LFCS Operation of Running Systems Practice Test 3 — 15 Questions

Question 1

A system has a RAID 5 array that is degraded. One of the three disks failed and was replaced. The administrator runs 'cat /proc/mdstat' and sees that the array is still degraded. Which command should be used to add the new disk (/dev/sdc1) to the array?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

mdadm /dev/md0 --add /dev/sdc1. A, B, and C are all valid syntaxes for adding a new disk to a RAID array with mdadm. The device path can appear before or after the `--add` option, and the `--manage` mode is optional but does not invalidate the command. Option D uses `--re-add`, which is intended for re-adding a disk that was previously part of the array; for a brand new replacement, `--add` is correct.

Answer

mdadm --re-add /dev/md0 /dev/sdc1

Question 2

An administrator notices that the system clock is drifting significantly. To synchronize time using NTP, which command should be used to immediately sync with a server?

Accepted Answer

chronyd -q. `chronyd -q` sends a single NTP query to synchronize the system clock immediately and then exits, which is ideal for one-shot synchronization. This command is part of the `chrony` suite, the default NTP implementation on modern RHEL/CentOS 8+ and Ubuntu 18.04+ systems, and it respects the NTP protocol (RFC 5905) for accurate time adjustment.

Answer

ntpdate -u pool.ntp.org

Answer

ntpd -g

Answer

timedatectl set-ntp true

Question 3

Which TWO commands can be used to display the current block devices and their partitions?

Accepted Answer

lsblk. lsblk (B) reads /sys/block and udev data to print a tree of block devices with their partitions, sizes, and mountpoints, which directly matches the requirement. parted -l (C) enumerates every block device and prints its partition table and partitions, so it also displays current block devices and their partitions. fdisk -l (D) likewise lists all detected disks and their partition tables and partitions, satisfying the same goal. df -h (A) only reports mounted filesystems and their space usage, not block devices or partitions, and blkid (E) only prints UUIDs, LABELs, and filesystem types for existing devices without showing the device/partition layout.

Answer

df -h

Answer

blkid

Question 4

Which THREE factors can cause a system to fail to boot after changing kernel boot parameters in GRUB?

Accepted Answer

A missing initrd file path.. Option C is correct because GRUB's initrd line must point to an existing initramfs image; if the path is wrong or the file is missing, the kernel loads but cannot mount the root filesystem and boot fails. Option D is correct because a misspelled kernel parameter (e.g., 'rhgb' typed as 'rhbg' or 'root=' mistyped) is passed verbatim to the kernel, which may ignore it or misinterpret it, preventing proper initialization. Option E is correct because the root= parameter commonly uses a UUID; if that UUID does not match any block device (typo or changed disk), the kernel cannot locate the root filesystem and panics. Option A is not a boot-time kernel-parameter issue since network configuration is handled later by userspace services, and Option B, while it could break GRUB, is a corruption of the GRUB config itself rather than a consequence of changing kernel boot parameters.

Answer

An incorrect network configuration.

Answer

A corrupted GRUB configuration file.

Question 5

Which TWO commands can be used to view logs for a specific systemd unit (e.g., sshd.service)?

Accepted Answer

journalctl -u sshd.service. Option D, journalctl -u sshd.service, is correct because journalctl is the native query tool for the systemd journal, and the -u (--unit) flag filters entries to the specified unit, here sshd.service. Option E, journalctl _SYSTEMD_UNIT=sshd.service, is also correct because it uses journalctl's field-based match syntax, where _SYSTEMD_UNIT is the trusted journal field that records the unit name, yielding the same unit-specific log view. The other options do not belong: A (tail -f /var/log/secure) follows a legacy text log file rather than querying a systemd unit and is distro-specific, C (cat /var/log/messages | grep sshd) greps a general syslog file with no unit awareness, and B (systemctl status sshd.service) shows only a short recent status/tail summary, not the unit's full log stream.

Answer

tail -f /var/log/secure

Answer

systemctl status sshd.service

Answer

cat /var/log/messages | grep sshd

Question 6

Refer to the exhibit. Based on the exhibit, which service is configured to accept connections only from the local machine?

Accepted Answer

SMTP. The exhibit shows that the SMTP service is bound to the loopback address 127.0.0.1 on port 25, which means it will only accept connections originating from the local machine. This is a common security practice to prevent external hosts from directly submitting mail to the local MTA.

Answer

NTP

Answer

HTTP

Answer

HTTPS

Answer

SSH

Question 7

Refer to the exhibit. How many days of logs are retained before deletion?

Accepted Answer

14. (14 days) because the exhibit shows a log rotation configuration using `logrotate` with a `rotate 14` directive, which retains 14 rotated log files before deletion. The `daily` or `weekly` frequency determines how often rotation occurs, but the `rotate` count directly specifies the number of archived logs kept, not the total time span.

Answer

7

Answer

365

Answer

30

Question 8

A junior admin runs 'systemctl restart httpd' but the httpd service fails to start. Which command should the admin use first to diagnose the problem?

Accepted Answer

systemctl status httpd. `systemctl status httpd` provides a concise summary of the service's current state, including whether it is active, the last log entries, and the exit code or failure reason. This is the first diagnostic step recommended by systemd documentation to quickly identify common issues like configuration errors, missing dependencies, or permission problems.

Answer

journalctl -u httpd

Answer

systemctl show httpd

Answer

systemctl list-units --type=service

Question 9

During boot, the system drops into a shell with message 'ERROR: No suitable file system found'. Filesystem corruption is suspected. Which sequence of actions should the admin take to attempt recovery?

Accepted Answer

Determine the root device, then run 'fsck -y /dev/sda1'.. When the system drops into an emergency shell with 'ERROR: No suitable file system found', the admin must first identify the root device (e.g., using `blkid` or `lsblk`) and then run `fsck -y /dev/sda1` to attempt automatic repair of the corrupted filesystem. The `-y` flag answers 'yes' to all prompts, which is appropriate in a recovery scenario where the goal is to get the system bootable. This approach is filesystem-agnostic and works for common Linux filesystems like ext4, XFS, or btrfs, though specific tools (e.g., `xfs_repair` for XFS) may be needed if `fsck` is not suitable.

Answer

Run xfs_repair -n /dev/sda.

Answer

Run e2fsck /dev/sda1 from the emergency shell.

Answer

Mount the root filesystem manually, then run fsck.

Question 10

Which THREE methods can be used to rescue a Linux system that fails to boot past GRUB? (Choose three.)

Accepted Answer

Append 'systemd.unit=emergency.target' to kernel command line.. Option A is correct because appending 'systemd.unit=emergency.target' to the kernel command line in GRUB instructs systemd to boot into the emergency target, which mounts the root filesystem read-only and starts a minimal shell for repair. Option B is correct because adding 'single' to the kernel command line tells systemd (via the sysvinit compatibility layer) to boot into single-user/rescue mode, giving a root shell with minimal services. Option C is correct because pressing 'e' at the GRUB menu lets you edit the boot entry, and adding 'init=/bin/bash' bypasses the init system entirely, dropping directly into a root bash shell on the root filesystem. Option D is not a valid GRUB rescue method as written because 'linux' is a GRUB command-line directive used at the GRUB prompt, not a menu action, and the syntax given is not how you edit an existing entry to boot. Option E is not a GRUB-level rescue method; booting a separate rescue image is a recovery technique but does not rescue the installed system through GRUB itself.

Answer

From GRUB menu, run 'linux /vmlinuz-... root=/dev/sda1 init=/bin/bash'.

Answer

Use the system rescue image by selecting 'Rescue' from boot media.

Question 11

A system administrator notices that logrotate did not rotate the /var/log/messages file on a CentOS 7 server despite having a configuration at /etc/logrotate.d/syslog. The admin runs 'logrotate -d /etc/logrotate.conf' and sees that the syslog file is excluded due to 'olddir' option, but the olddir does not exist. Additionally, the logrotate status file (/var/lib/logrotate/logrotate.status) shows that /var/log/messages was last rotated 30 days ago. The logrotate cron job is scheduled daily. What is the most likely reason the rotation fails?

Accepted Answer

The olddir specified in the config does not exist, causing logrotate to error out before rotation.. The `logrotate -d` (debug) output explicitly states the file is excluded due to the 'olddir' option, and the admin confirmed the olddir does not exist. When logrotate is configured with an 'olddir' directive, it attempts to move the rotated log file to that directory before performing the rotation. If the directory does not exist, logrotate fails with an error and aborts the rotation for that log file, leaving it unrotated. This is a common misconfiguration that prevents rotation even when all other conditions (e.g., age, size) are met.

Answer

The log file size has not exceeded the configured maxsize threshold.

Answer

The logrotate script does not have read permission on /var/log/messages.

Answer

The 'compress' option is missing, so logrotate skips the file.

Question 12

Which TWO commands can be used to check and repair an ext4 file system that is mounted as /data? (Choose two.)

Accepted Answer

e2fsck -fy /dev/sdb1. Option B, e2fsck -fy /dev/sdb1, is correct because e2fsck is the dedicated ext2/ext3/ext4 file system checker, and the -f flag forces a full check even if the filesystem appears clean while -y automatically answers yes to all repair prompts. Option D, fsck -f /dev/sdb1, is correct because fsck is the generic front-end that dispatches to the appropriate type-specific checker (e2fsck for ext4) and the -f flag forces the check to run regardless of the clean state. Option A, tune2fs /dev/sdb1, is wrong because tune2fs only adjusts tunable filesystem parameters such as mount counts or reserved blocks and does not check or repair filesystem structures. Option C, xfs_repair /dev/sdb1, is wrong because xfs_repair is for XFS filesystems, not ext4, and would fail or damage the ext4 metadata. Option E, resize2fs /dev/sdb1, is wrong because resize2fs only grows or shrinks an ext2/ext3/ext4 filesystem and performs no consistency checking or repair.

Answer

tune2fs /dev/sdb1

Answer

xfs_repair /dev/sdb1

Answer

resize2fs /dev/sdb1

Question 13

Based on the exhibit, what is the most likely cause of the nginx failure and the appropriate first step to resolve it?

Accepted Answer

Check which process is listening on port 80 with 'ss -tlnp' and stop that process.. The most likely cause of an nginx failure to start is that another process is already bound to port 80, which nginx needs. The correct first diagnostic step is to identify what is listening on port 80 using 'ss -tlnp' (or netstat) and then stop that conflicting process. Restarting nginx without addressing the port conflict will simply fail again.

Answer

Restart the nginx service.

Answer

Increase the worker_connections in nginx.conf.

Answer

Reduce the MaxClients parameter in nginx.conf.

Question 14

A Linux server using systemd has a custom service unit `backup.service` that is supposed to run a script at 02:00 daily. The administrator notices that the service never starts at 02:00, but running `systemctl start backup.service` manually works. The unit file contains a `[Timer]` section in `backup.timer` with `OnCalendar=*-*-* 02:00:00` and `Persistent=true`. The `backup.timer` is enabled and active. Which command should the administrator run to diagnose why the timer is not triggering the service?

Accepted Answer

systemctl list-timers --all. The correct command is `systemctl list-timers --all`, which provides a detailed list of all timers, including their next and last trigger times. This helps identify if the timer is scheduled correctly and if it has ever triggered. Since manual start works, the issue is likely with the timer's scheduling or activation, and this command gives the necessary runtime information.

Answer

systemctl status backup.timer

Answer

systemctl cat backup.timer

Answer

journalctl -u backup.service --since '02:00'

Question 15

A production server runs a critical application that must be restarted automatically if it crashes, but should not be restarted if it exits cleanly due to a planned maintenance command. The application is managed by systemd. Which Restart setting in the unit file achieves this?

Accepted Answer

Restart=on-failure. The Restart=on-failure policy restarts a service only when it fails, meaning it exits with a non-zero code, is killed by a signal, or times out. A clean exit (status 0) does not trigger a restart. This aligns with the need to avoid restarts after a planned maintenance stop while ensuring recovery from unexpected crashes. Other policies either restart too often or too rarely.

Answer

Restart=on-success

Answer

Restart=on-abnormal

Answer

Restart=always