LFCS Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. An administrator attempts to mount all filesystems using mount -a, but it fails. The error message indicates that UUID=jkl012 is not found. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The swap partition is not formatted or missing.. The error 'UUID=jkl012 not found' indicates that the system cannot locate a device with that UUID. Since the swap partition is typically referenced by UUID in /etc/fstab and is not required for normal filesystem mounting, a missing or unformatted swap partition would cause mount -a to fail when it tries to mount the swap entry. This is the most likely cause because swap is often the only filesystem that can be missing without affecting other mounts, yet mount -a processes all entries including swap.

Answer

The /dev/mapper/vg_data-lv_data device does not exist.

Answer

The NFS share is unreachable.

Answer

The /home filesystem type is incorrect.

Question 2

Refer to the exhibit. What is the most likely issue with the Apache web server?

Accepted Answer

The DocumentRoot directory does not exist.. The most likely issue is that the DocumentRoot directory does not exist. When Apache starts, it checks for the existence of the directory specified by the DocumentRoot directive (e.g., /var/www/html). If this directory is missing, Apache will fail to serve content and may log an error like 'Primary script unknown' or 'Directory index forbidden', even though the service itself is running and enabled. This is a common misconfiguration after moving or deleting the web root.

Answer

The service is not enabled.

Answer

The main PID is incorrect.

Answer

The service is not running.

Question 3

A team of developers must share files under /opt/project. All developers are members of the 'devteam' group. New files must be automatically assigned to group 'devteam' and be writable by the group. Which umask and setgid configuration should be applied?

Accepted Answer

Set setgid bit on /opt/project and set umask for developers to 002. Setting the setgid bit on /opt/project ensures that new files inherit the group ownership of the directory (devteam), and setting the umask to 002 removes write permission for others but preserves group write permission, so new files are group-writable. This combination meets both requirements automatically without manual intervention.

Answer

Set setgid bit on /opt/project and set umask to 007

Answer

Set the sticky bit on /opt/project and umask to 022

Answer

Set umask for developers to 002 only

Question 4

A service unit has the directive 'ExecStartPre=/bin/true' and 'ExecStart=/usr/bin/myapp'. What is the effect of ExecStartPre?

Accepted Answer

It runs a pre-start script; if it fails, the service is not started.. ExecStartPre is a systemd directive that specifies a command to run before the main ExecStart command. If the ExecStartPre command fails (returns a non-zero exit code), systemd will not proceed to start the service, unless the '-' prefix is used to ignore failure. Here, /bin/true always succeeds (exit code 0), so it does not block the service, but the directive itself is designed to enforce a pre-start check.

Answer

It sets an environment variable.

Answer

It runs a post-start script.

Answer

It runs a pre-start script; if it fails, the service still starts.

Question 5

An administrator wants to run a script daily at 2 AM. They create a timer unit and a service unit. The service unit uses Type=oneshot. Which of the following timer configurations is correct?

Accepted Answer

OnCalendar=*-*-* 02:00:00. `OnCalendar=*-*-* 02:00:00` specifies an absolute calendar event that triggers the timer at 2:00 AM every day, regardless of when the system booted or when the service last ran. This matches the requirement to run a script daily at a fixed time, and it works correctly with a `Type=oneshot` service unit.

Answer

OnUnitActiveSec=24h

Answer

OnBootSec=1d

Answer

OnActiveSec=24h

Question 6

Which THREE of the following are valid methods to temporarily switch to a different user account without logging out entirely? (Choose three.)

Accepted Answer

sudo -u username -s. Options A, B, and E are correct. `sudo -u username -s` launches a shell as the specified user. `su - username` starts a login shell as that user. `runuser -l username -c 'bash'` runs a command as another user (common in scripts). Option C (`newgrp groupname`) changes the group, not the user. Option D (`login username`) requires a full login, which logs out the current session.

Answer

newgrp groupname

Answer

login username

Question 7

A system administrator needs to find all files in /home that are owned by user 'alice' and have been modified in the last 7 days. The administrator then wants to compress those files into a single archive named alice_recent.tar.gz. Which of the following commands accomplishes this?

Accepted Answer

tar -czf alice_recent.tar.gz -T <(find /home -user alice -mtime -7). It uses `tar -czf` with process substitution to compress the files found by `find` into a gzipped tar archive named alice_recent.tar.gz. The `-z` flag enables gzip compression, and `-T <(...)` reads the list of files from the process substitution, which runs `find` to locate files owned by alice modified within the last 7 days. Options A, B, and D either do not compress or use incompatible formats.

Answer

find /home -user alice -mtime -7 -exec tar -rf alice_recent.tar.gz {} +

Answer

find /home -user alice -mtime -7 -print | cpio -o > alice_recent.tar.gz

Answer

find /home -user alice -mtime -7 | tar -cvf alice_recent.tar.gz

Question 8

Which THREE of the following are valid methods to mount an NFS filesystem on a client?

Accepted Answer

mount -o hard,intr server:/export /mnt. The `mount` command with `-o hard,intr` specifies NFS-specific mount options: `hard` ensures that NFS operations retry indefinitely until the server responds, and `intr` allows signals to interrupt a hung NFS operation. The command `mount -o hard,intr server:/export /mnt` uses the default NFS version (typically NFSv3) and is a valid method to mount an NFS filesystem on a client.

Answer

echo 'server:/export /mnt nfs defaults 0 0' >> /etc/fstab && mount -a

Answer

mount -t cifs server:/share /mnt

Question 9

A system administrator needs to securely transfer files between two Linux servers using port 22. The administrator uses the following command: 'scp file.txt user@remote:/tmp/'. The transfer fails with the error 'Permission denied (publickey)'. What is the most likely cause?

Accepted Answer

The client's public key is not in the remote user's authorized_keys file.. The error 'Permission denied (publickey)' indicates that the SSH key-based authentication failed. SCP uses SSH for transport, and by default, SSH on the remote server checks the client's public key against the remote user's ~/.ssh/authorized_keys file. If the client's public key is not listed there, the SSH server rejects the connection, causing the SCP transfer to fail.

Answer

The remote server does not have SSH installed.

Answer

The SSH service is not running on the remote server.

Answer

The remote server's firewall is blocking port 22.

Question 10

A server has two network interfaces: eth0 (192.168.1.10/24) and eth1 (10.0.0.10/24). The default gateway is 192.168.1.1. The administrator wants traffic to 10.0.1.0/24 to go through eth1's gateway 10.0.0.1. Which command adds this route?

Accepted Answer

Both B and C are correct. Both B and C are valid `ip route add` syntax variations that achieve the same result: adding a route to 10.0.1.0/24 via gateway 10.0.0.1 on interface eth1. The `ip route` command accepts the `via` and `dev` keywords in either order, making both B and C syntactically correct. Option D uses the legacy `route` command with improper syntax (missing `dev` keyword before the interface name), which would fail or produce unexpected behavior.

Answer

ip route add 10.0.1.0/24 via 10.0.0.1 dev eth1

Answer

ip route add 10.0.1.0/24 dev eth1 via 10.0.0.1

Answer

route add -net 10.0.1.0 netmask 255.255.255.0 gw 10.0.0.1 eth1

Question 11

Based on the exhibit, what is the most likely cause of the nginx failure and the appropriate first step to resolve it?

Accepted Answer

Check which process is listening on port 80 with 'ss -tlnp' and stop that process.. The error 'Address already in use' indicates port 80 is occupied by another process. Checking with 'ss -tlnp' or 'lsof' identifies the offending process. Option A is incorrect as restarting would fail again. Option C is incorrect because worker_connections affects performance, not binding. Option D is incorrect because MaxClients is an Apache directive, not nginx.

Answer

Restart the nginx service.

Answer

Increase the worker_connections in nginx.conf.

Answer

Reduce the MaxClients parameter in nginx.conf.

Question 12

An administrator configures a systemd service with Restart=on-failure and RestartSec=10. What happens if the service exits with a non-zero exit code?

Accepted Answer

It waits 10 seconds before restarting. When Restart=on-failure is set, systemd only restarts the service if it exits with a non-zero exit code or is terminated by a signal (excluding SIGHUP, SIGINT, SIGTERM, and SIGPIPE). The RestartSec=10 directive then introduces a 10-second delay before the restart attempt, preventing rapid restart loops and giving the system time to stabilize.

Answer

It restarts immediately

Answer

It retries infinitely regardless of exit code

Answer

It does not restart

Question 13

Which THREE statements about Linux network bonding modes are correct? (Choose three.)

Accepted Answer

Mode 0 (balance-rr) can cause out-of-order packet delivery.. Mode 0 (balance-rr) transmits packets in sequential order from the first available slave through the last, then starts over. This round-robin distribution can cause packets belonging to the same TCP session to take different physical paths, leading to out-of-order delivery at the receiver, which may trigger TCP retransmissions and degrade performance.

Answer

Mode 2 (balance-xor) distributes traffic based on packet type.

Answer

Modes 5 and 6 (balance-tlb and balance-alb) require IEEE 802.3ad switch support.

Question 14

After running 'chage -l bob', the output shows: 'Last password change: Apr 01, 2023', 'Password expires: May 31, 2023', 'Account expires: Jul 15, 2023'. What will happen on May 31, 2023?

Accepted Answer

Bob can still log in but will be forced to change his password.. On May 31, 2023, Bob's password expires. According to the PAM (Pluggable Authentication Modules) configuration and the `chage` command's behavior, a password expiration does not lock the account or disable the password; instead, it forces the user to change their password at the next login. The user can still authenticate with their current password, but upon successful authentication, the system will prompt them to set a new password before granting access to the shell.

Answer

Bob's account will be locked.

Answer

Bob's password will be disabled.

Answer

Bob will receive a warning message only.

Question 15

An administrator notices that the system clock is drifting significantly. To synchronize time using NTP, which command should be used to immediately sync with a server?

Accepted Answer

chronyd -q. `chronyd -q` sends a single NTP query to synchronize the system clock immediately and then exits, which is ideal for one-shot synchronization. This command is part of the `chrony` suite, the default NTP implementation on modern RHEL/CentOS 8+ and Ubuntu 18.04+ systems, and it respects the NTP protocol (RFC 5905) for accurate time adjustment.

Answer

ntpdate -u pool.ntp.org

Answer

ntpd -g

Answer

timedatectl set-ntp true

Question 16

A process is consuming 99% CPU and is unresponsive to normal shutdown requests. After running 'top', you see the PID is 1234. What is the most appropriate command to stop the process gracefully first?

Accepted Answer

kill -15 1234. Kill -15 1234. The SIGTERM signal (15) is the standard way to request a process terminate gracefully, allowing it to clean up resources, close files, and perform shutdown routines. This is the most appropriate first step before escalating to stronger signals, as it gives the process a chance to exit normally.

Answer

kill -19 1234

Answer

kill -2 1234

Answer

kill -9 1234

Question 17

A security policy requires that a user account 'temp_audit' be locked immediately without changing the password. Which command locks the account and prevents login?

Accepted Answer

usermod -L temp_audit. The `usermod -L` command locks a user account by placing an exclamation mark (!) at the beginning of the password hash in /etc/shadow, effectively disabling password-based authentication without altering the existing password. This satisfies the security policy requirement to immediately prevent login without changing the password.

Answer

userdel temp_audit

Answer

chage -E 0 temp_audit

Answer

passwd -u temp_audit

Question 18

Which THREE of the following statements about the user private group (UPG) scheme are true?

Accepted Answer

It is the default scheme in Red Hat-based distributions.. Options A, D, and E are true. A: It is the default scheme in Red Hat-based distributions. D: It ensures that new files have a default group of the user's private group. E: Each user is assigned a unique group with the same name as the username. B is false because umask 0027 gives group read permission, not denies it. C is false because the primary group is the user's private group, not a system group.

Answer

The umask 0027 ensures files created are NOT readable by the group.

Answer

The primary group of a user is a system group with GID less than 1000.

Question 19

An administrator created an LVM snapshot of a logical volume to perform a backup. During the backup, the snapshot runs out of space. What will happen to the original logical volume?

Accepted Answer

The snapshot becomes invalid and must be recreated.. When an LVM snapshot runs out of space, it becomes invalid and cannot track changes made to the original logical volume during the backup. The snapshot is automatically dropped by the device-mapper, and any attempt to mount or read it will fail. The original logical volume remains fully functional and unaffected, but the snapshot must be recreated to perform a new backup.

Answer

The original volume becomes read-only.

Answer

The backup completes successfully but data may be inconsistent.

Answer

The original volume is automatically extended.

Question 20

You are a systems administrator for a company that runs a critical web application on a Linux server. The server has two network interfaces: eth0 (public IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (private IP 10.0.0.10/24). The web server listens on port 443 (HTTPS) and must be accessible from the internet. The server also needs to connect to an internal database server at 10.0.0.50/24 on port 3306. Recently, users reported that the website is intermittently unreachable. You SSH into the server and run 'ss -tln' and see that the web server is listening on 0.0.0.0:443. You check the routing table with 'ip route show' and see: default via 203.0.113.1 dev eth0; 10.0.0.0/24 dev eth1 proto kernel scope link src 10.0.0.10. You also run 'iptables -L -n -v' and see: Chain INPUT (policy ACCEPT), with no rules. However, you notice that the server's default gateway is unreachable from the server itself when you run 'ping 203.0.113.1' (100% packet loss). What is the most likely cause of the intermittent unreachability?

Accepted Answer

The default gateway is unreachable, preventing return traffic from the internet.. The server's default gateway (203.0.113.1) is unreachable, as confirmed by the 100% packet loss on ping. This means that although the web server is listening on 0.0.0.0:443 and the firewall allows traffic, any response packets from the server to internet clients must be routed through the default gateway. Without a working gateway, return traffic cannot reach the clients, causing intermittent unreachability from the internet.

Answer

The web server is not listening on the public IP address.

Answer

A firewall rule is blocking incoming HTTPS traffic.

Answer

The private interface eth1 has a misconfigured IP address.