LFCS Operation of Running Systems Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are valid methods to check the status of a systemd service named 'httpd'? (Select TWO.)

Accepted Answer

systemctl status httpd. `systemctl status httpd` is the standard command to query the status of a systemd service. It displays the service's current state, recent log entries, and process information, directly interfacing with systemd's unit management.

Answer

initctl status httpd

Answer

systemd-analyze status httpd

Answer

/etc/init.d/httpd status

Question 2

Which TWO of the following commands can be used to display the current kernel ring buffer messages? (Select TWO.)

Accepted Answer

journalctl -k. A is correct because `journalctl -k` queries the systemd journal for kernel messages only, displaying the current kernel ring buffer content. This is the modern way to access kernel logs on systems using systemd, equivalent to `dmesg` but with structured journal output.

Answer

syslog -k

Answer

cat /proc/kmsg

Answer

tail /var/log/messages

Question 3

Which THREE of the following are valid options for the `lsblk` command to display more detailed information about block devices? (Select THREE.)

Accepted Answer

-o. (-o) is correct because it allows users to specify custom output columns, such as NAME, SIZE, TYPE, MOUNTPOINT, etc., enabling detailed and tailored information about block devices. Option C (-f) is correct as it displays filesystem information, including FSTYPE, LABEL, UUID, and MOUNTPOINT, which is essential for identifying filesystem details. Option E (-m) is correct because it shows ownership and permissions (owner, group, mode) for each block device, providing security-related details beyond the default output.

Answer

-c

Answer

-g

Question 4

Refer to the exhibit. What is the most likely issue with the Apache web server?

Accepted Answer

The DocumentRoot directory does not exist.. The most likely issue is that the DocumentRoot directory does not exist. When Apache starts, it checks for the existence of the directory specified by the DocumentRoot directive (e.g., /var/www/html). If this directory is missing, Apache will fail to serve content and may log an error like 'Primary script unknown' or 'Directory index forbidden', even though the service itself is running and enabled. This is a common misconfiguration after moving or deleting the web root.

Answer

The service is not enabled.

Answer

The main PID is incorrect.

Answer

The service is not running.

Question 5

Refer to the exhibit. Which filesystem is close to full capacity?

Accepted Answer

/dev/sdb1. The `df -h` output (not shown) indicates that /dev/sdb1 is at 90% capacity, while /dev/sda1 is at 75%. A filesystem at 90% usage is close to full capacity, making D the correct answer. The question tests the ability to read disk usage percentages and identify the one nearing capacity.

Answer

Both are at 75% or less

Answer

/dev/sda1

Answer

Neither

Question 6

Refer to the exhibit. What is the most likely security issue?

Accepted Answer

Someone is attempting to brute-force the root password.. The exhibit shows multiple failed SSH login attempts for the root user from the same IP address in quick succession, as seen in the auth.log or secure log entries. This pattern indicates a brute-force attack, where an attacker systematically tries different passwords to gain unauthorized root access. Option C is correct because the repeated 'Failed password for root' messages are the hallmark of a brute-force attempt.

Answer

SSH service is not running.

Answer

The root account is disabled.

Answer

The firewall is blocking SSH.

Question 7

A system administrator notices that a web server process (PID 1234) is consuming excessive CPU. They want to trace its system calls to identify the cause. Which command should be used?

Accepted Answer

strace -p 1234. The correct command is `strace -p 1234`, which attaches to the running process (PID 1234) and intercepts all system calls (e.g., read, write, open) made by that process. This allows the administrator to see exactly what the web server is doing at the kernel level, such as excessive file I/O or network operations, which can pinpoint the cause of high CPU usage. Other tools like ltrace, perf, or gdb serve different purposes (library calls, profiling, debugging) and do not directly trace system calls.

Answer

ltrace -p 1234

Answer

perf record -p 1234

Answer

gdb -p 1234

Question 8

A Linux server experiences intermittent high load averages but low CPU utilization. The administrator suspects an I/O bottleneck. Which command best identifies the specific device causing the bottleneck?

Accepted Answer

iostat -x 1. `iostat -x 1` provides extended device statistics, including `%util`, `await`, and `svctm`, which directly indicate the specific block device causing an I/O bottleneck. The `-x` flag reports per-device metrics like average I/O queue size and service time, making it the precise tool to identify a slow or overloaded disk under high load with low CPU usage.

Answer

sar -d 1

Answer

vmstat 1

Answer

top -d 1

Question 9

An administrator wants to view the current memory usage in a human-readable format, showing totals for used and free memory. Which command should be used?

Accepted Answer

free -h. The `free -h` command displays memory usage in a human-readable format (e.g., MiB, GiB) and shows totals for used and free memory, including buffers/cache and swap. This directly matches the requirement for a quick, readable summary of memory usage.

Answer

vmstat

Answer

top

Answer

cat /proc/meminfo

Question 10

A cron job runs a script that outputs to stdout. The administrator wants to capture both stdout and stderr to a file named job.log, while also seeing output on the terminal. Which command achieves this?

Accepted Answer

./script 2>&1 | tee job.log. It uses `2>&1` to redirect stderr to stdout, then pipes the combined stream to `tee job.log`, which writes to the file and also displays output on the terminal. This ensures both stdout and stderr are captured in `job.log` and visible on the screen.

Answer

script 2>&1 | tee job.log

Answer

./script | tee job.log 2>&1

Answer

./script > job.log 2>&1

Question 11

After a kernel update, a service fails to start with 'cannot allocate memory'. The system has 16GB RAM and 8GB swap. Which command should the administrator run first to diagnose potential memory limits?

Accepted Answer

ulimit -a. `ulimit -a` displays all current user-level resource limits, including `max memory size`, `max processes`, and `max locked memory`. After a kernel update, the service may be hitting a newly enforced or reduced `ulimit` (e.g., `RLIMIT_AS` or `RLIMIT_DATA`), which can cause 'cannot allocate memory' even when system memory is abundant. This command is the fastest way to check if a per-process limit is the culprit.

Answer

free -m

Answer

cat /proc/meminfo

Answer

sysctl vm.overcommit_memory

Question 12

An engineer wants to list all processes currently running under user 'appuser'. Which command is appropriate?

Accepted Answer

ps -u appuser. The `ps -u appuser` command lists all processes owned by the user 'appuser' by filtering the process table based on the user's UID. The `-u` option selects processes whose effective user ID or name matches the given argument, making it the most straightforward and standard way to display processes for a specific user.

Answer

pgrep -u appuser

Answer

top -u appuser

Answer

ps aux | grep appuser

Question 13

A server runs out of inodes. The administrator needs to find which filesystem is exhausted and which directory has the most files. Which command sequence best accomplishes this?

Accepted Answer

df -i; find / -xdev -type f -printf '%h\0' | sort -z | uniq -c -z | sort -rn | head. `df -i` first checks inode usage across all mounted filesystems to identify which one is exhausted. Then the `find / -xdev -type f -printf '%h\0' | sort -z | uniq -c -z | sort -rn | head` command counts files per directory on the root filesystem only (due to `-xdev`), using null-delimited output to handle special characters in filenames, and sorts to show the directory with the most files. This directly addresses both parts of the problem: identifying the exhausted filesystem and the directory with the most files.

Answer

df -i; find / -type f | wc -l

Answer

df -i; du --inodes /

Answer

df -h; du -sh /

Question 14

A system has a process stuck in uninterruptible sleep (D state). The administrator wants to identify which kernel function it is waiting on. Which tool should be used?

Accepted Answer

cat /proc/PID/stack. Reading /proc/PID/stack directly shows the kernel stack trace of the process, revealing the exact kernel function or wait queue the process is blocked on while in uninterruptible sleep (D state). This is the only tool listed that can inspect the kernel-side call stack without attaching a debugger or altering process state.

Answer

gdb -p PID

Answer

perf top -p PID

Answer

strace -p PID

Question 15

To view the system's default runlevel (target) at boot, which command is used on a systemd-based system?

Accepted Answer

systemctl get-default. On systemd-based systems, the default target (analogous to runlevel) is managed by systemctl. The command `systemctl get-default` queries the symlink at `/etc/systemd/system/default.target` to display which target is set to boot by default, making it the correct way to view the system's default boot target.

Answer

systemd-analyze

Answer

runlevel

Answer

cat /etc/inittab