LFCS Operation of Running Systems — 40 Questions

Question 1

Which TWO commands can be used to display the current runlevel or target of a systemd-based system?

Accepted Answer

runlevel. The `runlevel` command displays the previous and current runlevel, which works on systemd-based systems by reading the last runlevel change. Option A (`systemctl get-default`) is incorrect because it shows the default target that will be used at boot, not the currently active runlevel or target. Options B and C change the runlevel, and option D lists all targets but does not isolate the current one without additional filtering. Therefore, only `runlevel` correctly displays the current runlevel or target.

Answer

systemctl get-default

Answer

telinit

Answer

init 3

Answer

systemctl list-units --type=target

Question 2

Which TWO commands can be used to display the current block devices and their partitions?

Accepted Answer

lsblk. B is correct because `lsblk` lists all block devices and their partitions in a tree-like format from sysfs. C is correct because `parted -l` displays partition tables for all block devices, including MBR and GPT layouts. D is correct because `fdisk -l` also shows partition tables. All three commands can be used to display current block devices and their partitions.

Answer

df -h

Answer

blkid

Question 3

A system administrator needs to ensure that a specific service, 'myapp', starts automatically after a system crash and also restarts if it fails. Which systemd unit directive should be used to achieve this behavior?

Accepted Answer

Restart=on-failure and WantedBy=multi-user.target. The combination of `Restart=on-failure` ensures the service restarts automatically if it exits with a non-zero exit code or is terminated by a signal, and `WantedBy=multi-user.target` creates a dependency that starts the service at boot, including after a system crash. This satisfies both requirements: automatic start after crash (via systemd's dependency-based boot) and restart on failure (via the Restart directive).

Answer

RemainAfterExit=yes

Answer

Restart=always

Answer

ExecStopPost=/bin/systemctl restart myapp.service

Question 4

A Linux system reports 'Out of memory' errors frequently. The administrator checks memory usage with 'free -m' and notices that most memory is used by file cache. Which command can the administrator run to immediately free up the cache without affecting running processes?

Accepted Answer

sysctl vm.drop_caches=1. Both options A and C are correct methods to free pagecache (file cache) without terminating processes. Writing to /proc/sys/vm/drop_caches via echo or using the sysctl command achieve the same result. The administrator can use either command to immediately reclaim memory used by file cache. Option B disables swap but does not free cache, and option D kills a process unnecessarily.

Answer

swapoff -a

Answer

kill -9 $(pidof some_process)

Question 5

An administrator needs to schedule a cron job that runs a script every day at 3:00 AM, but the system is in a different time zone (UTC) than the administrator's local time (EST). The administrator wants the job to run at 3:00 AM local time regardless of system time zone changes. What is the best approach?

Accepted Answer

Use the CRON_TZ variable in the crontab file to specify EST and schedule at 3:00 AM. The CRON_TZ variable, when set in a crontab file, allows you to specify a time zone for the cron daemon to interpret the schedule entries. This ensures the job runs at 3:00 AM EST regardless of the system's default time zone (UTC), and it persists even if the system time zone changes, as cron uses the variable for scheduling.

Answer

Change the system time zone to EST and set the cron job to run at 3:00 AM

Answer

Set the TZ environment variable in the crontab file before the job definition

Answer

Calculate the UTC equivalent (8:00 AM UTC) and schedule the job at that time

Question 6

Which THREE steps are necessary to permanently disable a systemd service from starting at boot?

Accepted Answer

systemctl mask myapp.service. To permanently prevent a systemd service from starting at boot, two steps are necessary: disable it (`systemctl disable`) to remove the symbolic links that cause it to start on boot, and mask it (`systemctl mask`) to prevent manual or dependency-based activation. Stopping the service (`systemctl stop`) is optional and does not affect its boot behavior; it only stops the current running instance. Therefore, only disable and mask are required to permanently disable the service from booting.

Answer

systemctl stop myapp.service

Answer

systemctl reset-failed myapp.service

Answer

systemctl daemon-reload

Question 7

A system administrator wants to view the last 10 lines of the system log file '/var/log/syslog' and continue to watch for new lines as they are appended. Which command should be used?

Accepted Answer

tail -n 10 -f /var/log/syslog. The `tail -n 10 -f /var/log/syslog` command first displays the last 10 lines of the file and then uses the `-f` (follow) flag to continuously monitor the file for new appended lines, outputting them in real time. This matches the requirement to both view the last 10 lines and watch for new entries.

Answer

tail -n 10 /var/log/syslog

Answer

less /var/log/syslog

Answer

head -n 10 /var/log/syslog

Question 8

A systems administrator receives reports that a web server running Nginx is intermittently unresponsive. The server has 8 GB of RAM and 4 CPU cores. The administrator runs 'free -m' and sees that available memory is low, and 'top' shows that several nginx worker processes are using a high percentage of CPU. Which of the following is the most likely cause of the issue?

Accepted Answer

The nginx worker_connections setting is too high.. When `worker_connections` is set too high, each Nginx worker process attempts to handle more concurrent connections than the system can support, leading to CPU saturation and memory exhaustion. This matches the symptoms of high CPU usage by worker processes and low available memory, causing intermittent unresponsiveness.

Answer

The vm.swappiness value is set to 100.

Answer

The net.core.somaxconn setting is too low.

Answer

The kernel parameter kernel.pid_max is set too low.

Question 9

An administrator is troubleshooting a server that runs a critical application. The server has 16 GB of RAM and 8 CPU cores. The administrator notices that the server becomes very slow during peak hours. Analysis of 'iostat -x 1' shows that the average wait time (await) for the main disk (sda) is consistently above 1000 ms, while the average service time (svctm) is around 5 ms. What is the most likely cause?

Accepted Answer

There is a large queue of I/O requests waiting to be serviced.. The 'await' value in iostat represents the average time (in milliseconds) for I/O requests to be serviced, including time spent waiting in the queue. With 'await' at 1000+ ms and 'svctm' at only 5 ms, the vast majority of the time is spent waiting, not being serviced. This indicates a large queue of pending I/O requests, which is the direct cause of the slowdown.

Answer

The CPU is overloaded, causing processes to wait for CPU time.

Answer

The system is using swap space heavily, causing disk I/O.

Answer

The disk is experiencing hardware errors.

Question 10

A Linux server experiences a kernel panic during boot. The administrator needs to capture the kernel panic message for debugging. Which of the following methods would allow capturing the panic message?

Accepted Answer

Add 'panic=0' to the kernel boot parameters.. Setting 'panic=0' in the kernel boot parameters instructs the kernel to wait indefinitely (never reboot) after a kernel panic, allowing the administrator to capture the panic message from the console output. This is essential for debugging as it prevents automatic reboot and preserves the panic screen.

Answer

Add 'quiet' to the kernel boot parameters.

Answer

Configure netconsole to send kernel messages to a remote syslog server.

Answer

Set the kernel parameter 'console=ttyS0' to redirect output to a serial console.

Question 11

A systems administrator is troubleshooting a server that runs a database application. The server has 64 GB of RAM and 16 CPU cores. The administrator notices that the system is using a significant amount of swap space even though there is plenty of free memory. The 'free -m' command shows: total memory = 65536, used = 50000, free = 15536, buffers/cache = 10000, swap total = 8192, swap used = 6000. Which of the following is the most likely cause?

Accepted Answer

The vm.swappiness value is set too high.. A high vm.swappiness value (default 60) causes the kernel to aggressively swap out anonymous pages even when ample free memory exists. With 15 GB free and 10 GB in buffers/cache, the system should not be using 6 GB of swap unless swappiness is set too high, forcing premature swapping.

Answer

The vm.dirty_ratio and vm.dirty_background_ratio are set too high.

Answer

The database is configured to use huge pages, which are not swappable.

Answer

The vm.vfs_cache_pressure is set too low.

Question 12

Which TWO of the following are correct statements about systemd journald configuration?

Accepted Answer

The 'MaxRetentionSec' directive sets the maximum time to retain journal entries.. The 'MaxRetentionSec' directive in journald.conf specifies the maximum time (in seconds) that journal entries are retained before they are deleted. This is a time-based retention policy, distinct from size-based limits, and is used to automatically prune old log entries to manage disk usage.

Answer

The 'RuntimeMaxUse' directive applies to the journal stored in /var/log/journal.

Answer

The 'Compress' directive is set to 'no' by default.

Answer

The 'ForwardToSyslog' directive is set to 'yes' by default.

Question 13

You are a systems administrator for a company that runs a high-traffic web application on a Linux server with 32 GB of RAM and 8 CPU cores. The application uses Apache with mod_php and MySQL. Recently, the server has been experiencing intermittent slowdowns, especially during peak hours. Monitoring tools show that the CPU usage spikes to 100% for several minutes and then returns to normal. The 'top' command shows that the 'mysqld' process is often the top CPU consumer during these spikes. You notice that the MySQL slow query log contains many entries with long execution times. The database is heavily used by the web application for read-heavy workloads. After analyzing the situation, you suspect that the issue is related to MySQL configuration. Which of the following actions is most likely to resolve the performance issue?

Accepted Answer

Increase the MySQL query cache size (query_cache_size) to 256 MB.. Increasing the query cache size can significantly improve performance for read-heavy workloads with repeated identical queries, as it caches the result set of SELECT queries. The symptoms—CPU spikes from mysqld, many slow queries, and a read-heavy workload—indicate that the query cache is likely too small or disabled, causing MySQL to repeatedly execute expensive queries instead of serving cached results. A larger query cache reduces disk I/O and CPU usage for repeated queries, directly addressing the intermittent slowdowns.

Answer

Increase the maximum number of connections (max_connections) to 500.

Answer

Enable the MySQL slow query log and analyze the queries.

Answer

Increase the InnoDB buffer pool size to 20 GB.

Question 14

You are a systems administrator for a company that runs a web application on a Linux server with 16 GB of RAM and 4 CPU cores. The application uses Apache with mod_php and PostgreSQL. Recently, the server has been experiencing high load average (above 10) and the website is responding slowly. The 'top' command shows that many 'httpd' processes are in 'D' (uninterruptible sleep) state. The 'iostat -x 1' output shows high disk utilization (over 90%) and high average wait times (await > 200 ms) on the disk where PostgreSQL data is stored. The database is write-heavy, and you suspect that disk I/O is the bottleneck. Which of the following actions is most likely to improve the performance?

Accepted Answer

Increase the PostgreSQL shared_buffers setting to 4 GB.. The high disk utilization (over 90%) and high await times (>200 ms) on the PostgreSQL data disk indicate that the database is I/O-bound. Increasing PostgreSQL's shared_buffers to 4 GB (25% of 16 GB RAM) allows more data to be cached in memory, reducing the frequency of disk writes and reads for write-heavy workloads. This directly alleviates the disk I/O bottleneck, lowering the load average and the number of httpd processes in 'D' state.

Answer

Enable the PostgreSQL query cache by setting 'query_cache_type' to 'on'.

Answer

Increase the PostgreSQL max_connections setting to 200.

Answer

Decrease the Apache MaxClients setting to 50.

Question 15

A system administrator needs to check the current CPU load and memory usage on a Linux server. Which command should be used to display a dynamic, real-time view of running processes and system resource utilization?

Accepted Answer

top. (top) is correct because it provides a dynamic, real-time view of running processes and system resource utilization, including CPU load, memory usage, and process details. It updates continuously by default, making it ideal for monitoring live system performance.

Answer

uptime

Answer

ps aux

Answer

free -h

Question 16

A Linux administrator is troubleshooting a service that is running as the 'nobody' user but keeps failing because it cannot write to its log file. The log file is located at /var/log/app.log. Which TWO of the following methods will allow the service to write to the log file while maintaining security best practices?

Accepted Answer

Add an ACL entry for user nobody with write permission using setfacl.. Using setfacl to add an ACL entry for the 'nobody' user grants write permission without altering the file's ownership or group, preserving the principle of least privilege. ACLs provide fine-grained access control beyond traditional Unix permissions, allowing the service to write while other users and processes retain their existing access restrictions.

Answer

Delete /var/log/app.log and restart the service.

Answer

Change the group of /var/log/app.log to nogroup and set group write permission.

Answer

Change the permissions of /var/log/app.log to 777.

Question 17

Based on the journalctl output, what is the most likely cause of the service failure?

Accepted Answer

Another process is already using port 8080.. The journalctl output shows a bind error on port 8080 with 'Address already in use'. This indicates that another process is already listening on that port, preventing the service from starting. In systemd, such a failure is logged with the specific errno EADDRINUSE, which directly points to a port conflict.

Answer

The service configuration file has a syntax error.

Answer

The system is out of memory.

Answer

The service is trying to write to a read-only filesystem.

Question 18

Order the steps to set up a LVM logical volume from a new disk.

Accepted Answer

Create physical volume (pvcreate), then volume group (vgcreate), then logical volume (lvcreate), then format with filesystem (mkfs), then mount.. The correct sequence for setting up an LVM logical volume from a new disk is: first create a physical volume (PV) using pvcreate, then create a volume group (VG) with vgcreate, then create a logical volume (LV) with lvcreate, then format the LV with a filesystem using mkfs, and finally mount it to a directory. This order ensures all dependencies are satisfied: the VG requires the PV, the LV requires the VG, and the filesystem requires the LV.

Answer

Create volume group (vgcreate), then physical volume (pvcreate), then logical volume (lvcreate), then format, then mount.

Answer

Create physical volume (pvcreate), then format (mkfs), then volume group (vgcreate), then logical volume (lvcreate), then mount.

Answer

Create logical volume (lvcreate), then physical volume (pvcreate), then volume group (vgcreate), then format, then mount.

Question 19

Order the steps to recover a forgotten root password on a Linux system using single-user mode.

Accepted Answer

1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Change root password, 4. Reboot.. To recover a forgotten root password on Linux using single-user mode, you must first boot into single-user mode (e.g., by adding 'single' to the kernel command line). At the root prompt, the filesystem is mounted read-only, so you must remount it as read-write with 'mount -o remount,rw /'. Then use 'passwd root' to set a new password. Finally, reboot the system. Attempting to change the password without remounting or rebooting prematurely will cause the recovery to fail.

Answer

1. Boot into single-user mode, 2. Change root password, 3. Remount filesystem as read-write, 4. Reboot.

Answer

1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Reboot, 4. Change root password.

Answer

1. Change root password, 2. Boot into single-user mode, 3. Remount filesystem as read-write, 4. Reboot.

Question 20

Match each file system type to its typical use case.

Accepted Answer

ext4: General-purpose file system for Linux distributions, widely used on desktops and servers.. Common file systems in Linux include ext4 for general use, XFS for high-performance and large files, and Btrfs for advanced features like snapshots. Swapping definitions is a common error.

Answer

ext4: High-performance file system suitable for large files and parallel I/O, often used in enterprise storage.

Answer

XFS: Modern file system with snapshot and compression capabilities, designed for scalability and fault tolerance.