LFCS Essential Commands Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. The administrator receives alerts that the root filesystem is almost full. Which command could free up space by removing old log files?

Accepted Answer

find /var/log -name '*.log' -mtime +30 -delete. The `find` command with `-name '*.log'` targets log files, `-mtime +30` selects files modified more than 30 days ago, and `-delete` removes them. This safely frees space by purging only old logs, preserving recent logs needed for troubleshooting.

Answer

truncate -s 0 /var/log/syslog

Answer

rm -rf /var/log/*

Answer

du -sh /var/log

Question 2

A system administrator notices that '/var/log/syslog' has grown very large and is consuming significant disk space. The administrator wants to identify the largest log files in the '/var/log' directory hierarchy. Which command should the administrator use?

Accepted Answer

du -ah /var/log | sort -hr | head -10. `du -ah /var/log` calculates the disk usage of all files and directories in `/var/log` in human-readable format, then `sort -hr` sorts them by size in descending order, and `head -10` shows the top 10 largest entries. This directly identifies the largest log files in the hierarchy, which is exactly what the administrator needs.

Answer

find /var/log -size +100M -exec ls -lh {} \;

Answer

df -h /var/log

Answer

ls -lhS /var/log

Question 3

A developer reports that a compiled binary 'app' fails to execute with 'Permission denied' error when run from a mounted directory '/mnt/software'. The binary has execute permissions for all users. What is the most likely cause?

Accepted Answer

The filesystem is mounted with the 'noexec' option.. The 'noexec' mount option prevents execution of any binary files on the filesystem, regardless of their file permissions. When a filesystem is mounted with 'noexec', the kernel will refuse to execute binaries from that mount point, returning 'Permission denied' even if the binary has execute permissions for all users. This is a common security measure for mounted directories like /mnt/software to prevent unauthorized code execution.

Answer

SELinux is blocking execution.

Answer

The binary is linked against missing libraries.

Answer

The binary is setuid but owned by a user other than root.

Question 4

Which TWO commands can be used to display the contents of a text file that has been compressed with gzip without decompressing it to disk?

Accepted Answer

zcat file.gz. Option C, zcat file.gz, is correct because zcat is functionally equivalent to gunzip -c and writes the decompressed contents of a gzip file directly to standard output, leaving no decompressed file on disk. Option D, gunzip -c file.gz, is correct because the -c (--stdout) flag tells gunzip to send the decompressed data to standard output instead of replacing the .gz file with an uncompressed one. Option A, xzcat file.gz, is wrong because xzcat handles files compressed with xz/lzma, not gzip format. Option B, gzip -l file.gz, is wrong because -l only lists the compressed and uncompressed sizes and ratio; it does not display the file's contents. Option E, bzcat file.gz, is wrong because bzcat decompresses bzip2 files, not gzip files.

Answer

xzcat file.gz

Answer

gzip -l file.gz

Answer

bzcat file.gz

Question 5

Which THREE of the following statements about Linux file permissions are correct?

Accepted Answer

The command 'chmod 400 secret.txt' sets read-only permission for the owner only.. Option B is correct because chmod 400 secret.txt assigns the octal value 4 (read) to the owner and 0 (no permissions) to group and others, producing r--------, i.e., read-only for the owner only. Option C is correct because chmod 755 file sets owner to 7 (rwx), group to 5 (r-x), and others to 5 (r-x), yielding rwxr-xr-x. Option D is correct because chmod u+x script.sh uses the symbolic mode u+x to add execute permission for the file's owner without altering other permission bits. Option A is wrong because a+w adds write permission for all (user, group, other), not removes it; removal would be a-w. Option E is wrong because chmod 644 yields rw-r--r--, not rw-rw-rw- (which would be 666).

Answer

The command 'chmod a+w file' removes write permission for all.

Answer

The command 'chmod 644 file' sets permissions to rw-rw-rw-.

Question 6

A user reports that they cannot delete a file named 'important.txt' located in their home directory. The file is owned by the user and the user has write permission on the directory. Running 'rm important.txt' produces the error: 'rm: cannot remove 'important.txt': Operation not permitted'. The user has also tried using 'sudo rm' but gets the same error. Which of the following is the most likely cause and correct solution?

Accepted Answer

The file has the immutable attribute set. Use 'lsattr important.txt' and if the 'i' attribute is present, remove it with 'chattr -i important.txt'.. The error 'Operation not permitted' despite the user owning the file and having write permission on the directory indicates a filesystem-level restriction rather than a permission or ACL issue. The immutable attribute (i) on the file prevents any modification, including deletion, even by the root user. Running 'lsattr' reveals the attribute, and 'chattr -i' removes it, allowing deletion.

Answer

The file has an ACL that denies deletion. Use 'setfacl -b important.txt' to remove ACLs.

Answer

The file is currently in use by another process. Use 'lsof' to find the process and kill it.

Answer

The directory has the sticky bit set, preventing deletion. Use 'chmod o-t .' to remove the sticky bit.

Question 7

A system administrator notices that the disk space on the root filesystem is at 95% usage. After investigating, they find that a large log file named 'access.log' in /var/log is taking up significant space. The administrator deletes the file using 'rm /var/log/access.log' but the disk usage remains at 95%. Running 'df -h' still shows the same usage. What is the most likely cause and the correct next step?

Accepted Answer

The file is still open by a process. Use 'lsof | grep access.log' to identify the process and restart it.. When a file is deleted with 'rm' while it is still open by a running process, the file's directory entry is removed, but the inode and data blocks remain allocated until the process closes the file descriptor. This causes 'df' to still report the space as used. The correct next step is to use 'lsof' to find the process holding the file open and restart it, which releases the file descriptor and frees the disk space.

Answer

The file is compressed and needs to be decompressed. Use 'gzip -d access.log' first.

Answer

The filesystem is marked as full in the superblock. Use 'fsck' to repair the filesystem.

Answer

The file has multiple hard links. Use 'find / -links +1' to locate all hard links and delete them.

Question 8

A DevOps engineer is writing a continuous integration pipeline that runs a script to deploy an application. The script is stored in a Git repository and is executed on a build server. The script works locally on the engineer's workstation, but when executed on the build server, it fails with '/bin/sh: line 12: somecommand: command not found'. The 'somecommand' is a standard Linux tool that is installed on the build server. The build server uses a minimal Docker container. Which of the following is the most likely cause and solution?

Accepted Answer

The PATH environment variable is not set correctly in the non-interactive shell. Use the full path to 'somecommand' or set PATH explicitly in the script.. The error 'command not found' despite the tool being installed indicates that the shell cannot locate the executable. In a non-interactive shell (like those used in CI/CD pipelines or minimal Docker containers), the PATH environment variable is often not set or is minimal. The fix is to either use the absolute path to the command or explicitly set PATH in the script to include the directory containing the command.

Answer

The script does not have execute permissions. Add 'chmod +x' before running the script.

Answer

The script requires root privileges. Use 'sudo' to run the script.

Answer

The script is using a different shell than the build server's default. Change the shebang to '#!/bin/sh'.

Question 9

A security audit reveals that a sensitive file '/etc/shadow' has been modified. The file's permissions are set to 600 and owned by root. However, the audit logs show that a service account 'webapp' was able to read the file. The 'webapp' user is not in the root group. Which of the following is the most likely method the 'webapp' user used to read the file?

Accepted Answer

The file has an Access Control List (ACL) granting read permission to 'webapp'.. An Access Control List (ACL) can grant specific permissions to a user or group beyond the traditional Unix permission model. Even though the file's mode is 600 (owner read/write only) and owned by root, a setfacl command could have added an ACL entry (e.g., 'u:webapp:r') that explicitly allows the 'webapp' user to read /etc/shadow. This is a common method to give a service account access to a sensitive file without changing its ownership or group membership.

Answer

The file is a hard link to another file that is readable by 'webapp'.

Answer

The 'webapp' user exploited a SUID binary that reads the file.

Answer

The 'webapp' user used 'sudo' to read the file as root.

Question 10

A system administrator configures a new server with multiple disks. After partitioning and formatting, they mount a partition to /data. Several days later, they notice that the /data filesystem is full, but 'du -sh /data' reports only 2 GB used, while the partition is 100 GB. 'df -h' shows /data is 98% full. What is the most likely cause and the correct action?

Accepted Answer

There are deleted files still held open by processes. Use 'lsof /data' to find and restart those processes.. When a file is deleted but still held open by a running process, the filesystem does not release the disk blocks until the process closes the file descriptor. This causes 'df' to report the space as used, while 'du' cannot see the deleted file's data, leading to the discrepancy. Using 'lsof /data' identifies the processes holding the deleted files, and restarting them frees the space.

Answer

The filesystem is fragmented. Run 'e4defrag' to defragment.

Answer

The filesystem has reserved blocks for root. Reduce the reserved percentage with 'tune2fs -m 0'.

Answer

The 'du' command is not counting hidden files (dot files). Use 'du -sh .*' to include them.

Question 11

A junior administrator needs to create a new empty file named report.txt in the current working directory. They want to ensure that if the file already exists, its contents are not altered. Which command should they run?

Accepted Answer

touch report.txt. The touch command is designed to create empty files or update timestamps without modifying existing content. Redirection methods like echo > or cat > would truncate the file if it already exists, risking data loss. mkdir creates a directory, not a file. Therefore, touch is the correct choice for safely creating an empty file.

Answer

mkdir report.txt

Answer

echo > report.txt

Answer

cat > report.txt

Question 12

A technician must create a hard link named 'report_link' to an existing file '/data/report.txt'. Which command should be used?

Accepted Answer

ln /data/report.txt report_link. The ln command without options creates a hard link by default. This results in two directory entries pointing to the same inode, which is exactly what a hard link is. The other commands either create symbolic links, copies, or rename the file, none of which produce a hard link as required.

Answer

cp /data/report.txt report_link

Answer

mv /data/report.txt report_link

Answer

ln -s /data/report.txt report_link

Question 13

A system administrator needs to change the ownership of the file /var/www/html/index.html from user alice to user bob, and also change the group to webdev. Which command should they use?

Accepted Answer

chown bob:webdev /var/www/html/index.html. The chown command is specifically designed to change file owner and group. Using the colon-separated syntax user:group sets both in one step. chmod deals with permissions, chgrp only changes group, and usermod manages user accounts. Thus, chown with bob:webdev is the correct and efficient solution.

Answer

chmod bob:webdev /var/www/html/index.html

Answer

usermod -o bob:webdev /var/www/html/index.html

Answer

chgrp bob:webdev /var/www/html/index.html

Question 14

A junior administrator is troubleshooting a server and needs to inspect the manual page for the 'ip' command, but the system is a minimal install where the man pages for that package were not installed. The administrator still wants the short one-line usage summary for 'ip' printed directly to the terminal. Which command should they run?

Accepted Answer

ip --help. The utility's own --help option is parsed by the binary itself, so it produces usage information regardless of whether any documentation packages exist on the machine. Because the scenario explicitly describes a minimal install with no man pages, the only reliable way to obtain the short usage summary is to invoke the command with its built-in help flag.

Answer

info ip

Answer

whatis ip

Answer

man ip

Question 15

A junior administrator needs to create a compressed archive of the /etc directory that preserves file ownership and permissions, and writes it to /backup/etc.tar.gz. Which single command accomplishes this?

Accepted Answer

tar -czvf /backup/etc.tar.gz /etc. Creating a gzip-compressed tarball requires the create, gzip, verbose, and file flags together with the source directory. The combination tar -czvf /backup/etc.tar.gz /etc builds the archive in one pass, preserving metadata, and writes it to the specified path. The other commands either attempt extraction, misuse compression tools, or produce non-tar output.

Answer

gzip -r /etc > /backup/etc.tar.gz

Answer

cpio -ov /etc < /backup/etc.tar.gz

Answer

tar -xzvf /backup/etc.tar.gz /etc