LFCS Operation of Running Systems Practice Test 2 — 15 Questions

Question 1

Which TWO of the following commands can be used to display the current kernel ring buffer messages? (Select TWO.)

Accepted Answer

journalctl -k. A is correct because `journalctl -k` queries the systemd journal for kernel messages only, displaying the current kernel ring buffer content. This is the modern way to access kernel logs on systems using systemd, equivalent to `dmesg` but with structured journal output.

Answer

syslog -k

Answer

cat /proc/kmsg

Answer

tail /var/log/messages

Question 2

Which THREE of the following are valid options for the `lsblk` command to display more detailed information about block devices? (Select THREE.)

Accepted Answer

-o. Option B (-o) is correct because the --output option lets you specify exactly which columns lsblk displays (e.g., lsblk -o NAME,SIZE,TYPE,MOUNTPOINT), giving more detailed, tailored information about each block device. Option C (-f) is correct because it adds filesystem-related columns such as FSTYPE, LABEL, UUID, and MOUNTPOINT, which is precisely the extra detail lsblk can show about block devices. Option E (-m) is correct because it displays permissions and ownership information (the MODE, OWNER, GROUP columns) for the device nodes, another valid way to enrich the output. Option A (-c) is not a valid lsblk detail option; it is used by other tools (and in lsblk the ASCII/raw formatting is controlled by -r or --list), so it does not add device detail. Option D (-g) is not a valid lsblk option for detailed output; it is not defined for this purpose in lsblk.

Answer

-c

Answer

-g

Question 3

Refer to the exhibit. What is the most likely issue with the Apache web server?

Accepted Answer

The DocumentRoot directory does not exist.. The most likely issue is that the DocumentRoot directory does not exist. When Apache starts, it checks for the existence of the directory specified by the DocumentRoot directive (e.g., /var/www/html). If this directory is missing, Apache will fail to serve content and may log an error like 'Primary script unknown' or 'Directory index forbidden', even though the service itself is running and enabled. This is a common misconfiguration after moving or deleting the web root.

Answer

The service is not enabled.

Answer

The main PID is incorrect.

Answer

The service is not running.

Question 4

Refer to the exhibit. Which filesystem is close to full capacity?

Accepted Answer

/dev/sdb1. The `df -h` output (not shown) indicates that /dev/sdb1 is at 90% capacity, while /dev/sda1 is at 75%. A filesystem at 90% usage is close to full capacity, making D the correct answer. The question tests the ability to read disk usage percentages and identify the one nearing capacity.

Answer

Both are at 75% or less

Answer

/dev/sda1

Answer

Neither

Question 5

A Linux server experiences intermittent high load averages but low CPU utilization. The administrator suspects an I/O bottleneck. Which command best identifies the specific device causing the bottleneck?

Accepted Answer

iostat -x 1. `iostat -x 1` provides extended device statistics, including `%util`, `await`, and `svctm`, which directly indicate the specific block device causing an I/O bottleneck. The `-x` flag reports per-device metrics like average I/O queue size and service time, making it the precise tool to identify a slow or overloaded disk under high load with low CPU usage.

Answer

sar -d 1

Answer

vmstat 1

Answer

top -d 1

Question 6

A cron job runs a script that outputs to stdout. The administrator wants to capture both stdout and stderr to a file named job.log, while also seeing output on the terminal. Which command achieves this?

Accepted Answer

./script 2>&1 | tee job.log. It uses `2>&1` to redirect stderr to stdout, then pipes the combined stream to `tee job.log`, which writes to the file and also displays output on the terminal. This ensures both stdout and stderr are captured in `job.log` and visible on the screen.

Answer

script 2>&1 | tee job.log

Answer

./script | tee job.log 2>&1

Answer

./script > job.log 2>&1

Question 7

An engineer wants to list all processes currently running under user 'appuser'. Which command is appropriate?

Accepted Answer

ps -u appuser. The `ps -u appuser` command lists all processes owned by the user 'appuser' by filtering the process table based on the user's UID. The `-u` option selects processes whose effective user ID or name matches the given argument, making it the most straightforward and standard way to display processes for a specific user.

Answer

pgrep -u appuser

Answer

top -u appuser

Answer

ps aux | grep appuser

Question 8

A system administrator needs to monitor real-time network traffic on a specific interface (eth0). Which TWO tools can be used for packet-level analysis?

Accepted Answer

tshark -i eth0. Option A, tshark -i eth0, is correct because tshark is the command-line version of Wireshark that captures and decodes packets on the specified interface eth0, providing packet-level analysis. Option B, tcpdump -i eth0, is correct because tcpdump is a classic packet capture tool that reads raw packets on interface eth0 and can display them with protocol-level detail. Option C, iftop, is not correct because it only shows a summary of bandwidth usage per connection and does not perform packet-level analysis. Option D, wireshark, is not correct because although it is a packet analyzer, the question asks for tools that can be used with the specific interface syntax shown, and Wireshark is primarily GUI-based and not invoked as 'wireshark' with -i in the same command-line manner as tshark. Option E, netstat -i, is not correct because it only displays interface statistics and routing information, not individual packet contents.

Answer

iftop

Answer

wireshark

Answer

netstat -i

Question 9

Which THREE commands can show the current system time and date?

Accepted Answer

timedatectl. Option B, timedatectl, is correct because on systemd-based Linux distributions it displays the system clock, date, time zone, and NTP synchronization status in a single output. Option C, date, is correct because it prints the current system date and time (and can also set it), making it the classic command for reading the clock. Option E, hwclock, is correct because it reads (and can set) the hardware/CMOS real-time clock, showing the current time maintained by the RTC. Option A, time, is not correct because it is a shell keyword that measures how long a command takes to execute, not the current date/time. Option D, ntpdate, is not correct because it is a deprecated utility that sets the system clock from an NTP server rather than simply displaying the current time and date.

Answer

time

Answer

ntpdate

Question 10

Based on the exhibit, what happens if the service 'myapp' crashes?

Accepted Answer

systemd will automatically restart it after 5 seconds. The systemd service unit for 'myapp' includes the directive `Restart=always` combined with `RestartSec=5`. When the service process crashes or exits, systemd detects the termination and automatically schedules a restart after the specified 5-second delay. The `Restart=always` directive ensures that the service is restarted regardless of the exit status, guaranteeing high availability. This behavior is defined in the service unit file and is a core feature of systemd's service management.

Answer

The service is disabled and will not start at boot

Answer

The service remains stopped until manually started

Answer

An alert is sent to the system administrator

Question 11

To display the current runlevel on a system using SysV init, which command should be used?

Accepted Answer

runlevel. The `runlevel` command is the standard tool for displaying the current runlevel on a system using SysV init. It outputs the previous and current runlevels, with 'N' indicating no previous runlevel. This command directly queries the SysV init process (PID 1) to retrieve the runlevel state.

Answer

who -r

Answer

systemctl get-default

Answer

init 3

Question 12

An administrator wants to schedule a one-time task to run at 2:30 PM next Friday. Which command should be used?

Accepted Answer

at 14:30 next Friday. The `at` command is specifically designed for scheduling one-time tasks at a specified time and date. The syntax `at 14:30 next Friday` correctly uses 24-hour time and the `next Friday` keyword, which the `atd` daemon interprets to run the job exactly once at that moment.

Answer

crontab -e and add entry

Answer

systemd-run --on-calendar='Fri 14:30' /bin/bash -c 'command'

Answer

at 2:30 PM Fri

Question 13

A system administrator needs to find all files that are larger than 100MB in the /var directory. Which command accomplishes this?

Accepted Answer

find /var -size +100M -type f. The `find` command with `-size +100M` locates files larger than 100 megabytes, and `-type f` restricts results to regular files, avoiding directories or special files. The `+` prefix means 'greater than', and `M` denotes megabytes (1048576-byte blocks). This is the standard syntax for size-based file searches on Linux.

Answer

find /var -size +100M

Answer

find /var -size +100MB

Answer

ls -lh /var | grep '100M'

Question 14

A production web server is experiencing intermittent high load. The administrator suspects that a specific Apache module is causing memory leaks. Which approach is most effective for isolating the issue without restarting the server?

Accepted Answer

Use strace -p <PID> on the Apache process and analyze system calls for memory allocation patterns.. D is correct because strace attaches to a running Apache process and traces its system calls, including memory-related calls like mmap, brk, and malloc. By analyzing these calls over time, the administrator can identify abnormal memory allocation patterns indicative of a leak in a specific module, all without restarting the server.

Answer

Check the Apache error log for memory-related errors.

Answer

Disable all modules in httpd.conf and reload the configuration.

Answer

Use top to monitor the memory usage of httpd processes over time.

Question 15

To permanently mount an ext4 filesystem at /data with noatime option, which entry should be added to /etc/fstab?

Accepted Answer

/dev/sdb1 /data ext4 defaults,noatime 0 0. The /etc/fstab entry for a permanent mount requires the filesystem device, mount point, type, options, dump frequency, and fsck pass order. The 'defaults,noatime' option string includes 'defaults' (which implies rw, suid, dev, exec, auto, nouser, async) and then overrides the access time update behavior with 'noatime'. The dump field (5th column) is 0 to disable backups, and the fsck pass order (6th column) is 0 to skip filesystem checks at boot, which is appropriate for a non-root data partition.

Answer

/dev/sdb1 /data ext4 noatime 0 0

Answer

/dev/sdb1 /data ext4 defaults,noatime 1 0

Answer

/dev/sdb1 /data ext4 defaults,noatime 0 1