LFCS Hard Questions — 25 Difficult Questions

Question 1

After deleting user 'alice', the system administrator wants to also remove the home directory and mail spool. Which command should be used?

Accepted Answer

userdel -r alice. The correct option is B, userdel -r alice. The -r flag removes the user's home directory and mail spool, along with the user account. This is the standard flag for removing user data along with the account.

Answer

userdel -Z alice

Answer

userdel -f alice

Answer

userdel --remove alice

Question 2

An administrator needs to set up a shared directory /project for the group 'projectteam' (GID 5000). All members of the group should be able to create and delete files, but only the file owner can modify their own files. The directory should also ensure that new files inherit the group ownership. Which set of commands achieves this?

Accepted Answer

chown root:projectteam /project; chmod 2770 /project; setfacl -d -m o::--- /project. Option B correctly achieves all requirements. 'chown root:projectteam /project' sets the owner and group. 'chmod 2770 /project' sets the SGID bit (2) so new files inherit the group 'projectteam', and gives the owner and group full rwx on the directory (allowing group members to create and delete files), while granting no permissions to others. 'setfacl -d -m o::---' adds a default ACL that denies all access to others for new items. Since no default group ACL is defined, new files inherit group permissions from the process umask (typically 022, giving group read-only). Thus, group members have read-only access to files owned by others, so only the file owner can modify their files. All requirements are met without unnecessary ACLs for the group.

Answer

chown root:projectteam /project; chmod 2775 /project; setfacl -m g:projectteam:rwx /project

Answer

chown root:projectteam /project; chmod 2775 /project

Answer

chown root:projectteam /project; chmod 1770 /project; setfacl -m m::rwx /project

Question 3

Which THREE of the following are valid methods to temporarily switch to a different user account without logging out entirely? (Choose three.)

Accepted Answer

sudo -u username -s. Option A (sudo -u username -s) is correct because sudo with -u runs a shell as the specified target user, and -s invokes the user's shell, effectively switching identity without ending the current login session. Option B (su - username) is correct because su starts a login shell as the target user, changing the effective UID and loading that user's environment while the original session remains active in the background. Option E (runuser -l username -c 'bash') is correct because runuser, like su, changes to the target user and -l produces a login shell, with -c 'bash' executing bash as that user, all without logging out. Option C (newgrp groupname) is not a user-account switch; it only changes the current user's effective primary group in a new shell. Option D (login username) is not a temporary switch because login replaces the current session with a fresh login process, requiring re-authentication and ending the existing session.

Answer

newgrp groupname

Answer

login username

Question 4

A system administrator needs to find all files in /home that are owned by user 'alice' and have been modified in the last 7 days. The administrator then wants to compress those files into a single archive named alice_recent.tar.gz. Which of the following commands accomplishes this?

Accepted Answer

tar -czf alice_recent.tar.gz -T <(find /home -user alice -mtime -7). It uses `tar -czf` with process substitution to compress the files found by `find` into a gzipped tar archive named alice_recent.tar.gz. The `-z` flag enables gzip compression, and `-T <(...)` reads the list of files from the process substitution, which runs `find` to locate files owned by alice modified within the last 7 days. Options A, B, and D either do not compress or use incompatible formats.

Answer

find /home -user alice -mtime -7 -exec tar -rf alice_recent.tar.gz {} +

Answer

find /home -user alice -mtime -7 -print | cpio -o > alice_recent.tar.gz

Answer

find /home -user alice -mtime -7 | tar -cvf alice_recent.tar.gz

Question 5

A system administrator needs to replace all occurrences of 'oldhost' with 'newhost' in /etc/hosts, but only on lines that contain the string 'domain'. Which sed command accomplishes this?

Accepted Answer

sed -i '/domain/s/oldhost/newhost/g' /etc/hosts. Options A and D are correct because they use `-i` for in-place editing, restrict substitution to lines containing 'domain' with `/domain/`, and use the `g` flag to replace all occurrences on each line. Option B is incorrect because it only outputs lines containing 'domain' to stdout but does not edit the file. Option C is incorrect because it lacks the `g` flag, replacing only the first occurrence per line. Option E is incorrect because `-n` suppresses default output and `p` prints only lines where substitution occurred, but the file is not modified.

Answer

sed 's/oldhost/newhost/g' /etc/hosts | grep domain

Answer

sed -i '/domain/s/oldhost/newhost/' /etc/hosts

Answer

sed -ne '/domain/s/oldhost/newhost/gp' /etc/hosts

Question 6

After running 'chage -l bob', the output shows: 'Last password change: Apr 01, 2023', 'Password expires: May 31, 2023', 'Account expires: Jul 15, 2023'. What will happen on May 31, 2023?

Accepted Answer

Bob can still log in but will be forced to change his password.. On May 31, 2023, Bob's password expires. According to the PAM (Pluggable Authentication Modules) configuration and the `chage` command's behavior, a password expiration does not lock the account or disable the password; instead, it forces the user to change their password at the next login. The user can still authenticate with their current password, but upon successful authentication, the system will prompt them to set a new password before granting access to the shell.

Answer

Bob's account will be locked.

Answer

Bob's password will be disabled.

Answer

Bob will receive a warning message only.

Question 7

An administrator notices that the system clock is drifting significantly. To synchronize time using NTP, which command should be used to immediately sync with a server?

Accepted Answer

chronyd -q. `chronyd -q` sends a single NTP query to synchronize the system clock immediately and then exits, which is ideal for one-shot synchronization. This command is part of the `chrony` suite, the default NTP implementation on modern RHEL/CentOS 8+ and Ubuntu 18.04+ systems, and it respects the NTP protocol (RFC 5905) for accurate time adjustment.

Answer

ntpdate -u pool.ntp.org

Answer

ntpd -g

Answer

timedatectl set-ntp true

Question 8

Which THREE of the following statements about the user private group (UPG) scheme are true?

Accepted Answer

It is the default scheme in Red Hat-based distributions.. Options A, D, and E are true. A: It is the default scheme in Red Hat-based distributions. D: It ensures that new files have a default group of the user's private group. E: Each user is assigned a unique group with the same name as the username. B is false because umask 0027 gives group read permission, not denies it. C is false because the primary group is the user's private group, not a system group.

Answer

The umask 0027 ensures files created are NOT readable by the group.

Answer

The primary group of a user is a system group with GID less than 1000.

Question 9

The backup script fails to run as user 'backup' with sudo. What is the issue?

Accepted Answer

The script does not have execute permission for the 'backup' user.. For a script to be executed via sudo, the user (backup) must have execute permission on the script file. Even if sudo is configured to allow the user to run the script, the operating system enforces file permission checks at execution time. Without the execute bit set for the backup user (or for others, depending on the sudo runas context), the kernel will refuse to execve() the script, resulting in a 'Permission denied' error.

Answer

The script has a restrictive umask.

Answer

The script is not owned by 'backup'.

Answer

The 'backup' user is not in the sudoers file.

Question 10

A developer needs to extract the third column from a CSV file where columns are separated by commas, but some fields contain commas within double quotes. Which command correctly handles this?

Accepted Answer

awk 'BEGIN { FPAT = "[^,]*|\"[^\"]+\"" } { print $3 }' file.csv. It uses `awk` with the `FPAT` variable to define a field pattern that correctly handles commas inside double-quoted fields. The pattern `[^,]*|"[^"]+"` matches either a sequence of non-comma characters or a double-quoted string (including any commas within it), ensuring that the third column is extracted accurately even when fields contain embedded commas.

Answer

cut -d',' -f3 file.csv

Answer

awk -F',' '{ print $3 }' file.csv

Answer

sed 's/[^,]*,[^,]*,$[^,]*$.*/\1/' file.csv

Question 11

A system administrator needs to schedule a one-time task that will run at 2:30 AM on July 15. Which command should be used to create this job?

Accepted Answer

at 2:30 AM July 15. The at command is specifically designed for scheduling one-time tasks at a precise date and time. Using at 2:30 AM July 15 allows the administrator to queue a command that will execute once at that moment, fulfilling the requirement.

Answer

crontab -e

Answer

systemd-run --on-calendar="*-07-15 02:30:00"

Answer

batch

Question 12

An administrator is configuring a bridge using iproute2. Which command correctly attaches eth0 to bridge br0?

Accepted Answer

ip link set eth0 master br0. The `ip link set eth0 master br0` command attaches the physical interface `eth0` as a slave port of the bridge `br0` using the iproute2 suite. The `master` keyword specifies the bridge device that should become the master of the specified interface, which is the standard way to add an interface to a bridge with iproute2.

Answer

ip link set br0 master eth0

Answer

nmcli device modify eth0 master br0

Answer

brctl addif br0 eth0

Question 13

A security policy requires that all users in the 'admin' group must have a umask of 027 set automatically upon login. An administrator adds 'umask 027' to /etc/profile. However, users report that the umask is still 022. What is a likely cause?

Accepted Answer

The umask in /etc/profile is overridden by user-specific .bash_profile or .bashrc files.. User-specific shell configuration files (like ~/.bash_profile, ~/.bash_login, or ~/.profile for login shells, and ~/.bashrc for interactive non-login shells) are sourced after /etc/profile. These files can override the system-wide umask setting with a user-defined value, such as the default 022. Since the administrator only modified /etc/profile, any existing user-specific umask command in their personal dotfiles will take precedence.

Answer

The umask command in /etc/profile has a syntax error that is silently ignored.

Answer

The admin placed the umask command after the call to /etc/bash.bashrc which resets it.

Answer

The admin forgot to run 'source /etc/profile' on each user's session.

Question 14

A systems administrator needs to add a new user 'jdoe' with a home directory in /export/home, a UID of 1500, and an expiry date of 2025-12-31. Which command should they use?

Accepted Answer

useradd -u 1500 -d /export/home/jdoe -e 2025-12-31 jdoe. The `useradd` command with `-u 1500` sets the UID, `-d /export/home/jdoe` explicitly specifies the home directory path (without creating it unless `-m` is also used), and `-e 2025-12-31` sets the account expiry date in YYYY-MM-DD format. This matches all requirements: UID 1500, home directory at /export/home/jdoe, and expiry on 2025-12-31.

Answer

useradd -u 1500 -d /export/home/jdoe -c 2025-12-31 jdoe

Answer

useradd -u 1500 -m -e 2025-12-31 jdoe

Answer

useradd -u 1500 -b /export/home -e 2025-12-31 jdoe

Question 15

You are a system administrator for a company that runs a web server on a Linux system. The web server logs are stored in /var/log/nginx/access.log. The log file grows rapidly and rotates weekly via logrotate. The system has been running for several months. Recently, the development team reported that the web server is responding slowly. You suspect that the disk I/O might be high due to log file activity. You check the disk usage and find that /var/log/nginx/access.log is 4 GB, and the rotated logs (access.log.1.gz, access.log.2.gz, etc.) total another 10 GB. The /var partition has 20 GB total, so it's 70% full. You decide to reduce the disk usage by compressing the current log file and truncating it without stopping the nginx service. Which command sequence should you use to safely achieve this?

Accepted Answer

cp /var/log/nginx/access.log /var/log/nginx/access.log.bak && :> /var/log/nginx/access.log && gzip /var/log/nginx/access.log.bak. It first copies the current log file to a backup, then truncates the original file in place using the shell null command (`:>`) without stopping nginx, and finally compresses the backup. This ensures nginx continues writing to the same inode (file descriptor remains valid) and the disk space is reclaimed after compression.

Answer

:> /var/log/nginx/access.log && cp /var/log/nginx/access.log /var/log/nginx/access.log.bak && gzip /var/log/nginx/access.log.bak

Answer

rm /var/log/nginx/access.log && touch /var/log/nginx/access.log && chmod 644 /var/log/nginx/access.log

Answer

mv /var/log/nginx/access.log /var/log/nginx/access.log.bak && touch /var/log/nginx/access.log && gzip /var/log/nginx/access.log.bak

Question 16

A service unit has the directive 'ExecStartPre=/bin/true' and 'ExecStart=/usr/bin/myapp'. What is the effect of ExecStartPre?

Accepted Answer

It runs a pre-start script; if it fails, the service is not started.. ExecStartPre is a systemd directive that specifies a command to run before the main ExecStart command. If the ExecStartPre command fails (returns a non-zero exit code), systemd will not proceed to start the service, unless the '-' prefix is used to ignore failure. Here, /bin/true always succeeds (exit code 0), so it does not block the service, but the directive itself is designed to enforce a pre-start check.

Answer

It sets an environment variable.

Answer

It runs a post-start script.

Answer

It runs a pre-start script; if it fails, the service still starts.

Question 17

An administrator wants to find all files larger than 100MB in the /home directory. Which two commands or command sequences achieve this? (Choose two.)

Accepted Answer

find /home -type f -size +100M. Option A is correct because GNU find's -size +100M uses the M suffix to mean 1,048,576-byte units (MiB), so +100M matches regular files strictly larger than 100 MiB in /home. Option D is correct because the k suffix means 1,024-byte units, so +102400k equals 102400 × 1024 = 104,857,600 bytes, the same threshold as 100 MiB, and -type f restricts results to regular files. Option B is wrong because +100000000c compares against 100,000,000 bytes (about 95.4 MiB), not 100 MiB. Option C is wrong because find does not accept the MB suffix; valid size suffixes are b, c, w, k, M, and G. Option E is wrong because the size 100M (without +) matches files of exactly 100 MiB, not files larger than 100MB.

Answer

find /home -type f -size +100000000c

Answer

find /home -type f -size +100MB

Answer

find /home -type f -size 100M

Question 18

Based on the journalctl output, what is the most likely cause of the service failure?

Accepted Answer

Another process is already using port 8080.. The journalctl output shows a bind error on port 8080 with 'Address already in use'. This indicates that another process is already listening on that port, preventing the service from starting. In systemd, such a failure is logged with the specific errno EADDRINUSE, which directly points to a port conflict.

Answer

The service configuration file has a syntax error.

Answer

The system is out of memory.

Answer

The service is trying to write to a read-only filesystem.

Question 19

An e-commerce company runs a critical application on a Linux server that occasionally becomes unresponsive. The server has 64GB RAM and runs a Java application. The operations team notices that during peak hours, the system becomes very slow and eventually the application crashes with 'OutOfMemoryError'. After restart, it works fine for a while. They suspect a memory leak but also want to ensure the system does not go down during peak hours. The system uses systemd to manage the Java service. The administrator needs to implement a solution that: (1) automatically restarts the service if it becomes unresponsive, (2) limits the memory usage of the service to prevent OOM kills on the system, and (3) provides early warning of high memory usage. Which of the following approaches best meets these requirements?

Accepted Answer

Configure systemd service with WatchdogSec=30, Restart=on-failure, MemoryMax=32G. Also set up a log watcher that alerts when memory usage exceeds 28G via journalctl and a custom script.. It uses systemd's WatchdogSec to detect unresponsiveness and Restart=on-failure to automatically restart the service, while MemoryMax=32G enforces a hard memory limit via cgroups to prevent OOM kills. The custom log watcher provides early warning by alerting when memory usage exceeds 28G, satisfying all three requirements.

Answer

Set up a cron job to run every minute that checks memory usage with free and if > 90%, restart the service with systemctl restart. Also configure MemoryMax=32G in the systemd unit.

Answer

Configure sysctl vm.overcommit_memory=2 to prevent overcommit, and allocate huge pages for Java. Also set Restart=always in the systemd unit.

Answer

Use ulimit -v 33554432 in the service script to limit virtual memory, and set Restart=always. Also configure a cron job to send alerts when dmesg shows OOM.

Question 20

An administrator is troubleshooting a server that runs a critical application. The server has 16 GB of RAM and 8 CPU cores. The administrator notices that the server becomes very slow during peak hours. Analysis of 'iostat -x 1' shows that the average wait time (await) for the main disk (sda) is consistently above 1000 ms, while the average service time (svctm) is around 5 ms. What is the most likely cause?

Accepted Answer

There is a large queue of I/O requests waiting to be serviced.. The 'await' value in iostat represents the average time (in milliseconds) for I/O requests to be serviced, including time spent waiting in the queue. With 'await' at 1000+ ms and 'svctm' at only 5 ms, the vast majority of the time is spent waiting, not being serviced. This indicates a large queue of pending I/O requests, which is the direct cause of the slowdown.

Answer

The CPU is overloaded, causing processes to wait for CPU time.

Answer

The system is using swap space heavily, causing disk I/O.

Answer

The disk is experiencing hardware errors.