LFCS Operation of Running Systems Practice Test 4 — 15 Questions

Question 1

A system administrator needs to monitor real-time network traffic on a specific interface (eth0). Which TWO tools can be used for packet-level analysis?

Accepted Answer

tshark -i eth0. A is correct because tshark is the command-line version of Wireshark, capable of capturing and analyzing packets in real time on a specific interface using the -i flag. It provides detailed packet-level inspection, including protocol dissection, which is essential for network traffic analysis.

Answer

iftop

Answer

wireshark

Answer

netstat -i

Question 2

Which THREE commands can display the current CPU utilization statistics on a Linux system?

Accepted Answer

top. The `top` command (option B) provides a real-time, dynamic view of system processes, including CPU utilization statistics such as user, system, idle, and I/O wait percentages. It is a standard tool for monitoring current CPU performance on Linux systems.

Answer

free

Answer

uptime

Question 3

Which THREE commands can show the current system time and date?

Accepted Answer

timedatectl. B is correct because `timedatectl` is the primary command in systemd-based Linux distributions (e.g., RHEL 7+, Ubuntu 16.04+) for querying and configuring system time, date, time zone, and NTP synchronization. It displays the current local time, UTC time, RTC time, and time zone status in a structured output.

Answer

time

Answer

ntpdate

Question 4

Based on the exhibit, which process is using the most physical memory (RES)?

Accepted Answer

mysqld (PID 9101). The exhibit shows the output of the `top` command, where the RES column indicates the resident memory (physical RAM) used by each process. mysqld (PID 9101) has a RES value of 2.5g, which is significantly higher than nginx (PID 5678) with 128m and systemd (PID 1234) with 48m, making it the process using the most physical memory.

Answer

Not determinable from exhibit

Answer

nginx (PID 5678)

Answer

systemd (PID 1234)

Question 5

Based on the exhibit, what is the most likely cause of the blocked task?

Accepted Answer

Disk I/O bottleneck or hung storage. The exhibit shows a process in 'D' state (uninterruptible sleep), which typically indicates the process is waiting for I/O completion from a block device. When a task is blocked in this state for an extended period, it is most likely due to a disk I/O bottleneck or hung storage, as the kernel cannot interrupt this wait. CPU starvation (run queue) and memory leaks (OOM or swapping) produce different process states, making disk I/O the primary suspect.

Answer

CPU starvation

Answer

Memory leak

Answer

Network congestion

Question 6

Based on the exhibit, what happens if the service 'myapp' crashes?

Accepted Answer

systemd will automatically restart it after 5 seconds. The systemd service unit for 'myapp' includes the directive `Restart=always` combined with `RestartSec=5`. When the service process crashes or exits, systemd detects the termination and automatically schedules a restart after the specified 5-second delay. The `Restart=always` directive ensures that the service is restarted regardless of the exit status, guaranteeing high availability. This behavior is defined in the service unit file and is a core feature of systemd's service management.

Answer

The service is disabled and will not start at boot

Answer

The service remains stopped until manually started

Answer

An alert is sent to the system administrator

Question 7

To display the current runlevel on a system using SysV init, which command should be used?

Accepted Answer

runlevel. The `runlevel` command is the standard tool for displaying the current runlevel on a system using SysV init. It outputs the previous and current runlevels, with 'N' indicating no previous runlevel. This command directly queries the SysV init process (PID 1) to retrieve the runlevel state.

Answer

who -r

Answer

systemctl get-default

Answer

init 3

Question 8

An administrator wants to schedule a one-time task to run at 2:30 PM next Friday. Which command should be used?

Accepted Answer

at 14:30 next Friday. The `at` command is specifically designed for scheduling one-time tasks at a specified time and date. The syntax `at 14:30 next Friday` correctly uses 24-hour time and the `next Friday` keyword, which the `atd` daemon interprets to run the job exactly once at that moment.

Answer

crontab -e and add entry

Answer

systemd-run --on-calendar='Fri 14:30' /bin/bash -c 'command'

Answer

at 2:30 PM Fri

Question 9

A process (PID 1234) is hung and cannot be killed with SIGTERM. To force termination, which signal should be sent?

Accepted Answer

kill -9 1234 (SIGKILL). SIGKILL (signal 9) is the correct choice because it cannot be caught, blocked, or ignored by the process. Unlike SIGTERM, which allows the process to perform cleanup, SIGKILL immediately terminates the process at the kernel level, making it the only reliable way to force-kill a hung process that ignores other signals.

Answer

kill -15 1234 (SIGTERM)

Answer

kill -2 1234 (SIGINT)

Answer

kill -1 1234 (SIGHUP)

Question 10

A system administrator needs to find all files that are larger than 100MB in the /var directory. Which command accomplishes this?

Accepted Answer

find /var -size +100M -type f. The `find` command with `-size +100M` locates files larger than 100 megabytes, and `-type f` restricts results to regular files, avoiding directories or special files. The `+` prefix means 'greater than', and `M` denotes megabytes (1048576-byte blocks). This is the standard syntax for size-based file searches on Linux.

Answer

find /var -size +100M

Answer

find /var -size +100MB

Answer

ls -lh /var | grep '100M'

Question 11

A production web server is experiencing intermittent high load. The administrator suspects that a specific Apache module is causing memory leaks. Which approach is most effective for isolating the issue without restarting the server?

Accepted Answer

Use strace -p <PID> on the Apache process and analyze system calls for memory allocation patterns.. D is correct because strace attaches to a running Apache process and traces its system calls, including memory-related calls like mmap, brk, and malloc. By analyzing these calls over time, the administrator can identify abnormal memory allocation patterns indicative of a leak in a specific module, all without restarting the server.

Answer

Check the Apache error log for memory-related errors.

Answer

Disable all modules in httpd.conf and reload the configuration.

Answer

Use top to monitor the memory usage of httpd processes over time.

Question 12

Which command shows the default target for systemd?

Accepted Answer

systemctl get-default. The correct command to display the default target (the systemd unit that the system boots into by default) is `systemctl get-default`. This command reads the symlink at `/etc/systemd/system/default.target` and outputs its target, such as `multi-user.target` or `graphical.target`. Option C is correct because it directly queries systemd for the current default boot target.

Answer

systemctl show default

Answer

systemctl list-default

Answer

systemctl default

Question 13

To permanently mount an ext4 filesystem at /data with noatime option, which entry should be added to /etc/fstab?

Accepted Answer

/dev/sdb1 /data ext4 defaults,noatime 0 0. The /etc/fstab entry for a permanent mount requires the filesystem device, mount point, type, options, dump frequency, and fsck pass order. The 'defaults,noatime' option string includes 'defaults' (which implies rw, suid, dev, exec, auto, nouser, async) and then overrides the access time update behavior with 'noatime'. The dump field (5th column) is 0 to disable backups, and the fsck pass order (6th column) is 0 to skip filesystem checks at boot, which is appropriate for a non-root data partition.

Answer

/dev/sdb1 /data ext4 noatime 0 0

Answer

/dev/sdb1 /data ext4 defaults,noatime 1 0

Answer

/dev/sdb1 /data ext4 defaults,noatime 0 1

Question 14

A system has a RAID 5 array that is degraded. One of the three disks failed and was replaced. The administrator runs 'cat /proc/mdstat' and sees that the array is still degraded. Which command should be used to add the new disk (/dev/sdc1) to the array?

Accepted Answer

mdadm /dev/md0 --add /dev/sdc1. A, B, and C are all valid syntaxes for adding a new disk to a RAID array with mdadm. The device path can appear before or after the `--add` option, and the `--manage` mode is optional but does not invalidate the command. Option D uses `--re-add`, which is intended for re-adding a disk that was previously part of the array; for a brand new replacement, `--add` is correct.

Answer

mdadm --re-add /dev/md0 /dev/sdc1

Question 15

An administrator notices that the system clock is drifting significantly. To synchronize time using NTP, which command should be used to immediately sync with a server?

Accepted Answer

chronyd -q. `chronyd -q` sends a single NTP query to synchronize the system clock immediately and then exits, which is ideal for one-shot synchronization. This command is part of the `chrony` suite, the default NTP implementation on modern RHEL/CentOS 8+ and Ubuntu 18.04+ systems, and it respects the NTP protocol (RFC 5905) for accurate time adjustment.

Answer

ntpdate -u pool.ntp.org

Answer

ntpd -g

Answer

timedatectl set-ntp true