LFCS Operation of Running Systems Practice Test 5 — 15 Questions

Question 1

Which THREE factors can cause a system to fail to boot after changing kernel boot parameters in GRUB?

Accepted Answer

A missing initrd file path.. The initrd (initial RAM disk) contains essential drivers and modules needed to mount the root filesystem. If the initrd file path in GRUB is missing or incorrect, the kernel cannot load the necessary drivers to access the root partition, causing a boot failure.

Answer

An incorrect network configuration.

Answer

A corrupted GRUB configuration file.

Question 2

Which TWO commands can be used to view logs for a specific systemd unit (e.g., sshd.service)?

Accepted Answer

journalctl -u sshd.service. Both `journalctl -u sshd.service` and `journalctl _SYSTEMD_UNIT=sshd.service` are correct because `journalctl` is the native tool for querying the systemd journal, which stores logs for all systemd units. The `-u` flag filters by unit name, while `_SYSTEMD_UNIT=` is a journal field that directly matches the unit identifier, both providing the same filtered output for sshd.service.

Answer

tail -f /var/log/secure

Answer

systemctl status sshd.service

Answer

cat /var/log/messages | grep sshd

Question 3

Refer to the exhibit. Based on the exhibit, which service is configured to accept connections only from the local machine?

Accepted Answer

SMTP. The exhibit shows that the SMTP service is bound to the loopback address 127.0.0.1 on port 25, which means it will only accept connections originating from the local machine. This is a common security practice to prevent external hosts from directly submitting mail to the local MTA.

Answer

NTP

Answer

HTTP

Answer

HTTPS

Answer

SSH

Question 4

Refer to the exhibit. How many days of logs are retained before deletion?

Accepted Answer

14. (14 days) because the exhibit shows a log rotation configuration using `logrotate` with a `rotate 14` directive, which retains 14 rotated log files before deletion. The `daily` or `weekly` frequency determines how often rotation occurs, but the `rotate` count directly specifies the number of archived logs kept, not the total time span.

Answer

7

Answer

365

Answer

30

Question 5

An e-commerce company runs a critical application on a Linux server that occasionally becomes unresponsive. The server has 64GB RAM and runs a Java application. The operations team notices that during peak hours, the system becomes very slow and eventually the application crashes with 'OutOfMemoryError'. After restart, it works fine for a while. They suspect a memory leak but also want to ensure the system does not go down during peak hours. The system uses systemd to manage the Java service. The administrator needs to implement a solution that: (1) automatically restarts the service if it becomes unresponsive, (2) limits the memory usage of the service to prevent OOM kills on the system, and (3) provides early warning of high memory usage. Which of the following approaches best meets these requirements?

Accepted Answer

Configure systemd service with WatchdogSec=30, Restart=on-failure, MemoryMax=32G. Also set up a log watcher that alerts when memory usage exceeds 28G via journalctl and a custom script.. It uses systemd's WatchdogSec to detect unresponsiveness and Restart=on-failure to automatically restart the service, while MemoryMax=32G enforces a hard memory limit via cgroups to prevent OOM kills. The custom log watcher provides early warning by alerting when memory usage exceeds 28G, satisfying all three requirements.

Answer

Set up a cron job to run every minute that checks memory usage with free and if > 90%, restart the service with systemctl restart. Also configure MemoryMax=32G in the systemd unit.

Answer

Configure sysctl vm.overcommit_memory=2 to prevent overcommit, and allocate huge pages for Java. Also set Restart=always in the systemd unit.

Answer

Use ulimit -v 33554432 in the service script to limit virtual memory, and set Restart=always. Also configure a cron job to send alerts when dmesg shows OOM.

Question 6

A junior admin runs 'systemctl restart httpd' but the httpd service fails to start. Which command should the admin use first to diagnose the problem?

Accepted Answer

systemctl status httpd. `systemctl status httpd` provides a concise summary of the service's current state, including whether it is active, the last log entries, and the exit code or failure reason. This is the first diagnostic step recommended by systemd documentation to quickly identify common issues like configuration errors, missing dependencies, or permission problems.

Answer

journalctl -u httpd

Answer

systemctl show httpd

Answer

systemctl list-units --type=service

Question 7

During boot, the system drops into a shell with message 'ERROR: No suitable file system found'. Filesystem corruption is suspected. Which sequence of actions should the admin take to attempt recovery?

Accepted Answer

Determine the root device, then run 'fsck -y /dev/sda1'.. When the system drops into an emergency shell with 'ERROR: No suitable file system found', the admin must first identify the root device (e.g., using `blkid` or `lsblk`) and then run `fsck -y /dev/sda1` to attempt automatic repair of the corrupted filesystem. The `-y` flag answers 'yes' to all prompts, which is appropriate in a recovery scenario where the goal is to get the system bootable. This approach is filesystem-agnostic and works for common Linux filesystems like ext4, XFS, or btrfs, though specific tools (e.g., `xfs_repair` for XFS) may be needed if `fsck` is not suitable.

Answer

Run xfs_repair -n /dev/sda.

Answer

Run e2fsck /dev/sda1 from the emergency shell.

Answer

Mount the root filesystem manually, then run fsck.

Question 8

A system running RHEL 8 experiences intermittent crashes. After reboot, 'journalctl -p err -b -1' outputs: 'PID 1234 (myapp) ended due to signal: KILL'. Which diagnostic step should the administrator perform next?

Accepted Answer

Check journalctl for 'oom-kill' entries or use 'dmesg | grep -i oom'.. The 'PID ended due to signal: KILL' message indicates the process was terminated by a SIGKILL (signal 9), which is commonly sent by the Out-Of-Memory (OOM) killer when the system runs low on memory. Checking journalctl for 'oom-kill' entries or using 'dmesg | grep -i oom' directly confirms whether the OOM killer was responsible, making D the correct next diagnostic step.

Answer

Review logrotate configuration for myapp logs.

Answer

Run strace to capture system calls of myapp before restarting.

Answer

Enable core dumps and reproduce issue.

Question 9

Which TWO commands can be used to display real-time process resource usage on a Linux system? (Choose two.)

Accepted Answer

htop. (htop) is correct because it is an interactive process viewer that displays real-time resource usage, including CPU, memory, and process details, with a user-friendly interface. Option E (top) is correct because it is the standard Linux command for real-time monitoring of system processes and resource consumption, updating dynamically by default.

Answer

vmstat 1

Answer

ps -aux

Answer

free -h

Question 10

Which THREE methods can be used to rescue a Linux system that fails to boot past GRUB? (Choose three.)

Accepted Answer

Append 'systemd.unit=emergency.target' to kernel command line.. Options A, B, and C are all valid rescue methods directly from the GRUB menu. Option A appends 'systemd.unit=emergency.target' to boot into a minimal systemd emergency shell. Option B adds 'single' to invoke single-user mode (equivalent to systemd rescue.target). Option C edits the GRUB entry by pressing 'e' and appending 'init=/bin/bash' to boot directly to a Bash shell as PID 1. Option D is incorrect because the 'linux' command with 'init=/bin/bash' is not a valid standalone GRUB command; the correct procedure is to edit the kernel line within the GRUB menu entry. Option E is also incorrect in this context because using a rescue image from boot media is not a method that is executed from the GRUB prompt; it changes the boot source entirely.

Answer

From GRUB menu, run 'linux /vmlinuz-... root=/dev/sda1 init=/bin/bash'.

Answer

Use the system rescue image by selecting 'Rescue' from boot media.

Question 11

A system administrator is troubleshooting a production web server running CentOS 7 that became unresponsive. The server is still pingable, but SSH connections timeout. The admin performs an out-of-band console login. The server appears frozen; typing commands shows no output. The admin is able to trigger a Magic SysRq key sequence (Alt+SysRq+f) to kill the hung processes. After that, the server resumes normal operation. However, the admin wants to understand the root cause. Upon checking 'dmesg', they see repeated messages: 'NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s!' followed by stack traces from a kernel thread. Which action should the admin take to prevent recurrence while maintaining system stability?

Accepted Answer

Update the server's BIOS/firmware and check for kernel updates.. Soft lockup errors on CentOS 7 often indicate kernel bugs or hardware/firmware issues that cause CPUs to stall for extended periods. Updating the BIOS/firmware can resolve underlying hardware timing problems, while kernel updates may include patches for known soft lockup bugs. This approach addresses the root cause without disabling or weakening the watchdog mechanism, preserving system stability.

Answer

Replace the power supply unit to ensure stable power.

Answer

Increase the soft lockup threshold via sysctl to reduce false positives.

Answer

Add 'nosoftlockup' to the kernel boot parameters.

Question 12

A user reports that a background process (PID 3456) is consuming 95% of CPU and causing system slowness. The process name is 'crypto-miner'. The administrator needs to immediately stop this process and ensure it does not restart. Which set of commands should the administrator execute?

Accepted Answer

kill -9 3456, then locate the cron job or systemd service that starts it, and disable/remove it.. It addresses both immediate termination and persistence removal. The SIGKILL signal (kill -9) immediately terminates the process, and disabling the cron job or systemd service prevents automatic restart, which is critical for a malicious or unwanted process like 'crypto-miner'.

Answer

renice -n 19 -p 3456 and let it run with lower priority.

Answer

kill -9 3456 and then notify the user.

Answer

kill -15 3456 and hope it terminates.

Question 13

An administrator is investigating why the 'tomcat' service fails to start on a RHEL 8 server. The output of 'systemctl status tomcat' shows: 'Loaded: loaded (/etc/systemd/system/tomcat.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since ... Process: 4567 ExecStart=/opt/tomcat/bin/startup.sh (code=exited, status=1/FAILURE)'. The 'journalctl -u tomcat' shows: 'Error: JAVA_HOME is not defined correctly, cannot execute /usr/lib/jvm/java-11-openjdk/bin/java'. The admin checks /opt/tomcat/bin/startup.sh and sees it references JAVA_HOME. The admin verifies that Java 11 is installed at /usr/lib/jvm/java-11-openjdk. Which action should the admin take to fix the service?

Accepted Answer

Add 'Environment=JAVA_HOME=/usr/lib/jvm/java-11-openjdk' to the [Service] section of /etc/systemd/system/tomcat.service and run 'systemctl daemon-reload && systemctl restart tomcat'.. Systemd services can have environment variables set via the `Environment=` directive in the unit file. Adding `JAVA_HOME=/usr/lib/jvm/java-11-openjdk` to the `[Service]` section ensures the variable is available to the `ExecStart` process. Running `systemctl daemon-reload` reloads the unit definition, and `systemctl restart tomcat` applies the change. This is the proper method for configuring environment variables for systemd-managed services on RHEL 8.

Answer

Edit /opt/tomcat/bin/startup.sh and hardcode JAVA_HOME.

Answer

Run the startup script manually with 'bash /opt/tomcat/bin/startup.sh'.

Answer

Set JAVA_HOME globally using 'export JAVA_HOME=/usr/lib/jvm/java-11-openjdk' in /etc/profile.

Question 14

A system administrator notices that logrotate did not rotate the /var/log/messages file on a CentOS 7 server despite having a configuration at /etc/logrotate.d/syslog. The admin runs 'logrotate -d /etc/logrotate.conf' and sees that the syslog file is excluded due to 'olddir' option, but the olddir does not exist. Additionally, the logrotate status file (/var/lib/logrotate/logrotate.status) shows that /var/log/messages was last rotated 30 days ago. The logrotate cron job is scheduled daily. What is the most likely reason the rotation fails?

Accepted Answer

The olddir specified in the config does not exist, causing logrotate to error out before rotation.. The `logrotate -d` (debug) output explicitly states the file is excluded due to the 'olddir' option, and the admin confirmed the olddir does not exist. When logrotate is configured with an 'olddir' directive, it attempts to move the rotated log file to that directory before performing the rotation. If the directory does not exist, logrotate fails with an error and aborts the rotation for that log file, leaving it unrotated. This is a common misconfiguration that prevents rotation even when all other conditions (e.g., age, size) are met.

Answer

The log file size has not exceeded the configured maxsize threshold.

Answer

The logrotate script does not have read permission on /var/log/messages.

Answer

The 'compress' option is missing, so logrotate skips the file.

Question 15

A developer reports that a custom daemon fails to start after a reboot. The daemon's unit file is located in /etc/systemd/system/custom.service. Which of the following is the most likely cause?

Accepted Answer

The service is not enabled.. The most likely cause is that the service is not enabled (systemctl enable). Even though the unit file exists in /etc/systemd/system, systemd only starts services automatically at boot if they are enabled. Option B is correct. Option A is incorrect because manually starting the service after installation would work but does not affect boot behavior. Option C is unlikely because SELinux policy blocks would produce a different error (e.g., denial messages). Option D is incorrect because firewall rules do not prevent systemd from starting a service; they affect network connectivity.

Answer

The service was not started manually after installation.

Answer

The SELinux policy blocks the service.

Answer

A firewall rule is blocking inbound connections.