Troubleshooting

A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?

A user reports that they cannot reach a website. The administrator wants to check the path that packets take to the destination server. Which command should be used?

A Linux engineer is investigating high disk I/O on a server. Which command provides disk I/O statistics including %util, await, r/s, and w/s?

During boot, a Linux system displays a kernel panic with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

An administrator wants to capture network traffic on interface eth0, writing the output to a file for later analysis, without resolving hostnames. Which command accomplishes this?

A technician needs to check the current memory usage on a Linux system, including buffers and cache. Which command provides the most user-friendly output?

A server is experiencing intermittent network connectivity issues. The administrator wants to run a continuous test that combines ping and traceroute to monitor the path and packet loss to a target host. Which command should be used?

An administrator needs to check the current routing table on a Linux system. Which command should be used?

An administrator needs to identify which processes are consuming the most CPU and memory resources. Which two commands can provide this information? (Choose two.)

A Linux administrator needs to view all current IPv4 addresses assigned to network interfaces on a system. Which command should be used?

A user reports that they cannot access a web server at 192.168.1.100. The administrator wants to check if the server is reachable and measure round-trip time. Which command is most appropriate?

An administrator is troubleshooting a DNS issue and needs to query the authoritative name servers for example.com. Which dig command should be used?

A system administrator notices that a web server is running but users cannot connect to port 443. Which ss command will show if the server is listening on that port?

A system is experiencing high disk I/O wait. Which command can provide disk I/O statistics such as requests per second and average wait time?

An administrator needs to check the kernel ring buffer for hardware error messages after a system crash. Which command should be used?

A technician suspects a process is leaking file descriptors. Which command can be used to list open files associated with a specific PID?

A server running RHEL 8 has intermittent network connectivity. The administrator wants to view the current DNS resolver configuration. Which file should be examined?

A technician needs to trace the system calls made by a running process to debug a performance issue. Which tool should be used?

A Linux administrator is troubleshooting a service that fails to start. Which TWO commands can be used to view the last 20 lines of the systemd journal for the sshd unit?

A system administrator is investigating a slow website. The web server is responding but pages load slowly. Which THREE commands can help identify network latency or packet loss?

A Linux administrator needs to check which services are listening on TCP port 22. Which command should be used?

A system administrator is troubleshooting a network issue where a server cannot reach the internet. The server's IP address is 192.168.1.10/24, and the default gateway is 192.168.1.1. Which command should be used to verify the default gateway configuration?

During boot, a Linux system displays a kernel panic indicating 'not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

A user reports that a web server is unreachable. The administrator runs 'curl -I https://example.com' and gets no response. Which command should be used next to check if the server is reachable at the network level?

A system is experiencing high load average. The administrator runs 'vmstat 1 5' and sees a high 'wa' value. What does this indicate?

A server running RHEL 8 fails to boot with a 'Dependency failed for /data' error. The /data filesystem is an ext4 partition on /dev/sdb1. Which sequence of steps should be taken to repair the filesystem?

An administrator wants to check the amount of free memory and swap usage on a system in a human-readable format. Which command should be used?

A user reports that they cannot access a website by domain name but can access it by IP address. Which of the following is the most likely cause?

A system fails to boot with a kernel panic. The administrator wants to recover by accessing a root shell. Which THREE methods can be used to achieve this?

A system administrator is investigating high disk I/O on a server. Which command can provide disk utilization statistics, including average wait time (await) and percentage of CPU time during which I/O requests were issued (%util)?

During boot, a Linux system displays a kernel panic with the message 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

A Linux system is running slowly with high I/O wait as shown by vmstat. To investigate the I/O activity of a specific process that is suspected of causing the bottleneck, which of the following commands would be used to trace its system calls related to I/O?

An administrator needs to capture network traffic on interface eth0, filter for packets to/from host 10.0.0.1, and save the output to a file for later analysis. Which command should be used?

A technician is troubleshooting a network connectivity issue. They need to trace the path packets take to a remote server and see the round-trip time for each hop. Which command should they use?

A system administrator wants to review kernel-related log messages from the current boot session. Which journalctl command should be used to filter the kernel messages?

An administrator is troubleshooting a service that fails to start with a 'Permission denied' error. The administrator runs `strace -f -o /tmp/strace.log systemctl start myservice`. Which of the following best describes what this command achieves?

An administrator is investigating a network issue where a server cannot connect to an external website. They run `ping 8.8.8.8` successfully, but `ping google.com` fails. Which TWO of the following are the most likely causes? (Choose TWO.)

A system administrator needs to collect performance data over time to analyze CPU and memory usage trends. Which THREE of the following commands can be used to gather historical performance data? (Choose THREE.)

A system administrator notices that the server is performing poorly. Running 'vmstat 1 5' shows high 'wa' values. Which subsystem is most likely experiencing a bottleneck?

An administrator is troubleshooting a service that fails to start. They want to trace the system calls made by the service binary. Which command should they use?

Which command displays the current routing table on a Linux system?

An administrator wants to monitor disk I/O performance in real-time, focusing on metrics like wait time and I/O queue size. Which tool is best suited for this?

A technician needs to check the kernel ring buffer for hardware errors detected during system boot. Which command should be used?

A Linux server is experiencing high CPU usage. Which TWO commands can be used to identify which processes are consuming the most CPU? (Choose two.)

A system is experiencing high memory usage. The administrator wants to see a brief summary of memory usage in human-readable format, including buffers and cache. Which command is most appropriate?

An administrator needs to check the kernel ring buffer for hardware error messages from the current boot. Which command displays this information?

A technician wants to check the disk I/O statistics, focusing on the average I/O wait time and utilization percentage. Which command provides this information?

A system administrator is troubleshooting a service that fails to start. They want to see the recent logs for that specific service unit. Which journalctl command should be used?

A user cannot access a website, but other websites work. The administrator wants to see the HTTP response headers from the web server. Which command is most appropriate?

A system is experiencing boot failures. The administrator wants to view kernel messages from the current boot to diagnose the issue. Which two commands can be used to see these messages? (Choose two.)

A Linux administrator needs to verify which network interfaces are up and their IP addresses on a server. Which command provides this information?

A server fails to boot with a kernel panic after a system update. The administrator suspects a corrupt initramfs. Which GRUB boot parameter should be added temporarily to boot into an emergency shell where the filesystem can be repaired?

A system administrator wants to collect network performance statistics over time, including packet loss and latency, to diagnose intermittent connectivity issues. Which tool combines the functionality of ping and traceroute into a single continuous monitoring command?

A Linux technician is troubleshooting a system that is experiencing high disk I/O wait times. Which TWO commands can be used to identify disk I/O performance issues? (Choose two.)

An administrator needs to verify DNS resolution for a web server. Which TWO commands can be used to query DNS A records for a given hostname? (Choose two.)

A system is running slowly and the administrator suspects a memory leak. Which THREE commands or tools can be used to analyze memory usage and identify processes consuming excessive memory? (Choose three.)

A Linux server's root filesystem was accidentally filled to 100% capacity by runaway application logs. After the administrator deletes several large log files with rm, df -h still reports the filesystem at 100% usage. Which command should the administrator use to identify the process that is holding these deleted files open?

A Linux administrator is troubleshooting a service that fails to start. The service unit file is present and enabled, but systemctl status shows 'failed' with exit code 203. Which command should the administrator run to view the most recent log messages specific to this service?

A Linux server's /var/log partition is 100% full and rsyslogd has stopped writing logs. The administrator needs to find which directories under /var/log consume the most space without deleting anything. Which command should the administrator run?

A Linux administrator receives reports that a server's root filesystem is completely full. They run `df -h` and see that the root partition is at 100% usage. Which command should they use NEXT to identify which directories are consuming the most space?

A Linux administrator is troubleshooting a server that has become unresponsive. They suspect a process is consuming excessive CPU. Which command should they use to display a real-time, interactive view of processes sorted by CPU usage?

Users report that a web application on a Linux server is unreachable from external clients. From the server itself, curl http://localhost works fine. The administrator wants to confirm whether the service is bound only to the loopback interface. Which command should the administrator run?

A Linux server is experiencing intermittent network connectivity issues. The administrator suspects that packets are being dropped due to a misconfigured firewall rule. Which command should the administrator use to view the current iptables rules and their packet counters?

A Linux administrator notices that a server's root filesystem is using 100% of its inodes, even though `df -h` shows only 60% of the disk space used. Users are unable to create new files. Which command most directly helps identify directories containing large numbers of small files that are consuming inodes?

A Linux server is experiencing intermittent network connectivity issues. The administrator suspects that the network interface is dropping packets due to a duplex mismatch. Which command should be used to check the duplex setting and link status of the interface?

A Linux administrator is diagnosing a system that occasionally hangs during boot. The administrator suspects a hardware issue. Which command will display kernel ring buffer messages, including hardware detection and driver errors, from the current boot?

A Linux server intermittently loses its default route after several hours of uptime, and users cannot reach external networks until the route is manually restored. The administrator suspects that a second default route is being installed and removed by a network management daemon. Which command should the administrator use to monitor route changes in real time?

A Linux administrator is troubleshooting a server that is unresponsive. They suspect a process is consuming excessive CPU. Which TWO commands can be used to identify the process with the highest CPU usage? (Choose two.)

A Linux server's clock drifts by several minutes each day. The administrator runs `timedatectl` and sees that NTP synchronization is enabled but the system clock is not synchronized. The server can reach the internet, and `chronyd` is running. Which command should the administrator use to verify which NTP sources are currently reachable and their stratum levels?

An administrator notices that a critical application server has become extremely slow, and load average has climbed above 40 on a 4-core system. The administrator wants to identify whether the bottleneck is CPU contention or processes stuck in uninterruptible sleep. (Choose two.)

A Linux administrator is troubleshooting a server that intermittently loses network connectivity. They suspect duplicate IP address conflicts on the local subnet. Which TWO commands can be used to detect whether another host is using the same IP address as the server? (Choose two.)

A Linux administrator is investigating why a user cannot log in via SSH. The SSH service is running, and the network is reachable. The administrator suspects that the user's account is locked or expired. Which command should they use to check the account status and expiration details for the user 'jdoe'?

After applying a kernel update, a Linux server boots but the root filesystem is mounted read-only, and dmesg shows I/O errors on /dev/sda2. The administrator needs to determine whether the filesystem is corrupted and, if so, repair it safely. Which sequence of actions should the administrator take?

A Linux administrator is troubleshooting a service that fails to start. The service's unit file has a dependency on another service, but the dependent service is not running. The administrator wants to view the dependency tree of the failing service to understand the ordering and requirements. Which command should be used?

A user reports that a shell script fails with a 'Permission denied' error when executed, even though the file has the execute bit set for the owner. The administrator runs `ls -l script.sh` and sees `-rwxr-xr-x`. Which command should the administrator use to determine whether the filesystem is mounted with the `noexec` option?

A Linux administrator is troubleshooting a server that has lost network connectivity. They need to verify the current IP configuration and check the default gateway. Which TWO commands can be used to display the IP address and routing table? (Choose two.)

A Linux administrator is troubleshooting a server that is running out of disk space. Which TWO commands can be used to identify which directories or files are consuming the most space? (Choose two.)

A Linux administrator is troubleshooting a service that fails to start. They want to view the most recent log entries for that service using systemd's journal. Which command should they use?

A Linux administrator notices that a server's root filesystem is filling up rapidly. After running `df -h`, the root filesystem shows 100% usage. However, when the administrator runs `du -sh /*` from the root directory, the total size is only about 40% of the filesystem. The administrator suspects that a deleted file is still being held open by a process. Which command should the administrator use to identify the process holding the deleted file?

A Linux server has a single disk /dev/sda with LVM. The root logical volume is nearly full and the administrator adds a new disk /dev/sdb to extend it. After creating a physical volume on /dev/sdb and adding it to the volume group, which command should be used to extend the root logical volume and its filesystem in one step?

A Linux administrator notices that a production server's root filesystem is 100% full, but du reports only 40 GB used on a 100 GB partition. Which command should the administrator use to identify deleted files still held open by running processes?

A Linux administrator notices that a server's clock is drifting and NTP synchronization is failing. The administrator runs 'chronyc sources' and sees that all sources are marked with a '?' character. Which command should be run next to diagnose why chronyd cannot reach the NTP servers?

A Linux administrator is troubleshooting a server that has lost network connectivity. The administrator runs `ip a` and sees that the interface `ens33` is in the DOWN state and has no IP address assigned. The administrator wants to bring the interface up and assign it an IP address of 192.168.1.50/24. Which command should the administrator use?

A Linux server is experiencing intermittent network connectivity issues. The administrator needs to capture and analyze network traffic to diagnose the problem. Which TWO commands or tools can be used to capture packets on the eth0 interface? (Choose two.)

A Linux server's root filesystem was extended with LVM, but after a reboot users report that only the original capacity is available again. Running 'df -h' shows the mount smaller than the logical volume, and 'lvextend' completed successfully before the reboot. Which command should the administrator run to make the filesystem use the additional space on an XFS root volume?

A Linux administrator receives reports that a server becomes unresponsive for several seconds at a time. Running `uptime` shows a load average of 14.2 on a system with 4 CPU cores, and `vmstat 1` reports a steadily rising 'r' column with a 'wa' column near zero. Which command should the administrator run NEXT to identify which processes are consuming CPU time?

A Linux administrator notices that the /home filesystem is full. They want to identify which top-level directories under /home are consuming the most disk space. Which command should they run?

A Linux administrator receives reports that a database server becomes unresponsive every day around 02:00. Reviewing logs, the administrator notices repeated messages about 'blocked for more than 120 seconds' and high I/O wait. Which command should be used to identify which process is generating the most disk I/O during this period?

A production web server intermittently stops responding for about 30 seconds at a time. The administrator runs 'vmstat 1' during an incident and observes the 'wa' column consistently above 80 while 'us' and 'sy' remain low. Which conclusion best describes the bottleneck?

A user reports that an application fails with 'Permission denied' when writing to /srv/reports, even though the user is a member of the group that owns the directory. Running `ls -ld /srv/reports` returns 'drwxr-x--- 2 root reports 4096 Jun 10 09:14 /srv/reports'. The user's `id` output confirms membership in the reports group. Which action will allow the user to create files in that directory?

A Linux server's root filesystem is filling rapidly. The administrator suspects a process is writing to a deleted file that still holds space. They want to identify which running process has an open file descriptor to a deleted file. Which command should they use?

A user reports that they are unable to write to a USB drive mounted at /mnt/usb. The administrator checks the mount options and sees that the drive is mounted read-only. Which command should the administrator use to remount the filesystem as read-write without unmounting it?

A user reports that the 'backup.sh' script runs correctly when launched manually but silently does nothing when executed by cron at 02:00. The script relies on 'tar', which is found at /usr/bin/tar. Which action most directly resolves the failure?

A Linux administrator is troubleshooting a server that randomly drops SSH connections. The administrator suspects a network interface is experiencing errors or discards. Which command should be used to display detailed error and discard statistics for a specific network interface?

A Linux administrator is troubleshooting intermittent application failures on a server. They suspect resource exhaustion. Which TWO commands can be used to check current system resource limits and usage for a running process? (Choose two.)

A Linux administrator needs to check the amount of free disk space on all mounted filesystems in a human-readable format. Which command should be used?

An administrator notices that a web application intermittently returns 'Connection timed out' to clients on the same subnet, while the server itself responds to pings. Packet captures show the server receiving SYN packets but never replying. The host firewall is suspected. Which command should the administrator use to inspect the active ruleset and its counters on a system using nftables?

A Linux administrator is troubleshooting a system that becomes unresponsive under heavy load. They suspect that a process is causing excessive disk I/O. Which command should the administrator use to identify the process performing the most disk writes in real time?

A Linux server becomes unresponsive, and the administrator suspects a process is consuming excessive CPU. The administrator needs to identify the offending process and then terminate it cleanly by PID. Which TWO commands should be used to accomplish these tasks? (Choose two.)

A Linux server reports that its root filesystem is 100 percent full, and applications are failing to write logs. The administrator needs to identify what is consuming space and reclaim it safely. Which two commands are appropriate to determine where the space is used? (Choose two.)

A Linux administrator is troubleshooting a server that cannot resolve hostnames. The administrator suspects a misconfiguration in the DNS resolver. Which file should be checked first to verify the DNS server addresses?

After adding a new static route to a server, an administrator notices that traffic to 10.20.0.0/16 still leaves through the default gateway. The route appears in 'ip route' output but is not used. The administrator confirms the interface is up. Which command should be run to verify that the kernel is selecting the intended route for that destination?

A Linux administrator is investigating why a scheduled backup job did not run overnight. The job is defined in the root user's crontab. Which command should the administrator use to review the cron daemon's log entries for the relevant time period?

A Linux administrator is troubleshooting a server that becomes unresponsive under load. They want to capture a live, per-second view of CPU usage broken down by individual processor cores, along with load averages. Which command should they use?