preserving ownership and permissions. The archive will be restored on another host with the same path layout. Which command should be used?

Accepted Answer

tar -czpf etc-backup.tar.gz /etc. To create a gzip-compressed tar archive while preserving permissions, the flags -c, -z, -p, and -f are combined. The -p flag retains permission bits, and -z ensures gzip compression matching the .tar.gz name. Alternatives either omit permission preservation, choose the wrong compression algorithm, or use an indirect pipeline that does not satisfy the explicit preservation requirement.

Answer

tar -czf etc-backup.tar.gz /etc

Answer

tar -cjf etc-backup.tar.gz /etc

Answer

tar -cf etc-backup.tar.gz /etc && gzip etc-backup.tar.gz

Question 15

An administrator wants to find all regular files under /srv that are larger than 100 MB and were modified more than 30 days ago, then delete them. Which command should they run?

Accepted Answer

find /srv -type f -size +100M -mtime +30 -delete. Combining -type f, -size +100M, -mtime +30, and -delete expresses all three conditions and performs the deletion atomically per match. The plus signs are essential for greater-than comparisons. Exact-value variants miss the intended files, and access-time selection targets the wrong timestamp.

Answer

find /srv -type f -size +100M -mtime +30 | xargs rm

Answer

find /srv -type f -size 100M -mtime 30 -exec rm {} \;

Answer

find /srv -type f -size +100M -atime +30 -delete