LFCS Operation of Running Systems — 15 Questions

Question 1

A system administrator needs to ensure that a specific service, 'myapp', starts automatically after a system crash and also restarts if it fails. Which systemd unit directive should be used to achieve this behavior?

Accepted Answer

Restart=on-failure and WantedBy=multi-user.target. Option C is correct because the combination of `Restart=on-failure` ensures the service restarts automatically if it exits with a non-zero exit code or is terminated by a signal, and `WantedBy=multi-user.target` creates a dependency that starts the service at boot, including after a system crash. This satisfies both requirements: automatic start after crash (via systemd's dependency-based boot) and restart on failure (via the Restart directive).

Answer

RemainAfterExit=yes

Answer

Restart=always

Answer

ExecStopPost=/bin/systemctl restart myapp.service

Question 2

A Linux system reports 'Out of memory' errors frequently. The administrator checks memory usage with 'free -m' and notices that most memory is used by file cache. Which command can the administrator run to immediately free up the cache without affecting running processes?

Accepted Answer

echo 1 > /proc/sys/vm/drop_caches. Option C is correct because writing 1 to /proc/sys/vm/drop_caches instructs the kernel to free pagecache (file cache) without terminating any processes. This is a safe, non-destructive operation that reclaims memory used for caching disk I/O, which is exactly what the administrator needs when 'free -m' shows most memory consumed by cache.

Answer

sysctl vm.drop_caches=1

Answer

swapoff -a

Answer

kill -9 $(pidof some_process)

Question 3

An administrator needs to schedule a cron job that runs a script every day at 3:00 AM, but the system is in a different time zone (UTC) than the administrator's local time (EST). The administrator wants the job to run at 3:00 AM local time regardless of system time zone changes. What is the best approach?

Accepted Answer

Use the CRON_TZ variable in the crontab file to specify EST and schedule at 3:00 AM. Option B is correct because the CRON_TZ variable, when set in a crontab file, allows you to specify a time zone for the cron daemon to interpret the schedule entries. This ensures the job runs at 3:00 AM EST regardless of the system's default time zone (UTC), and it persists even if the system time zone changes, as cron uses the variable for scheduling.

Answer

Change the system time zone to EST and set the cron job to run at 3:00 AM

Answer

Set the TZ environment variable in the crontab file before the job definition

Answer

Calculate the UTC equivalent (8:00 AM UTC) and schedule the job at that time

Question 4

Which TWO commands can be used to display the current runlevel or target of a systemd-based system?

Accepted Answer

systemctl get-default. Option A is correct because `systemctl get-default` directly queries the systemd default target, which is the equivalent of the traditional runlevel in a systemd-based system. This command outputs the target that will be activated at boot, such as `multi-user.target` or `graphical.target`.

Answer

telinit

Answer

init 3

Answer

systemctl list-units --type=target

Question 5

Which THREE steps are necessary to permanently disable a systemd service from starting at boot?

Accepted Answer

systemctl stop myapp.service. Option A is correct because `systemctl stop` immediately terminates the service process, which is necessary to ensure the service is not currently running before disabling it from future boots. While stopping alone does not prevent the service from starting at boot, it is a required step in the process of permanently disabling a service, as you must stop the current instance before disabling it to avoid an inconsistent state.

Answer

systemctl reset-failed myapp.service

Answer

systemctl daemon-reload

Question 6

A system administrator wants to view the last 10 lines of the system log file '/var/log/syslog' and continue to watch for new lines as they are appended. Which command should be used?

Accepted Answer

tail -n 10 -f /var/log/syslog. Option C is correct because the `tail -n 10 -f /var/log/syslog` command first displays the last 10 lines of the file and then uses the `-f` (follow) flag to continuously monitor the file for new appended lines, outputting them in real time. This matches the requirement to both view the last 10 lines and watch for new entries.

Answer

tail -n 10 /var/log/syslog

Answer

less /var/log/syslog

Answer

head -n 10 /var/log/syslog

Question 7

A systems administrator receives reports that a web server running Nginx is intermittently unresponsive. The server has 8 GB of RAM and 4 CPU cores. The administrator runs 'free -m' and sees that available memory is low, and 'top' shows that several nginx worker processes are using a high percentage of CPU. Which of the following is the most likely cause of the issue?

Accepted Answer

The nginx worker_connections setting is too high.. The correct answer is A. When `worker_connections` is set too high, each Nginx worker process attempts to handle more concurrent connections than the system can support, leading to CPU saturation and memory exhaustion. This matches the symptoms of high CPU usage by worker processes and low available memory, causing intermittent unresponsiveness.

Answer

The vm.swappiness value is set to 100.

Answer

The net.core.somaxconn setting is too low.

Answer

The kernel parameter kernel.pid_max is set too low.

Question 8

An administrator is troubleshooting a server that runs a critical application. The server has 16 GB of RAM and 8 CPU cores. The administrator notices that the server becomes very slow during peak hours. Analysis of 'iostat -x 1' shows that the average wait time (await) for the main disk (sda) is consistently above 1000 ms, while the average service time (svctm) is around 5 ms. What is the most likely cause?

Accepted Answer

There is a large queue of I/O requests waiting to be serviced.. The 'await' value in iostat represents the average time (in milliseconds) for I/O requests to be serviced, including time spent waiting in the queue. With 'await' at 1000+ ms and 'svctm' at only 5 ms, the vast majority of the time is spent waiting, not being serviced. This indicates a large queue of pending I/O requests, which is the direct cause of the slowdown.

Answer

The CPU is overloaded, causing processes to wait for CPU time.

Answer

The system is using swap space heavily, causing disk I/O.

Answer

The disk is experiencing hardware errors.

Question 9

A Linux server experiences a kernel panic during boot. The administrator needs to capture the kernel panic message for debugging. Which of the following methods would allow capturing the panic message?

Accepted Answer

Add 'panic=0' to the kernel boot parameters.. Option B is correct because setting 'panic=0' in the kernel boot parameters instructs the kernel to wait indefinitely (never reboot) after a kernel panic, allowing the administrator to capture the panic message from the console output. This is essential for debugging as it prevents automatic reboot and preserves the panic screen.

Answer

Add 'quiet' to the kernel boot parameters.

Answer

Configure netconsole to send kernel messages to a remote syslog server.

Answer

Set the kernel parameter 'console=ttyS0' to redirect output to a serial console.

Question 10

A systems administrator is troubleshooting a server that runs a database application. The server has 64 GB of RAM and 16 CPU cores. The administrator notices that the system is using a significant amount of swap space even though there is plenty of free memory. The 'free -m' command shows: total memory = 65536, used = 50000, free = 15536, buffers/cache = 10000, swap total = 8192, swap used = 6000. Which of the following is the most likely cause?

Accepted Answer

The vm.swappiness value is set too high.. Option B is correct because a high vm.swappiness value (default 60) causes the kernel to aggressively swap out anonymous pages even when ample free memory exists. With 15 GB free and 10 GB in buffers/cache, the system should not be using 6 GB of swap unless swappiness is set too high, forcing premature swapping.

Answer

The vm.dirty_ratio and vm.dirty_background_ratio are set too high.

Answer

The database is configured to use huge pages, which are not swappable.

Answer

The vm.vfs_cache_pressure is set too low.

Question 11

Which TWO of the following are correct statements about systemd journald configuration?

Accepted Answer

The 'MaxRetentionSec' directive sets the maximum time to retain journal entries.. Option A is correct because the 'MaxRetentionSec' directive in journald.conf specifies the maximum time (in seconds) that journal entries are retained before they are deleted. This is a time-based retention policy, distinct from size-based limits, and is used to automatically prune old log entries to manage disk usage.

Answer

The 'RuntimeMaxUse' directive applies to the journal stored in /var/log/journal.

Answer

The 'Compress' directive is set to 'no' by default.

Answer

The 'ForwardToSyslog' directive is set to 'yes' by default.

Question 12

You are a systems administrator for a company that runs a high-traffic web application on a Linux server with 32 GB of RAM and 8 CPU cores. The application uses Apache with mod_php and MySQL. Recently, the server has been experiencing intermittent slowdowns, especially during peak hours. Monitoring tools show that the CPU usage spikes to 100% for several minutes and then returns to normal. The 'top' command shows that the 'mysqld' process is often the top CPU consumer during these spikes. You notice that the MySQL slow query log contains many entries with long execution times. The database is heavily used by the web application for read-heavy workloads. After analyzing the situation, you suspect that the issue is related to MySQL configuration. Which of the following actions is most likely to resolve the performance issue?

Accepted Answer

Increase the MySQL query cache size (query_cache_size) to 256 MB.. Option C is correct because increasing the query cache size can significantly improve performance for read-heavy workloads with repeated identical queries, as it caches the result set of SELECT queries. The symptoms—CPU spikes from mysqld, many slow queries, and a read-heavy workload—indicate that the query cache is likely too small or disabled, causing MySQL to repeatedly execute expensive queries instead of serving cached results. A larger query cache reduces disk I/O and CPU usage for repeated queries, directly addressing the intermittent slowdowns.

Answer

Increase the maximum number of connections (max_connections) to 500.

Answer

Enable the MySQL slow query log and analyze the queries.

Answer

Increase the InnoDB buffer pool size to 20 GB.

Question 13

You are a systems administrator for a company that runs a web application on a Linux server with 16 GB of RAM and 4 CPU cores. The application uses Apache with mod_php and PostgreSQL. Recently, the server has been experiencing high load average (above 10) and the website is responding slowly. The 'top' command shows that many 'httpd' processes are in 'D' (uninterruptible sleep) state. The 'iostat -x 1' output shows high disk utilization (over 90%) and high average wait times (await > 200 ms) on the disk where PostgreSQL data is stored. The database is write-heavy, and you suspect that disk I/O is the bottleneck. Which of the following actions is most likely to improve the performance?

Accepted Answer

Increase the PostgreSQL shared_buffers setting to 4 GB.. The high disk utilization (over 90%) and high await times (>200 ms) on the PostgreSQL data disk indicate that the database is I/O-bound. Increasing PostgreSQL's shared_buffers to 4 GB (25% of 16 GB RAM) allows more data to be cached in memory, reducing the frequency of disk writes and reads for write-heavy workloads. This directly alleviates the disk I/O bottleneck, lowering the load average and the number of httpd processes in 'D' state.

Answer

Enable the PostgreSQL query cache by setting 'query_cache_type' to 'on'.

Answer

Increase the PostgreSQL max_connections setting to 200.

Answer

Decrease the Apache MaxClients setting to 50.

Question 14

A system administrator needs to check the current CPU load and memory usage on a Linux server. Which command should be used to display a dynamic, real-time view of running processes and system resource utilization?

Accepted Answer

top. Option B (top) is correct because it provides a dynamic, real-time view of running processes and system resource utilization, including CPU load, memory usage, and process details. It updates continuously by default, making it ideal for monitoring live system performance.

Answer

uptime

Answer

ps aux

Answer

free -h

Question 15

A Linux administrator is troubleshooting a service that is running as the 'nobody' user but keeps failing because it cannot write to its log file. The log file is located at /var/log/app.log. Which TWO of the following methods will allow the service to write to the log file while maintaining security best practices?

Accepted Answer

Add an ACL entry for user nobody with write permission using setfacl.. Option B is correct because using setfacl to add an ACL entry for the 'nobody' user grants write permission without altering the file's ownership or group, preserving the principle of least privilege. ACLs provide fine-grained access control beyond traditional Unix permissions, allowing the service to write while other users and processes retain their existing access restrictions.

Answer

Delete /var/log/app.log and restart the service.

Answer

Change the group of /var/log/app.log to nogroup and set group write permission.

Answer

Change the permissions of /var/log/app.log to 777.