LPIC-1 Administrative Tasks — 25 Questions

Question 1

A user reports that a cron job is not executing. The cron job is defined in /etc/crontab. The administrator checks the system logs and finds no errors. Which command should the administrator use to verify that the cron daemon is running?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

pgrep cron. `pgrep cron` searches the process table for processes named 'cron' and returns the PID(s) if running. This is a quick, reliable way to verify the cron daemon is active without parsing full process lists or relying on systemd-specific commands.

Answer

systemctl status cron

Answer

crontab -l

Answer

ps aux | grep cron

Question 2

A system administrator wants to schedule a script to run every Monday at 3:00 AM, but only if the system clock is set to local time (not UTC). Which crontab entry should be used?

Accepted Answer

0 3 * * 1 /path/to/script. The crontab format is 'minute hour day-of-month month day-of-week command'. To run at 3:00 AM Monday, the minute field is 0, the hour field is 3 (using 24-hour time), and the day-of-week field is 1 (Monday). The cron daemon does not care about UTC vs local time; it uses the system's configured timezone, so no special flag is needed.

Answer

3 0 * * 1 /path/to/script

Answer

0 15 * * 1 /path/to/script

Answer

0 3 * * 0 /path/to/script

Question 3

A Linux system fails to boot with the error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

The kernel lacks the necessary driver for the storage controller. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot find or access the root filesystem. This typically occurs when the kernel lacks the necessary driver (module) for the storage controller (e.g., SATA, SCSI, NVMe) that the root device is connected to. Without the driver, the kernel cannot communicate with the storage hardware, resulting in the unknown-block(0,0) identifier.

Answer

The root filesystem has a corrupted superblock

Answer

The initrd file is missing or corrupted

Answer

The bootloader configuration points to the wrong partition

Question 4

Which THREE of the following statements are true about the /etc/shadow file?

Accepted Answer

It can contain password expiration information. Option B is correct because /etc/shadow stores password aging data in fields 3 through 8 (last change, min, max, warn, inactive, and expire), which control password expiration. Option C is correct because /etc/shadow is normally owned by root:shadow with permissions 000 or 640, so only root (and members of the shadow group where applicable) can read it. Option D is correct because the second colon-separated field holds the encrypted password hash (for example, a $6$ SHA-512 crypt string), or a locked marker such as ! or * when no password is set. Option A is not correct as stated because it describes the second field of /etc/passwd being replaced by 'x' to redirect lookups to /etc/shadow, not the content of /etc/shadow itself. Option E is not correct because /etc/shadow is deliberately not world-readable; making it world-readable would expose password hashes to offline cracking.

Answer

It contains the encrypted passwords in the second field, replacing the 'x' in /etc/passwd

Answer

It is world-readable to allow any user to verify passwords

Question 5

Match each Linux signal to its default action.

Accepted Answer

SIGINT: Terminate the process. Common Linux signals: SIGINT, SIGTERM, and SIGKILL terminate processes; SIGSTOP and SIGTSTP stop processes; SIGQUIT terminates with a core dump.

Answer

SIGTERM: Stop the process

Answer

SIGKILL: Core dump

Answer

SIGTSTP: Terminate the process

Question 6

A system administrator needs to ensure a custom script runs every time the system boots. Where should the script be placed for execution during the boot process on a standard Linux system?

Accepted Answer

/etc/rc.local. /etc/rc.local is a legacy system initialization script that is executed at the end of the boot process on many Linux distributions using SysV init or systemd (with a compatibility unit). Placing a custom script inside /etc/rc.local ensures it runs once per boot, after all other init scripts have completed, making it a straightforward method for executing custom commands or scripts at system startup.

Answer

/etc/cron.d/

Answer

/etc/init.d/

Answer

/etc/cron.hourly/

Question 7

Which two commands can be used to display the amount of free and used memory in the system?

Accepted Answer

free. Option A, `free`, is correct because it directly reads /proc/meminfo and prints total, used, free, shared, buffer/cache, and available memory in kibibytes (or with -h/-m/-g for human-readable, megabytes, or gigabytes). Option D, `top`, is correct because its header includes the Mem and Swap lines showing total, free, used, and buff/cache memory, refreshed interactively along with per-process statistics. Option B, `uptime`, only shows the current time, system uptime, number of logged-in users, and 1/5/15-minute load averages, not memory figures. Option C, `ps`, reports process status (PID, TTY, CPU, memory percentage per process) but does not summarize total free/used system memory. Option E, `vmstat`, reports virtual memory statistics such as processes, swap, I/O, and CPU activity, but its memory columns (swpd, free, buff, cache) are not the standard free/used memory summary the question asks for.

Answer

uptime

Answer

ps

Answer

vmstat

Question 8

Refer to the exhibit. During the next boot, which filesystem will be checked first by fsck?

Accepted Answer

/dev/sda1. The order in which fsck checks filesystems during boot is determined by the pass number (field 6) in /etc/fstab. The filesystem with the lowest pass number is checked first. In the exhibit, /dev/sda1 has a pass number of 1, while /dev/sda2 and /dev/sda3 have pass numbers of 2, so /dev/sda1 will be checked first.

Answer

All checked in parallel

Answer

/dev/sda2

Answer

/dev/sda3

Question 9

Refer to the exhibit. The administrator restarts the sshd service. What is the new main PID after restart?

Accepted Answer

It will be a new, different PID.. When the sshd service is restarted, the old process is terminated and a new process is spawned, resulting in a new main PID. The PID is a unique identifier assigned by the kernel to each process at creation time, and it is never reused immediately after termination. Therefore, the new main PID will be different from the previous one.

Answer

It remains the same.

Answer

1235

Answer

1234

Question 10

A user can successfully ping a web server but cannot access the website via a browser. Which is the most likely cause?

Accepted Answer

Web service (e.g., Apache) not running. B is correct because the user can successfully ping the web server, confirming that the server is reachable at the network layer (ICMP). However, the inability to access the website via a browser indicates that the application layer service handling HTTP/HTTPS requests is not running. If the web service (e.g., Apache, Nginx) is stopped or crashed, the server will not respond to TCP port 80 or 443, even though basic connectivity exists.

Answer

Incorrect subnet mask

Answer

Firewall blocking HTTP ports

Answer

DNS resolution failure

Question 11

Which command schedules a job to run once at 2:30 PM today?

Accepted Answer

at 14:30. The `at` command schedules a one-time job for a specified time. The correct syntax uses a colon (:) to separate hours and minutes, as in `at 14:30`, which schedules the job for 2:30 PM today. Option D is correct because it follows the standard `at` time format.

Answer

crontab -e

Answer

batch

Answer

at 14.30

Question 12

Which THREE signals are commonly used to terminate a process with the kill command?

Accepted Answer

SIGKILL. SIGKILL (B) is correct because it unconditionally terminates a process at the kernel level and cannot be caught, blocked, or ignored, making it the definitive kill signal. SIGTERM (E) is correct because it is the default signal sent by kill and requests a graceful, catchable termination so the process can clean up before exiting. SIGHUP (D) is correct because it is commonly used to terminate or restart processes, especially daemons, and by default terminates a process that has not installed a handler. SIGSTOP (A) is incorrect because it merely suspends (stops) a process for later resumption rather than terminating it. SIGINT (C) is incorrect here because it is the interrupt signal typically generated by Ctrl+C and, while it often ends a foreground process, it is not one of the three signals conventionally grouped as termination signals in this context.

Answer

SIGSTOP

Answer

SIGINT

Question 13

A user reports that a file cannot be saved due to 'No space left on device'. Which command should the administrator use to verify disk usage?

Accepted Answer

df -h. The 'df -h' command displays disk space usage in human-readable format (e.g., GB, MB) for all mounted filesystems. When a user encounters 'No space left on device', the most direct verification is to check available disk space with 'df -h', which shows used and available blocks. Option D is correct because it specifically addresses the space shortage indicated by the error.

Answer

du -sh /

Answer

fdisk -l

Answer

df -i

Question 14

Which TWO commands can be used to view all running processes on a Linux system? (Choose TWO.)

Accepted Answer

top. Option D, top, is correct because it launches an interactive process viewer that continuously displays all running processes along with CPU, memory, and load information, refreshed in real time. Option E, ps aux, is correct because it produces a static snapshot listing every process on the system (the a shows processes from all users, u gives user-oriented format, and x includes processes without a controlling terminal). Option A, jobs, only lists jobs in the current shell session, not all system processes. Option B, ls /proc, merely lists the numeric PID directories under /proc and does not show process details or a proper process listing. Option C, pstree, displays processes as a hierarchical tree, which is a different view and not the standard full listing asked for here.

Answer

jobs

Answer

ls /proc

Answer

pstree

Question 15

Which command displays all error messages from the systemd journal since the last boot?

Accepted Answer

journalctl -b -p err. `journalctl -b -p err` filters the systemd journal to show only messages with a priority level of 'err' (error) or higher since the last boot. The `-b` flag restricts output to the current boot, and `-p err` selects messages at the 'err' level and above (including 'crit', 'alert', and 'emerg'), which are all error-related. This matches the requirement to display 'all error messages' from the systemd journal since the last boot.

Answer

journalctl -b -p warning

Answer

journalctl -b -p crit

Answer

journalctl -b -p info

Question 16

Which THREE commands are used to manage systemd services? (Choose THREE.)

Accepted Answer

systemctl status. Options A, B, and C are correct because systemctl is the primary command-line utility for managing systemd services: 'systemctl status' queries the current runtime state of a unit (active/inactive, enabled/disabled, recent log lines), 'systemctl start' activates a unit immediately at runtime, and 'systemctl enable' creates the symlinks needed to start the unit automatically at boot. These three subcommands cover inspection, runtime control, and boot-time configuration of systemd units, which is exactly what the question asks for. Option D, 'chkconfig --add', is a SysVinit/legacy Red Hat tool for registering init scripts in runlevels and does not manage systemd units. Option E, 'service start', is the legacy SysVinit wrapper (which on systemd systems merely redirects to systemctl) and is not itself a systemd management command with the syntax shown.

Answer

chkconfig --add

Answer

service start

Question 17

Refer to the exhibit. The root partition is at 80% usage. Which action would reduce usage the most?

Accepted Answer

Delete unused files in /tmp. The /tmp directory typically contains temporary files that can be safely deleted without affecting system operation. Since the root partition is at 80% usage, clearing out /tmp can reclaim significant space, especially on systems where applications or users have left large temporary files. The 'rm -rf /tmp/*' command or using tmpwatch/systemd-tmpfiles can free up space immediately.

Answer

Increase the size of /dev/sda1

Answer

Run 'du -sh /home' to find large files

Answer

Move some files from /home to /

Question 18

An administrator wants to enforce a password history that prevents using the last 5 passwords. Which directive should be added to /etc/pam.d/system-auth?

Accepted Answer

password required pam_pwhistory.so remember=5. The `required` control flag ensures that the `pam_pwhistory.so` module must succeed for the password change to proceed, and `remember=5` enforces that the last 5 passwords cannot be reused. This is the standard way to enforce password history in PAM (Pluggable Authentication Modules) on Linux systems.

Answer

password optional pam_pwhistory.so remember=5

Answer

password sufficient pam_pwhistory.so remember=5

Answer

password requisite pam_pwhistory.so remember=5

Question 19

To prevent the 'nouveau' kernel module from loading at boot, which configuration file should be edited?

Accepted Answer

/etc/modprobe.d/nouveau.conf with 'blacklist nouveau'. Both A and D are valid because any .conf file under /etc/modprobe.d/ can contain 'blacklist nouveau' to prevent the module from loading. Option B is incorrect because /etc/modules-load.d/ is intended for loading modules, not blacklisting. Option C is incorrect because option B is not valid.

Answer

/etc/modules-load.d/nouveau.conf

Answer

Both A and B are valid

Question 20

Which THREE steps are necessary to configure a static IP address using ifcfg files on a RHEL-based system? (Choose THREE.)

Accepted Answer

Edit /etc/sysconfig/network-scripts/ifcfg-eth0. Option A is correct because on RHEL-based systems the persistent per-interface configuration is stored in /etc/sysconfig/network-scripts/ifcfg-<interface>, so editing /etc/sysconfig/network-scripts/ifcfg-eth0 is the required file-based step. Option B is correct because ONBOOT=yes ensures the interface is brought up automatically at boot, which is part of a complete static ifcfg configuration. Option E is correct because BOOTPROTO=static (or none) tells the network scripts not to use DHCP and to apply the manually specified IPADDR, NETMASK/PREFIX, and GATEWAY values. Option C is not required because restarting the network service is an activation action, not a configuration step, and modern RHEL uses NetworkManager (nmcli con up or systemctl restart NetworkManager) rather than the legacy network service. Option D is not required because 'ip addr add' applies a runtime address directly to the kernel and does not create or modify the persistent ifcfg file, so it is not part of configuring a static IP via ifcfg files.

Answer

Run 'systemctl restart network'

Answer

Run 'ip addr add 192.168.1.10/24 dev eth0'