LPIC-1 Practice Test 38 — 15 Questions

Question 1

A medium-sized company runs a web server on Linux with two 1TB disks in a software RAID1 (mdadm) configuration for the root filesystem and /var. Recently, the /var partition is reporting low disk space. The administrator discovers that old log files are consuming space but should be rotated. However, the logrotate service is not running. After starting logrotate, it fails to rotate some logs because of missing directories. Additionally, the administrator wants to add a third disk (500GB SSD) for additional storage and mount it under /srv/webdata. The disk is new and not partitioned. The server uses systemd and the current /etc/fstab uses UUIDs. What is the correct sequence of steps to add the new disk and ensure it is mounted automatically at boot?

Accepted Answer

Partition the disk with fdisk, create an ext4 filesystem, create the mount point, mount the filesystem, obtain the UUID, add an entry to /etc/fstab using the UUID, and run mount -a to verify.. Option B is correct because it follows the standard procedure for adding a new disk to a Linux system: partition the disk (even if only one partition is needed), create a filesystem, create a mount point, mount it, obtain the UUID (e.g., via blkid), add an entry to /etc/fstab using the UUID for reliable boot-time mounting, and verify with mount -a. This ensures the disk is mounted automatically at boot, independent of device name changes, and aligns with systemd's expectation of UUID-based fstab entries.

Answer

Format the disk with ext4, add an entry to /etc/fstab using the device path /dev/sdc with the nofail option, then mount -a.

Answer

Add the disk to the existing RAID1 array to expand it, then grow the filesystem to use the new space.

Answer

Initialize the disk as an LVM physical volume, extend the existing volume group, create a logical volume, format it, mount it, and add to /etc/fstab.

Question 2

You manage a CentOS 7 server that runs a critical application storing data on an XFS filesystem mounted at /data. The server experiences an unexpected power outage. After rebooting, the application fails to start, and you suspect filesystem corruption. You boot into single-user mode and attempt to mount /data, but the mount fails with an error: 'mount: /dev/sdb1: can't read superblock'. You run 'xfs_repair -n /dev/sdb1' and it reports the log is dirty and must be replayed or the filesystem repaired with the -L option (force log zeroing). You want to recover the filesystem with minimal data loss. Which action should you take?

Accepted Answer

Run 'xfs_repair -L /dev/sdb1' to force log replay and repair.. The correct answer is A because xfs_repair -L /dev/sdb1 forces the log to be zeroed (cleared) and then performs a full filesystem check and repair. This is necessary when the log is dirty and cannot be replayed normally due to corruption, such as after an unclean shutdown. The -L option is the standard recovery method for XFS when the log is damaged, and it minimizes data loss by only discarding the log (which contains metadata changes that were not yet written to disk) while preserving the rest of the filesystem data.

Answer

Mount the filesystem with the 'norecovery' option to bypass the log and then attempt to repair.

Answer

Run 'fsck -y /dev/sdb1' to automatically repair.

Answer

Run 'xfs_admin -U generate /dev/sdb1' to generate a new UUID and then mount.

Question 3

You are a Linux administrator for a large e-commerce company. The company's application server runs Ubuntu 22.04 and uses a Btrfs filesystem for the /srv/app partition to take advantage of snapshots and compression. During a routine maintenance window, you create a snapshot of the /srv/app subvolume using 'btrfs subvolume snapshot /srv/app /srv/app_snapshot'. Later, you need to roll back to the snapshot because of a failed application update. You attempt to delete the original subvolume with 'btrfs subvolume delete /srv/app', but the command fails with the error: 'ERROR: cannot delete '/srv/app': Device or resource busy'. You check that no processes are using the directory with lsof, and it shows no open files. The /srv/app subvolume is the default subvolume and is mounted via fstab with the option 'subvol=/' (the root of the Btrfs filesystem). What is the most likely reason for the deletion failure, and how should you proceed?

Accepted Answer

The subvolume is the default subvolume (ID 5) and cannot be deleted while it is the mounted root; use 'btrfs subvolume set-default <new_subvol_id> /srv/app', then unmount and remount with the new default subvolume, then delete the old subvolume.. The error occurs because the subvolume at /srv/app is the default subvolume (ID 5) of the Btrfs filesystem, and it is currently mounted as the root of the filesystem via the 'subvol=/' mount option. A default subvolume cannot be deleted while it is mounted because the kernel treats it as the top-level volume. To delete it, you must first set a different subvolume as the default using 'btrfs subvolume set-default', then unmount and remount the filesystem with the new default, after which the original subvolume can be safely deleted.

Answer

The subvolume is read-only; change it to read-write with 'btrfs property set -f /srv/app ro false'.

Answer

You cannot delete the subvolume because it is the default subvolume; you must first delete the snapshot and then recreate the original.

Answer

The Btrfs kernel module has a readahead lock on the subvolume; wait for it to expire or reboot.

Question 4

A system administrator notices that the system's syslog messages are not being written to /var/log/messages. The rsyslog service is running. The administrator wants to check the configuration syntax of rsyslog. Which command should be used?

Accepted Answer

rsyslogd -N. The correct command is `rsyslogd -N` because the `-N` option performs a configuration syntax check without starting or restarting the rsyslog daemon. This allows the administrator to validate the rsyslog configuration file for errors before applying changes, ensuring that syslog messages will be written correctly to /var/log/messages.

Answer

rsyslogd -d

Answer

rsyslogd -f

Answer

rsyslogd -v

Question 5

A Linux administrator manages a server that runs a custom application requiring a specific kernel module to be loaded at boot. The server uses SysV init and has the module listed in /etc/modules. However, after a recent kernel update, the module fails to load automatically at boot. The administrator can manually load the module with 'modprobe <module>' after the system is running. The application depends on this module being loaded before any network services start. Which of the following actions should the administrator take to ensure the module loads automatically at the correct time during boot?

Accepted Answer

Create a SysV init script that loads the module and place it in /etc/init.d/ with appropriate symlinks in /etc/rc?.d/ to ensure it runs before network services.. Option A is correct because SysV init systems use init scripts in /etc/init.d/ with symlinks in /etc/rc?.d/ to control the order of service startup. By creating a custom init script that loads the module via modprobe and placing it with a symlink that has a lower number (e.g., S01module) than network services (e.g., S10network), the module will be loaded before network services start, satisfying the application's dependency.

Answer

Add the module name to /etc/modules-load.d/ directory.

Answer

Add an install directive in /etc/modprobe.d/ for the module.

Answer

Add a blacklist entry for the module in /etc/modprobe.d/blacklist.conf.

Question 6

A junior system administrator is tasked with setting up a new Linux server that will act as a network time client. The server must synchronize its clock with the external NTP pool servers 0.pool.ntp.org, 1.pool.ntp.org, and 2.pool.ntp.org. The administrator installs the ntp package and edits /etc/ntp.conf to include the following lines:

server 0.pool.ntp.org
server 1.pool.ntp.org
server 2.pool.ntp.org

However, after restarting the ntpd service, the administrator notices that the system time does not appear to be synchronized. The command 'ntpq -p' returns no output. The administrator checks the status of the ntpd service with 'systemctl status ntp' and sees that the service is active (running). What is the most likely reason for the synchronization failure?

Accepted Answer

The ntpd daemon is configured to only adjust the clock gradually and refuses to make large time jumps by default.. B is correct because the ntpd daemon, by default, will not make large time jumps (more than a certain threshold, typically 128 ms) and instead gradually slews the clock. If the system clock is significantly out of sync (e.g., by minutes or hours), ntpd will refuse to step the time and may appear to do nothing, resulting in no output from 'ntpq -p' until the daemon has had time to adjust or until the offset is corrected manually. The administrator likely started ntpd with a large clock offset, and the daemon is waiting for the clock to drift naturally or for a manual intervention.

Answer

The NTP servers are unreachable due to a firewall blocking UDP port 123.

Answer

The ntp.conf file is missing the 'pool' directive; instead, 'server' lines are used incorrectly.

Answer

The ntpd service is not enabled to start at boot, so it stopped after the administrator logged out.

Question 7

A Linux administrator is troubleshooting a server that fails to boot with the error 'Give root password for maintenance (or press Control-D to continue)'. The root filesystem is on /dev/sda2, formatted as ext4. The administrator suspects a filesystem inconsistency. The server is in a remote data center and the administrator has console access via IPMI. Which of the following is the safest procedure to repair the filesystem?

Accepted Answer

At the maintenance prompt, run 'mount -o remount,ro /dev/sda2 /' then 'fsck -f /dev/sda2' and then 'reboot'.. Option A is correct because it first remounts the root filesystem as read-only to prevent any writes during the repair, which is essential for a consistent fsck run on an ext4 filesystem. Then it uses 'fsck -f' to force a check even if the filesystem appears clean, followed by a reboot to exit maintenance mode. This is the safest procedure as it avoids the risk of the filesystem being mounted read-write during repair, which could cause further corruption.

Answer

At the maintenance prompt, run 'fsck /dev/sda2' and answer yes to all prompts.

Answer

At the maintenance prompt, run 'fsck -y /dev/sda2' to force repair.

Answer

At the maintenance prompt, run 'fsck -a /dev/sda2' to automatically repair.

Question 8

You are a Linux administrator for a company that runs a web server on a system with limited disk space. The web server logs are stored in /var/log/httpd/access_log and grow quickly. The operations team requires that the most recent logs be available for troubleshooting, but logs older than 7 days must be compressed to save space. You decide to implement log rotation using logrotate. The logrotate configuration file for httpd currently contains:

/var/log/httpd/*.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    sharedscripts
    postrotate
        /bin/systemctl reload httpd 2>/dev/null || true
    endscript
}

After applying this configuration, you notice that log files are being compressed immediately instead of after one rotation. What is the most likely cause and the correct step to fix this?

Accepted Answer

Change the rotation frequency to 'weekly' so that the most recent week's logs remain uncompressed and older logs are compressed.. Option B is correct because the configuration uses 'rotate 7' with 'daily' frequency, meaning seven daily rotations are kept. However, 'delaycompress' delays compression by one rotation, so the most recent rotated log remains uncompressed. With 'daily' rotation, the current log and the most recent rotated log are both uncompressed, which may appear as if compression happens immediately. Changing to 'weekly' ensures that only the most recent week's logs remain uncompressed, matching the requirement that logs older than 7 days are compressed.

Answer

Remove the 'sharedscripts' directive to ensure the postrotate script runs for each log file individually.

Answer

Remove the 'delaycompress' directive to ensure compression occurs at each rotation.

Answer

Add the 'copytruncate' directive to avoid moving the log file, allowing the web server to continue writing to the same file.

Question 9

A Linux administrator is responsible for a server that runs a critical database application. The server uses SysV init and the current runlevel is 3. The administrator needs to schedule a maintenance window for next Sunday at 2:00 AM to apply security patches that require a reboot. The administrator wants to ensure that after the reboot, the system returns to runlevel 3 and the database service (db_service) starts automatically. The administrator also wants to log the maintenance actions to /var/log/maintenance.log. Which of the following is the BEST approach to accomplish these tasks?

Accepted Answer

Edit /etc/inittab to change the initdefault line to 'id:3:initdefault:' and create an init script for db_service with appropriate symlinks in /etc/rc.d/rc3.d/. Schedule the reboot using 'shutdown -r 02:00' and configure syslog to capture messages to /var/log/maintenance.log.. Option B is correct because it properly configures SysV init by setting the default runlevel to 3 in /etc/inittab and ensures the database service starts automatically via init scripts with symlinks in /etc/rc.d/rc3.d/. Scheduling the reboot with 'shutdown -r 02:00' (which uses 24-hour format) and configuring syslog to capture messages to /var/log/maintenance.log provides reliable logging without manual intervention.

Answer

Edit /etc/rc.d/rc.local to start db_service and set runlevel via 'init 3' in the script. Then use 'at 02:00 shutdown -r now' to schedule reboot and redirect output to /var/log/maintenance.log.

Answer

Use 'systemctl set-default runlevel3.target' and 'systemctl enable db_service' then schedule reboot with 'shutdown -r 02:00' and log with 'logger' to /var/log/maintenance.log.

Answer

Use 'telinit 3' and 'service db_service start' then run 'reboot' at 2:00 AM. Log actions by appending to /var/log/maintenance.log manually.

Question 10

You are a system administrator for a small company running a web server on Ubuntu 20.04 LTS. The web server application was installed using apt from the official repositories. Recently, a critical security patch was released for the web server package. You run 'apt update' and 'apt upgrade' but the package is not upgraded. You check the package status with 'apt-cache policy <package>' and see that the installed version is 2.4.41-4ubuntu3.6, and the candidate version is the same. The latest patched version in the repository is 2.4.41-4ubuntu3.7. You verify that the system has internet connectivity and that the repository URLs in /etc/apt/sources.list are correct. What is the most likely reason the upgrade is not being offered?

Accepted Answer

Run 'apt-mark unhold ' and then 'apt upgrade'.. The most likely reason is that the package has been placed on hold using 'apt-mark hold', which prevents it from being upgraded even when a newer version is available in the repository. Running 'apt-mark unhold ' removes this hold, allowing 'apt upgrade' to proceed normally.

Answer

Add the universe repository to sources.list and run 'apt update'.

Answer

Use 'apt dist-upgrade' instead of 'apt upgrade'.

Answer

Run 'apt install <package>' which will force the upgrade.

Question 11

A company runs a critical database server on Linux. The server has a hardware RAID controller with two logical volumes: one for the operating system (LV1) and one for the database data (LV2). The server uses LVM on top of the RAID volumes. Recently, the database performance has degraded. The administrator suspects that the file system on LV2 is heavily fragmented. The server uses the ext4 filesystem. The administrator wants to check the fragmentation level and, if necessary, defragment the filesystem without unmounting it or causing downtime. However, ext4 does not support online defragmentation. What should the administrator do to minimize fragmentation impact while maintaining availability?

Accepted Answer

Use the e4defrag command with the -v option on the mount point to check and defragment files online.. Option D is correct because e4defrag is a tool specifically designed for online defragmentation of ext4 filesystems. It can check fragmentation levels and defragment files without requiring the filesystem to be unmounted, thus avoiding downtime. This directly addresses the administrator's need to minimize fragmentation impact while maintaining availability.

Answer

Create a new filesystem on LV2, copy data back, and symlink the old mount point to the new one.

Answer

Use tune2fs to set the reserved block percentage to 0 and increase the inode size.

Answer

Schedule a maintenance window, unmount LV2, run e2fsck -fn, then run e2fsck -D to defragment.

Question 12

A Linux system administrator is tasked with setting up a new server that will host multiple virtual machines using KVM. The server has 64 GB of RAM and two physical CPUs, each with 8 cores (16 threads). The administrator needs to allocate resources efficiently. The VMs will have varying workloads. The administrator wants to ensure that the host system has enough resources for itself and that VMs can use all available CPU cores. Which approach should the administrator take to configure CPU allocation for the host and VMs?

Accepted Answer

Use CPU pinning to reserve two physical cores for the host and distribute the remaining cores among VMs using host-passthrough mode.. Option C is correct because it reserves two physical cores for the host system to ensure its stability and performance, while distributing the remaining cores among VMs using CPU pinning and host-passthrough mode. This approach allows VMs to access the full CPU feature set and all available cores efficiently, balancing host overhead with VM resource needs in a KVM environment.

Answer

Use QEMU emulation instead of KVM to reduce CPU overhead.

Answer

Pin all physical CPU cores to the VMs using virsh vcpupin, and leave no cores for the host.

Answer

Overcommit CPU resources by assigning 32 vCPUs to each VM, relying on the hypervisor to schedule.

Question 13

You are a Linux administrator for a company that uses a custom RPM-based distribution. The development team has built a new version of the internal tool 'monitor-app' (version 2.0) and placed the RPM package in a local YUM repository located at http://internal.repo/monitor-app-2.0.el7.x86_64.rpm. The repository metadata has been updated using 'createrepo'. On a test server running CentOS 7, you run 'yum update monitor-app' but the system reports 'No packages marked for update'. The currently installed version is 1.0. You verify that the repository is enabled and accessible via 'yum repolist'. What is the most likely cause and the correct course of action?

Accepted Answer

Run 'yum list available | grep monitor' to see if the package is listed with a different name, then install it with the exact name. Option B is correct because the most likely cause is that the package name in the repository differs from the installed package name (e.g., 'monitor-app' vs. 'monitor-app-2.0'). Running 'yum list available | grep monitor' will reveal the exact package name in the repository, allowing you to install it with the correct name. This is a common scenario when package naming conventions change between versions or when the repository uses a different naming scheme than the installed package.

Answer

Download the RPM and install it locally with 'rpm -Uvh monitor-app-2.0.el7.x86_64.rpm'

Answer

Check the version number in the repository using 'yum info monitor-app' and compare with installed version

Answer

Run 'yum clean all' and then 'yum update monitor-app' again

Question 14

A company runs a web server on Linux with two hard disks: /dev/sda (500GB) and /dev/sdb (500GB). The root filesystem is on /dev/sda1, and /var is on /dev/sda2. The administrator wants to add a new disk /dev/sdc (500GB) to be used as additional storage for /var/www/html. The new disk should be configured as an LVM physical volume and added to an existing volume group named 'vg_web'. The volume group currently has 200GB free space from /dev/sdb1. The administrator intends to extend the logical volume 'lv_web' mounted at /var/www/html by 300GB. Which of the following is the correct sequence of commands to achieve this without data loss?

Accepted Answer

pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend -L +300G /dev/vg_web/lv_web; resize2fs /dev/vg_web/lv_web. Option D is correct because it follows the proper sequence: create a physical volume on the partition /dev/sdc1, extend the volume group vg_web with it, then extend the logical volume lv_web by 300GB, and finally resize the filesystem with resize2fs to utilize the new space. Since the logical volume is mounted and contains data, the filesystem must be resized after extending the LV to avoid data loss. The --resizefs flag in option C would also work, but the question asks for the correct sequence without that flag, and option D explicitly includes the separate resize2fs step.

Answer

pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend -L +300G /dev/vg_web/lv_web

Answer

pvcreate /dev/sdc; vgextend vg_web /dev/sdc; lvextend -L +300G /dev/vg_web/lv_web; resize2fs /dev/vg_web/lv_web

Answer

pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend --resizefs -L +300G /dev/vg_web/lv_web

Question 15

A systems administrator is responsible for a Linux server that runs a custom application. The application writes logs to /var/log/app.log and rotates them using logrotate. Recently, the server ran out of disk space because log files were not being rotated. The administrator checks the logrotate configuration file /etc/logrotate.d/app and finds:

/var/log/app.log {
    weekly
    rotate 4
    compress
    missingok
    notifempty
}

The administrator manually runs 'logrotate -f /etc/logrotate.d/app' and the log rotates successfully. However, the next day, the log is not rotated again. The administrator checks the cron job for logrotate and finds that /etc/cron.daily/logrotate exists and runs logrotate /etc/logrotate.conf. The administrator checks /etc/logrotate.conf and sees that it includes /etc/logrotate.d/*. What is the most likely reason the log is not rotating automatically?

Accepted Answer

The 'notifempty' directive is misspelled; it should be 'notifempty'.. Option B is correct because the 'notifempty' directive is misspelled as 'notifempty' (it should be 'notifempty'). Logrotate silently ignores unknown directives, so the misspelled directive has no effect. Without the correct 'notifempty' directive, logrotate will skip rotation if the log file is empty, which can prevent rotation from occurring automatically even though the manual forced rotation with -f succeeds.

Answer

The 'weekly' directive is misspelled.

Answer

The /etc/logrotate.d/ directory is not included by logrotate.conf.

Answer

The 'missingok' directive prevents rotation if the log file is missing, but the file exists.