LFCS Operation of Running Systems — 50 Questions

Question 1

A system administrator needs to ensure that a specific service, 'myapp', starts automatically after a system crash and also restarts if it fails. Which systemd unit directive should be used to achieve this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restart=on-failure and WantedBy=multi-user.target. The combination of `Restart=on-failure` ensures the service restarts automatically if it exits with a non-zero exit code or is terminated by a signal, and `WantedBy=multi-user.target` creates a dependency that starts the service at boot, including after a system crash. This satisfies both requirements: automatic start after crash (via systemd's dependency-based boot) and restart on failure (via the Restart directive).

Answer

RemainAfterExit=yes

Answer

Restart=always

Answer

ExecStopPost=/bin/systemctl restart myapp.service

Question 2

A Linux system reports 'Out of memory' errors frequently. The administrator checks memory usage with 'free -m' and notices that most memory is used by file cache. Which command can the administrator run to immediately free up the cache without affecting running processes?

Accepted Answer

sysctl vm.drop_caches=1. Both options A and C are correct methods to free pagecache (file cache) without terminating processes. Writing to /proc/sys/vm/drop_caches via echo or using the sysctl command achieve the same result. The administrator can use either command to immediately reclaim memory used by file cache. Option B disables swap but does not free cache, and option D kills a process unnecessarily.

Answer

swapoff -a

Answer

kill -9 $(pidof some_process)

Question 3

An administrator needs to schedule a cron job that runs a script every day at 3:00 AM, but the system is in a different time zone (UTC) than the administrator's local time (EST). The administrator wants the job to run at 3:00 AM local time regardless of system time zone changes. What is the best approach?

Accepted Answer

Use the CRON_TZ variable in the crontab file to specify EST and schedule at 3:00 AM. The CRON_TZ variable, when set in a crontab file, allows you to specify a time zone for the cron daemon to interpret the schedule entries. This ensures the job runs at 3:00 AM EST regardless of the system's default time zone (UTC), and it persists even if the system time zone changes, as cron uses the variable for scheduling.

Answer

Change the system time zone to EST and set the cron job to run at 3:00 AM

Answer

Set the TZ environment variable in the crontab file before the job definition

Answer

Calculate the UTC equivalent (8:00 AM UTC) and schedule the job at that time

Question 4

Which TWO commands can be used to display the current runlevel or target of a systemd-based system?

Accepted Answer

runlevel. The `runlevel` command displays the previous and current runlevel, which works on systemd-based systems by reading the last runlevel change. Option A (`systemctl get-default`) is incorrect because it shows the default target that will be used at boot, not the currently active runlevel or target. Options B and C change the runlevel, and option D lists all targets but does not isolate the current one without additional filtering. Therefore, only `runlevel` correctly displays the current runlevel or target.

Answer

systemctl get-default

Answer

telinit

Answer

init 3

Answer

systemctl list-units --type=target

Question 5

Which THREE steps are necessary to permanently disable a systemd service from starting at boot?

Accepted Answer

systemctl mask myapp.service. To permanently prevent a systemd service from starting at boot, two steps are necessary: disable it (`systemctl disable`) to remove the symbolic links that cause it to start on boot, and mask it (`systemctl mask`) to prevent manual or dependency-based activation. Stopping the service (`systemctl stop`) is optional and does not affect its boot behavior; it only stops the current running instance. Therefore, only disable and mask are required to permanently disable the service from booting.

Answer

systemctl stop myapp.service

Answer

systemctl reset-failed myapp.service

Answer

systemctl daemon-reload

Question 6

A systems administrator receives reports that a web server running Nginx is intermittently unresponsive. The server has 8 GB of RAM and 4 CPU cores. The administrator runs 'free -m' and sees that available memory is low, and 'top' shows that several nginx worker processes are using a high percentage of CPU. Which of the following is the most likely cause of the issue?

Accepted Answer

The nginx worker_connections setting is too high.. When `worker_connections` is set too high, each Nginx worker process attempts to handle more concurrent connections than the system can support, leading to CPU saturation and memory exhaustion. This matches the symptoms of high CPU usage by worker processes and low available memory, causing intermittent unresponsiveness.

Answer

The vm.swappiness value is set to 100.

Answer

The net.core.somaxconn setting is too low.

Answer

The kernel parameter kernel.pid_max is set too low.

Question 7

A Linux server experiences a kernel panic during boot. The administrator needs to capture the kernel panic message for debugging. Which of the following methods would allow capturing the panic message?

Accepted Answer

Add 'panic=0' to the kernel boot parameters.. Setting 'panic=0' in the kernel boot parameters instructs the kernel to wait indefinitely (never reboot) after a kernel panic, allowing the administrator to capture the panic message from the console output. This is essential for debugging as it prevents automatic reboot and preserves the panic screen.

Answer

Add 'quiet' to the kernel boot parameters.

Answer

Configure netconsole to send kernel messages to a remote syslog server.

Answer

Set the kernel parameter 'console=ttyS0' to redirect output to a serial console.

Question 8

You are a systems administrator for a company that runs a high-traffic web application on a Linux server with 32 GB of RAM and 8 CPU cores. The application uses Apache with mod_php and MySQL. Recently, the server has been experiencing intermittent slowdowns, especially during peak hours. Monitoring tools show that the CPU usage spikes to 100% for several minutes and then returns to normal. The 'top' command shows that the 'mysqld' process is often the top CPU consumer during these spikes. You notice that the MySQL slow query log contains many entries with long execution times. The database is heavily used by the web application for read-heavy workloads. After analyzing the situation, you suspect that the issue is related to MySQL configuration. Which of the following actions is most likely to resolve the performance issue?

Accepted Answer

Increase the MySQL query cache size (query_cache_size) to 256 MB.. Increasing the query cache size can significantly improve performance for read-heavy workloads with repeated identical queries, as it caches the result set of SELECT queries. The symptoms—CPU spikes from mysqld, many slow queries, and a read-heavy workload—indicate that the query cache is likely too small or disabled, causing MySQL to repeatedly execute expensive queries instead of serving cached results. A larger query cache reduces disk I/O and CPU usage for repeated queries, directly addressing the intermittent slowdowns.

Answer

Increase the maximum number of connections (max_connections) to 500.

Answer

Enable the MySQL slow query log and analyze the queries.

Answer

Increase the InnoDB buffer pool size to 20 GB.

Question 9

You are a systems administrator for a company that runs a web application on a Linux server with 16 GB of RAM and 4 CPU cores. The application uses Apache with mod_php and PostgreSQL. Recently, the server has been experiencing high load average (above 10) and the website is responding slowly. The 'top' command shows that many 'httpd' processes are in 'D' (uninterruptible sleep) state. The 'iostat -x 1' output shows high disk utilization (over 90%) and high average wait times (await > 200 ms) on the disk where PostgreSQL data is stored. The database is write-heavy, and you suspect that disk I/O is the bottleneck. Which of the following actions is most likely to improve the performance?

Accepted Answer

Increase the PostgreSQL shared_buffers setting to 4 GB.. The high disk utilization (over 90%) and high await times (>200 ms) on the PostgreSQL data disk indicate that the database is I/O-bound. Increasing PostgreSQL's shared_buffers to 4 GB (25% of 16 GB RAM) allows more data to be cached in memory, reducing the frequency of disk writes and reads for write-heavy workloads. This directly alleviates the disk I/O bottleneck, lowering the load average and the number of httpd processes in 'D' state.

Answer

Enable the PostgreSQL query cache by setting 'query_cache_type' to 'on'.

Answer

Increase the PostgreSQL max_connections setting to 200.

Answer

Decrease the Apache MaxClients setting to 50.

Question 10

A Linux administrator is troubleshooting a service that is running as the 'nobody' user but keeps failing because it cannot write to its log file. The log file is located at /var/log/app.log. Which TWO of the following methods will allow the service to write to the log file while maintaining security best practices?

Accepted Answer

Add an ACL entry for user nobody with write permission using setfacl.. Using setfacl to add an ACL entry for the 'nobody' user grants write permission without altering the file's ownership or group, preserving the principle of least privilege. ACLs provide fine-grained access control beyond traditional Unix permissions, allowing the service to write while other users and processes retain their existing access restrictions.

Answer

Delete /var/log/app.log and restart the service.

Answer

Change the group of /var/log/app.log to nogroup and set group write permission.

Answer

Change the permissions of /var/log/app.log to 777.

Question 11

Match each Linux networking command to its primary function.

Accepted Answer

ping: Tests reachability of a host on an IP network. The correct matches are: ping - test reachability, netstat - display network connections, traceroute - trace routes, ifconfig - configure interfaces. Common confusions involve swapping ping with traceroute and netstat with ping.

Answer

ping: Traces the route packets take to a network host

Answer

netstat: Tests reachability of a host on an IP network

Question 12

A developer reports that a web application is running out of file descriptors. Which sysctl parameter should be reviewed and potentially increased?

Accepted Answer

fs.file-max. The `fs.file-max` sysctl parameter defines the system-wide limit on the number of open file descriptors that the kernel can allocate. When a web application runs out of file descriptors, it is typically because this global limit has been reached, and increasing it allows more concurrent open files, sockets, and other descriptors. This directly resolves the reported exhaustion.

Answer

fs.nr_open

Answer

kernel.max_files

Answer

net.ipv4.tcp_max_syn_backlog

Question 13

A service is using a port that conflicts with another application. Which command can be used to identify which process is listening on a specific TCP port?

Accepted Answer

All of the above. All three commands—ss, lsof, and netstat—can be used to identify which process is listening on a specific TCP port. The ss command is the modern replacement for netstat and uses kernel netlink to display socket information, while lsof lists open files including network sockets, and netstat reads /proc/net files. Each command with the appropriate flags (ss -tulpn, lsof -i :port, netstat -tulpn) will show the PID and process name associated with a listening port, making 'All of the above' the accurate answer.

Answer

ss -tulpn | grep :port

Answer

lsof -i :port

Answer

netstat -tulpn | grep :port

Question 14

A server with multiple network interfaces has intermittent connectivity issues. The administrator suspects routing table misconfiguration. Which command would show the current routing table?

Accepted Answer

All of the above. All three commands—`ip route show`, `netstat -r`, and `route -n`—display the kernel's IPv4 routing table on a Linux system. `ip route show` is the modern iproute2 tool, `netstat -r` reads from /proc/net/route, and `route -n` shows the table in numeric format. Since each command provides the same core routing information, any of them would allow the administrator to diagnose the routing table misconfiguration.

Answer

ip route show

Answer

netstat -r

Answer

route -n

Question 15

Which TWO of the following are valid methods to check the status of a systemd service named 'httpd'? (Select TWO.)

Accepted Answer

systemctl status httpd. Option D (systemctl status httpd) is correct because systemctl is the native command-line utility for controlling and inspecting systemd units, and 'status' displays the unit's active state, loaded state, and recent log lines for the httpd.service unit. Option E (service httpd status) is correct because the service wrapper script translates the request into the appropriate systemd action (effectively invoking systemctl status httpd) when the system is running systemd, making it a valid way to check the service status. Option A (initctl status httpd) is wrong because initctl is the control tool for Upstart, not systemd, so it cannot query systemd units. Option B (systemd-analyze status httpd) is wrong because systemd-analyze is used for analyzing boot performance and unit dependencies (e.g., 'systemd-analyze blame' or 'critical-chain'), and it has no 'status' subcommand for querying a service. Option C (/etc/init.d/httpd status) is wrong because that path belongs to legacy SysV init scripts, which are not the native mechanism for managing systemd units, even if a compatibility wrapper sometimes exists.

Answer

initctl status httpd

Answer

systemd-analyze status httpd

Answer

/etc/init.d/httpd status

Question 16

Which TWO of the following commands can be used to display the current kernel ring buffer messages? (Select TWO.)

Accepted Answer

journalctl -k. A is correct because `journalctl -k` queries the systemd journal for kernel messages only, displaying the current kernel ring buffer content. This is the modern way to access kernel logs on systems using systemd, equivalent to `dmesg` but with structured journal output.

Answer

syslog -k

Answer

cat /proc/kmsg

Answer

tail /var/log/messages

Question 17

Which THREE of the following are valid options for the `lsblk` command to display more detailed information about block devices? (Select THREE.)

Accepted Answer

-o. Option B (-o) is correct because the --output option lets you specify exactly which columns lsblk displays (e.g., lsblk -o NAME,SIZE,TYPE,MOUNTPOINT), giving more detailed, tailored information about each block device. Option C (-f) is correct because it adds filesystem-related columns such as FSTYPE, LABEL, UUID, and MOUNTPOINT, which is precisely the extra detail lsblk can show about block devices. Option E (-m) is correct because it displays permissions and ownership information (the MODE, OWNER, GROUP columns) for the device nodes, another valid way to enrich the output. Option A (-c) is not a valid lsblk detail option; it is used by other tools (and in lsblk the ASCII/raw formatting is controlled by -r or --list), so it does not add device detail. Option D (-g) is not a valid lsblk option for detailed output; it is not defined for this purpose in lsblk.

Answer

-c

Answer

-g

Question 18

Refer to the exhibit. What is the most likely issue with the Apache web server?

Accepted Answer

The DocumentRoot directory does not exist.. The most likely issue is that the DocumentRoot directory does not exist. When Apache starts, it checks for the existence of the directory specified by the DocumentRoot directive (e.g., /var/www/html). If this directory is missing, Apache will fail to serve content and may log an error like 'Primary script unknown' or 'Directory index forbidden', even though the service itself is running and enabled. This is a common misconfiguration after moving or deleting the web root.

Answer

The service is not enabled.

Answer

The main PID is incorrect.

Answer

The service is not running.

Question 19

Refer to the exhibit. Which filesystem is close to full capacity?

Accepted Answer

/dev/sdb1. The `df -h` output (not shown) indicates that /dev/sdb1 is at 90% capacity, while /dev/sda1 is at 75%. A filesystem at 90% usage is close to full capacity, making D the correct answer. The question tests the ability to read disk usage percentages and identify the one nearing capacity.

Answer

Both are at 75% or less

Answer

/dev/sda1

Answer

Neither

Question 20

A Linux server experiences intermittent high load averages but low CPU utilization. The administrator suspects an I/O bottleneck. Which command best identifies the specific device causing the bottleneck?

Accepted Answer

iostat -x 1. `iostat -x 1` provides extended device statistics, including `%util`, `await`, and `svctm`, which directly indicate the specific block device causing an I/O bottleneck. The `-x` flag reports per-device metrics like average I/O queue size and service time, making it the precise tool to identify a slow or overloaded disk under high load with low CPU usage.

Answer

sar -d 1

Answer

vmstat 1

Answer

top -d 1