LFCS Operation of Running Systems Practice Test 2 — 15 Questions

Question 1

A Linux administrator is troubleshooting a service that is running as the 'nobody' user but keeps failing because it cannot write to its log file. The log file is located at /var/log/app.log. Which TWO of the following methods will allow the service to write to the log file while maintaining security best practices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an ACL entry for user nobody with write permission using setfacl.. Using setfacl to add an ACL entry for the 'nobody' user grants write permission without altering the file's ownership or group, preserving the principle of least privilege. ACLs provide fine-grained access control beyond traditional Unix permissions, allowing the service to write while other users and processes retain their existing access restrictions.

Answer

Delete /var/log/app.log and restart the service.

Answer

Change the group of /var/log/app.log to nogroup and set group write permission.

Answer

Change the permissions of /var/log/app.log to 777.

Question 2

Based on the journalctl output, what is the most likely cause of the service failure?

Accepted Answer

Another process is already using port 8080.. The journalctl output shows a bind error on port 8080 with 'Address already in use'. This indicates that another process is already listening on that port, preventing the service from starting. In systemd, such a failure is logged with the specific errno EADDRINUSE, which directly points to a port conflict.

Answer

The service configuration file has a syntax error.

Answer

The system is out of memory.

Answer

The service is trying to write to a read-only filesystem.

Question 3

Order the steps to set up a LVM logical volume from a new disk.

Accepted Answer

Create physical volume (pvcreate), then volume group (vgcreate), then logical volume (lvcreate), then format with filesystem (mkfs), then mount.. The correct sequence for setting up an LVM logical volume from a new disk is: first create a physical volume (PV) using pvcreate, then create a volume group (VG) with vgcreate, then create a logical volume (LV) with lvcreate, then format the LV with a filesystem using mkfs, and finally mount it to a directory. This order ensures all dependencies are satisfied: the VG requires the PV, the LV requires the VG, and the filesystem requires the LV.

Answer

Create volume group (vgcreate), then physical volume (pvcreate), then logical volume (lvcreate), then format, then mount.

Answer

Create physical volume (pvcreate), then format (mkfs), then volume group (vgcreate), then logical volume (lvcreate), then mount.

Answer

Create logical volume (lvcreate), then physical volume (pvcreate), then volume group (vgcreate), then format, then mount.

Question 4

Order the steps to recover a forgotten root password on a Linux system using single-user mode.

Accepted Answer

1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Change root password, 4. Reboot.. To recover a forgotten root password on Linux using single-user mode, you must first boot into single-user mode (e.g., by adding 'single' to the kernel command line). At the root prompt, the filesystem is mounted read-only, so you must remount it as read-write with 'mount -o remount,rw /'. Then use 'passwd root' to set a new password. Finally, reboot the system. Attempting to change the password without remounting or rebooting prematurely will cause the recovery to fail.

Answer

1. Boot into single-user mode, 2. Change root password, 3. Remount filesystem as read-write, 4. Reboot.

Answer

1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Reboot, 4. Change root password.

Answer

1. Change root password, 2. Boot into single-user mode, 3. Remount filesystem as read-write, 4. Reboot.

Question 5

Match each file system type to its typical use case.

Accepted Answer

ext4: General-purpose file system for Linux distributions, widely used on desktops and servers.. Common file systems in Linux include ext4 for general use, XFS for high-performance and large files, and Btrfs for advanced features like snapshots. Swapping definitions is a common error.

Answer

ext4: High-performance file system suitable for large files and parallel I/O, often used in enterprise storage.

Answer

XFS: Modern file system with snapshot and compression capabilities, designed for scalability and fault tolerance.

Question 6

Match each Linux networking command to its primary function.

Accepted Answer

ping: Tests reachability of a host on an IP network. The correct matches are: ping - test reachability, netstat - display network connections, traceroute - trace routes, ifconfig - configure interfaces. Common confusions involve swapping ping with traceroute and netstat with ping.

Answer

ping: Traces the route packets take to a network host

Answer

netstat: Tests reachability of a host on an IP network

Question 7

A system administrator notices that a process is consuming 100% CPU and is unresponsive. Which command should be used to immediately stop the process if the PID is 2345?

Accepted Answer

kill -9 2345. `kill -9 2345` sends the SIGKILL signal (signal 9) to process ID 2345, which immediately terminates the process without allowing it to clean up or ignore the signal. This is the appropriate action for an unresponsive process consuming 100% CPU, as SIGKILL cannot be caught or blocked by the process.

Answer

pkill -9 processname

Answer

systemctl stop processname

Answer

kill -15 2345

Question 8

A developer reports that a web application is running out of file descriptors. Which sysctl parameter should be reviewed and potentially increased?

Accepted Answer

fs.file-max. The `fs.file-max` sysctl parameter defines the system-wide limit on the number of open file descriptors that the kernel can allocate. When a web application runs out of file descriptors, it is typically because this global limit has been reached, and increasing it allows more concurrent open files, sockets, and other descriptors. This directly resolves the reported exhaustion.

Answer

fs.nr_open

Answer

kernel.max_files

Answer

net.ipv4.tcp_max_syn_backlog

Question 9

A system with systemd experiences a service that fails to start due to a 'Failed to start' error with status 203/EXEC. What is the most likely cause?

Accepted Answer

The service unit file has a missing or incorrect ExecStart command. Status 203/EXEC in systemd indicates that the service manager failed to execute the command specified in the service unit file. The most common cause is a missing or incorrect ExecStart directive, such as a typo in the binary path, a missing executable, or incorrect syntax. This error is specific to execution failures, not resource or dependency issues.

Answer

The system has run out of memory

Answer

The service is already running

Answer

The service requires a dependency that hasn't started

Question 10

A server is running out of disk space. Which command will show the disk usage of the root filesystem in a human-readable format?

Accepted Answer

df -h /. The `df -h /` command displays disk usage for the root filesystem (`/`) in a human-readable format (e.g., GB, MB) by using the `-h` flag. This is the standard tool for checking filesystem-level disk space, not directory-level usage.

Answer

ls -lh /

Answer

fdisk -l /

Answer

du -sh /

Question 11

A user reports that they cannot log in via SSH, but other users can. The administrator checks /var/log/auth.log and sees 'Failed password for invalid user'. What is the most likely cause?

Accepted Answer

The user does not exist on the system. The log message 'Failed password for invalid user' specifically indicates that the username presented during the SSH authentication attempt does not correspond to any account in the system's user database (e.g., /etc/passwd). This is distinct from a valid user failing authentication; the SSH server (sshd) rejects the session at the authentication stage because the user does not exist. Therefore, the most likely cause is that the user account does not exist on the system.

Answer

The user's SSH key is not authorized

Answer

The user account is locked

Answer

The user's password has expired

Question 12

A service is using a port that conflicts with another application. Which command can be used to identify which process is listening on a specific TCP port?

Accepted Answer

All of the above. All three commands—ss, lsof, and netstat—can be used to identify which process is listening on a specific TCP port. The ss command is the modern replacement for netstat and uses kernel netlink to display socket information, while lsof lists open files including network sockets, and netstat reads /proc/net files. Each command with the appropriate flags (ss -tulpn, lsof -i :port, netstat -tulpn) will show the PID and process name associated with a listening port, making 'All of the above' the accurate answer.

Answer

ss -tulpn | grep :port

Answer

lsof -i :port

Answer

netstat -tulpn | grep :port

Question 13

An administrator wants to ensure that a service starts automatically after a system crash. Which systemd command should be used?

Accepted Answer

systemctl enable service. The `systemctl enable service` command creates the necessary symlinks in the systemd unit configuration directories (e.g., `/etc/systemd/system/multi-user.target.wants/`) so that the service is automatically started at boot. This includes recovery after a system crash, because the crash triggers a reboot, and the enabled service will be started as part of the normal boot process.

Answer

systemctl daemon-reload

Answer

systemctl mask service

Answer

systemctl start service

Question 14

A server with multiple network interfaces has intermittent connectivity issues. The administrator suspects routing table misconfiguration. Which command would show the current routing table?

Accepted Answer

All of the above. All three commands—`ip route show`, `netstat -r`, and `route -n`—display the kernel's IPv4 routing table on a Linux system. `ip route show` is the modern iproute2 tool, `netstat -r` reads from /proc/net/route, and `route -n` shows the table in numeric format. Since each command provides the same core routing information, any of them would allow the administrator to diagnose the routing table misconfiguration.

Answer

ip route show

Answer

netstat -r

Answer

route -n

Question 15

A process is stuck in an uninterruptible sleep (D state) and cannot be killed. What is the most likely cause?

Accepted Answer

The process is waiting for I/O from a failing disk. A process in uninterruptible sleep (D state) is typically waiting for I/O from a block device, such as a disk. When a disk is failing or unresponsive, the kernel cannot complete the I/O request, and the process cannot be killed because doing so would risk data corruption or filesystem inconsistency. This state is a kernel-level wait that ignores signals, including SIGKILL.

Answer

The process has been stopped by a signal

Answer

The process is waiting for a network response

Answer

The process is waiting for CPU