LFCS Operation of Running Systems Practice Test 5 — 15 Questions

Question 1

A system with systemd experiences a service that fails to start due to a 'Failed to start' error with status 203/EXEC. What is the most likely cause?

Accepted Answer

The service unit file has a missing or incorrect ExecStart command. Status 203/EXEC in systemd indicates that the service manager failed to execute the command specified in the service unit file. The most common cause is a missing or incorrect ExecStart directive, such as a typo in the binary path, a missing executable, or incorrect syntax. This error is specific to execution failures, not resource or dependency issues.

Answer

The system has run out of memory

Answer

The service is already running

Answer

The service requires a dependency that hasn't started

Question 2

A server is running out of disk space. Which command will show the disk usage of the root filesystem in a human-readable format?

Accepted Answer

df -h /. The `df -h /` command displays disk usage for the root filesystem (`/`) in a human-readable format (e.g., GB, MB) by using the `-h` flag. This is the standard tool for checking filesystem-level disk space, not directory-level usage.

Answer

ls -lh /

Answer

fdisk -l /

Answer

du -sh /

Question 3

A user reports that they cannot log in via SSH, but other users can. The administrator checks /var/log/auth.log and sees 'Failed password for invalid user'. What is the most likely cause?

Accepted Answer

The user does not exist on the system. The log message 'Failed password for invalid user' specifically indicates that the username presented during the SSH authentication attempt does not correspond to any account in the system's user database (e.g., /etc/passwd). This is distinct from a valid user failing authentication; the SSH server (sshd) rejects the session at the authentication stage because the user does not exist. Therefore, the most likely cause is that the user account does not exist on the system.

Answer

The user's SSH key is not authorized

Answer

The user account is locked

Answer

The user's password has expired

Question 4

An administrator wants to ensure that a service starts automatically after a system crash. Which systemd command should be used?

Accepted Answer

systemctl enable service. The `systemctl enable service` command creates the necessary symlinks in the systemd unit configuration directories (e.g., `/etc/systemd/system/multi-user.target.wants/`) so that the service is automatically started at boot. This includes recovery after a system crash, because the crash triggers a reboot, and the enabled service will be started as part of the normal boot process.

Answer

systemctl daemon-reload

Answer

systemctl mask service

Answer

systemctl start service

Question 5

A process is stuck in an uninterruptible sleep (D state) and cannot be killed. What is the most likely cause?

Accepted Answer

The process is waiting for I/O from a failing disk. A process in uninterruptible sleep (D state) is typically waiting for I/O from a block device, such as a disk. When a disk is failing or unresponsive, the kernel cannot complete the I/O request, and the process cannot be killed because doing so would risk data corruption or filesystem inconsistency. This state is a kernel-level wait that ignores signals, including SIGKILL.

Answer

The process has been stopped by a signal

Answer

The process is waiting for a network response

Answer

The process is waiting for CPU

Question 6

Refer to the exhibit. What is the most likely security issue?

Accepted Answer

Someone is attempting to brute-force the root password.. The exhibit shows multiple failed SSH login attempts for the root user from the same IP address in quick succession, as seen in the auth.log or secure log entries. This pattern indicates a brute-force attack, where an attacker systematically tries different passwords to gain unauthorized root access. Option C is correct because the repeated 'Failed password for root' messages are the hallmark of a brute-force attempt.

Answer

SSH service is not running.

Answer

The root account is disabled.

Answer

The firewall is blocking SSH.

Question 7

A system administrator notices that a web server process (PID 1234) is consuming excessive CPU. They want to trace its system calls to identify the cause. Which command should be used?

Accepted Answer

strace -p 1234. The correct command is `strace -p 1234`, which attaches to the running process (PID 1234) and intercepts all system calls (e.g., read, write, open) made by that process. This allows the administrator to see exactly what the web server is doing at the kernel level, such as excessive file I/O or network operations, which can pinpoint the cause of high CPU usage. Other tools like ltrace, perf, or gdb serve different purposes (library calls, profiling, debugging) and do not directly trace system calls.

Answer

ltrace -p 1234

Answer

perf record -p 1234

Answer

gdb -p 1234

Question 8

An administrator wants to view the current memory usage in a human-readable format, showing totals for used and free memory. Which command should be used?

Accepted Answer

free -h. The `free -h` command displays memory usage in a human-readable format (e.g., MiB, GiB) and shows totals for used and free memory, including buffers/cache and swap. This directly matches the requirement for a quick, readable summary of memory usage.

Answer

vmstat

Answer

top

Answer

cat /proc/meminfo

Question 9

After a kernel update, a service fails to start with 'cannot allocate memory'. The system has 16GB RAM and 8GB swap. Which command should the administrator run first to diagnose potential memory limits?

Accepted Answer

ulimit -a. `ulimit -a` displays all current user-level resource limits, including `max memory size`, `max processes`, and `max locked memory`. After a kernel update, the service may be hitting a newly enforced or reduced `ulimit` (e.g., `RLIMIT_AS` or `RLIMIT_DATA`), which can cause 'cannot allocate memory' even when system memory is abundant. This command is the fastest way to check if a per-process limit is the culprit.

Answer

free -m

Answer

cat /proc/meminfo

Answer

sysctl vm.overcommit_memory

Question 10

A server runs out of inodes. The administrator needs to find which filesystem is exhausted and which directory has the most files. Which command sequence best accomplishes this?

Accepted Answer

df -i; find / -xdev -type f -printf '%h\0' | sort -z | uniq -c -z | sort -rn | head. `df -i` first checks inode usage across all mounted filesystems to identify which one is exhausted. Then the `find / -xdev -type f -printf '%h\0' | sort -z | uniq -c -z | sort -rn | head` command counts files per directory on the root filesystem only (due to `-xdev`), using null-delimited output to handle special characters in filenames, and sorts to show the directory with the most files. This directly addresses both parts of the problem: identifying the exhausted filesystem and the directory with the most files.

Answer

df -i; find / -type f | wc -l

Answer

df -i; du --inodes /

Answer

df -h; du -sh /

Question 11

A system has a process stuck in uninterruptible sleep (D state). The administrator wants to identify which kernel function it is waiting on. Which tool should be used?

Accepted Answer

cat /proc/PID/stack. Reading /proc/PID/stack directly shows the kernel stack trace of the process, revealing the exact kernel function or wait queue the process is blocked on while in uninterruptible sleep (D state). This is the only tool listed that can inspect the kernel-side call stack without attaching a debugger or altering process state.

Answer

gdb -p PID

Answer

perf top -p PID

Answer

strace -p PID

Question 12

To view the system's default runlevel (target) at boot, which command is used on a systemd-based system?

Accepted Answer

systemctl get-default. On systemd-based systems, the default target (analogous to runlevel) is managed by systemctl. The command `systemctl get-default` queries the symlink at `/etc/systemd/system/default.target` to display which target is set to boot by default, making it the correct way to view the system's default boot target.

Answer

systemd-analyze

Answer

runlevel

Answer

cat /etc/inittab

Question 13

Which THREE commands can display the current CPU utilization statistics on a Linux system?

Accepted Answer

top. Option B, top, is correct because it is an interactive process viewer that continuously reports CPU utilization statistics, including per-core and aggregate usage, load average, and per-process CPU consumption. Option C, sar -u, is correct because the -u flag of the sar command from the sysstat package reports CPU utilization statistics (user, system, iowait, idle percentages) either for the current day or a specified interval. Option D, mpstat -P ALL, is correct because mpstat from the sysstat package with -P ALL displays per-processor CPU utilization statistics, showing each individual CPU core's usage percentages. Option A, free, is incorrect because it only reports memory and swap usage, not CPU statistics. Option E, uptime, is incorrect because it only shows the current time, system uptime, number of logged-in users, and load averages, without detailed CPU utilization percentages.

Answer

free

Answer

uptime

Question 14

Based on the exhibit, which process is using the most physical memory (RES)?

Accepted Answer

mysqld (PID 9101). The exhibit shows the output of the `top` command, where the RES column indicates the resident memory (physical RAM) used by each process. mysqld (PID 9101) has a RES value of 2.5g, which is significantly higher than nginx (PID 5678) with 128m and systemd (PID 1234) with 48m, making it the process using the most physical memory.

Answer

Not determinable from exhibit

Answer

nginx (PID 5678)

Answer

systemd (PID 1234)

Question 15

Based on the exhibit, what is the most likely cause of the blocked task?

Accepted Answer

Disk I/O bottleneck or hung storage. The exhibit shows a process in 'D' state (uninterruptible sleep), which typically indicates the process is waiting for I/O completion from a block device. When a task is blocked in this state for an extended period, it is most likely due to a disk I/O bottleneck or hung storage, as the kernel cannot interrupt this wait. CPU starvation (run queue) and memory leaks (OOM or swapping) produce different process states, making disk I/O the primary suspect.

Answer

CPU starvation

Answer

Memory leak

Answer

Network congestion