LPIC-1 GNU and Unix Commands — 20 Questions

Question 1

Refer to the exhibit. An administrator needs to edit /etc/example.conf to change setting1 to 'production' and add a new line 'setting2=value' after the include line. The file must be edited in place without creating a backup. Which command sequence achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

sed -i 's/setting1=default/setting1=production/' /etc/example.conf; sed -i '/^include /a
setting2=value' /etc/example.conf. The first sed command uses the -i flag to edit the file in place without a backup, and the substitution 's/setting1=default/setting1=production/' changes the existing setting. The second sed command uses the 'a' (append) command after the line matching '^include ' to add the new line 'setting2=value' after it, also with -i to avoid creating a backup.

Answer

sed -i 's/setting1=default/setting1=production/' /etc/example.conf; sed -i '/^include /i
setting2=value' /etc/example.conf

Answer

sed -i.bak 's/setting1=default/setting1=production/' /etc/example.conf; sed -i.bak '/^include /a
setting2=value' /etc/example.conf

Answer

sed -i.bak 's/setting1=default/setting1=production/' /etc/example.conf; sed -i.bak '/^include /a
setting2=value' /etc/example.conf

Question 2

You are a Linux administrator for a company that runs a web server on a system with limited disk space. The web server logs are stored in /var/log/httpd/access_log and grow quickly. The operations team requires that the most recent logs be available for troubleshooting, but logs older than 7 days must be compressed to save space. You decide to implement log rotation using logrotate. The logrotate configuration file for httpd currently contains:

/var/log/httpd/*.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    sharedscripts
    postrotate
        /bin/systemctl reload httpd 2>/dev/null || true
    endscript
}

After applying this configuration, you notice that log files are being compressed immediately instead of after one rotation. What is the most likely cause and the correct step to fix this?

Accepted Answer

Change the rotation frequency to 'weekly' so that the most recent week's logs remain uncompressed and older logs are compressed.. The issue is that with daily rotation, the delaycompress directive delays compression by only one rotation (one day). This means that rotated logs are compressed after one day, not after the desired 7 days. To meet the requirement that logs older than 7 days are compressed, the rotation frequency should be changed to weekly. With weekly rotation, delaycompress delays compression by one week, so logs younger than 7 days remain uncompressed and the most recent week's logs are available for troubleshooting.

Answer

Remove the 'sharedscripts' directive to ensure the postrotate script runs for each log file individually.

Answer

Remove the 'delaycompress' directive to ensure compression occurs at each rotation.

Answer

Add the 'copytruncate' directive to avoid moving the log file, allowing the web server to continue writing to the same file.

Question 3

Order the steps to recover a forgotten root password on a Linux system.

Accepted Answer

1. Reboot the system. 2. Interrupt the GRUB bootloader. 3. Add 'init=/bin/bash' to the kernel command line. 4. Boot the system. 5. Remount the root filesystem as read-write. 6. Change the root password using passwd. 7. Reboot the system.. Recovery involves booting into a shell with root access, remounting read-write, and changing the password.

Answer

1. Reboot the system. 2. Interrupt the GRUB bootloader. 3. Add 'init=/bin/bash' to the kernel command line. 4. Boot the system. 5. Change the root password using passwd. 6. Remount the root filesystem as read-write. 7. Reboot the system.

Answer

1. Reboot the system. 2. Boot into single-user mode from GRUB. 3. Remount the root filesystem as read-write. 4. Change the root password using passwd. 5. Reboot the system.

Answer

1. Reboot the system. 2. Edit GRUB to add 'single' to the kernel line. 3. Boot the system. 4. Remount the root filesystem as read-write. 5. Change the root password using passwd. 6. Reboot the system.

Question 4

Match each device file naming pattern to its device type.

Accepted Answer

/dev/sda: SATA/SCSI hard disk. Common Linux device naming conventions: /dev/sdX for SATA/SCSI, /dev/hdX for IDE, /dev/ttySX for serial ports, /dev/srX for optical drives, /dev/nvmeXnY for NVMe. Be cautious not to confuse with floppy (/dev/fdX) or other types.

Answer

/dev/sr0: Floppy disk

Question 5

A systems administrator needs to find all files in /var/log that were modified in the last 24 hours and contain the word 'error'. Which command accomplishes this?

Accepted Answer

find /var/log -mtime 0 -exec grep -l 'error' {} \;. It uses `find` with `-mtime 0` to locate files modified within the last 24 hours, then pipes each found file to `grep -l` to print only filenames containing 'error'. The `-exec` option runs `grep` on each file individually, and `-l` ensures only matching filenames are output, not the matching lines.

Answer

grep -r 'error' /var/log -mtime 0

Answer

find /var/log -mmin 1440 -exec grep 'error' {}

Answer

ls -l /var/log | grep error

Question 6

An administrator wants to change the ownership of a file to user 'jane' and group 'staff'. Which command should be used?

Accepted Answer

chown jane:staff file. The `chown` command with the syntax `chown user:group file` changes both the user and group ownership of a file in a single command. This is the standard POSIX syntax, where a colon separates the user and group names, allowing the administrator to set ownership to user 'jane' and group 'staff' atomically.

Answer

chown jane.staff file

Answer

chgrp jane staff file

Answer

chown jane staff file

Question 7

A developer is troubleshooting a shell script that uses the variable $HOME but it outputs nothing when the script runs. The script is executed with ./script.sh from an interactive shell. What is the most likely cause?

Accepted Answer

The user has no home directory. In an interactive shell, the HOME variable is typically exported by the login process and inherited by child processes. The most likely cause for $HOME being empty is that the user has no home directory defined in the password database (or the directory doesn't exist), which can cause the variable to be empty or unset in some configurations. Options A and B would not cause $HOME to be empty; using sh instead of bash or running with sudo would still provide a HOME value (possibly different) or set it to root's home.

Answer

The script is run with sh instead of bash

Answer

The script is run with sudo

Answer

The HOME variable is not exported

Question 8

An administrator runs the command 'find / -name "*.conf" 2>/dev/null | head -n 10' and notices that the command returns very quickly. Which statement best describes what happened?

Accepted Answer

It scans the entire filesystem but stops after sending the first 10 lines to head due to a broken pipe.. The `find` command starts scanning the entire filesystem from root (`/`), but its output is piped to `head -n 10`, which reads only the first 10 lines and then closes the pipe. When `head` closes the pipe, `find` receives a SIGPIPE signal (broken pipe) and terminates early, so the command returns very quickly without scanning the entire filesystem.

Answer

It lists 10 .conf files only from the current directory because the path is /.

Answer

It lists all .conf files in the filesystem because head only affects output, not find.

Answer

It lists only the first 10 .conf files found in the filesystem.

Question 9

A script uses 'set -e' and then executes 'grep pattern file'. If the pattern is not found, the script exits. Which of the following modifications would prevent the script from exiting while still allowing detection of the pattern's absence?

Accepted Answer

set +e; grep pattern file; exit_code=$?; set -e. It temporarily disables 'set -e' with 'set +e', runs the grep command, captures its exit code in a variable, then re-enables 'set -e'. This allows the script to continue executing after a non-zero exit from grep, while still preserving the exit code for later conditional checks. The other options either fail to preserve the exit code or do not prevent the script from exiting under 'set -e'.

Answer

grep -q pattern file || true

Answer

grep pattern file; exit_code=$?

Answer

grep pattern file | head -1

Question 10

Refer to the exhibit. Which file has a special permission that allows a user to execute the file with the privileges of the file owner?

Accepted Answer

/usr/bin/su. The /usr/bin/su command has the SUID (Set User ID) special permission set (typically mode 4755). This allows any user who executes the file to run it with the effective user ID of the file owner (root), enabling privilege escalation to perform administrative tasks. The SUID bit is represented by an 's' in the owner's execute position when viewed with ls -l.

Answer

/usr/bin/myapp

Answer

/tmp/shared

Answer

None of the above

Question 11

Refer to the exhibit. Which file system is full and what is the likely consequence if the administrator does not take action?

Accepted Answer

/dev/sdb1 is full; applications writing to /var may fail.. The exhibit shows that /dev/sdb1, mounted on /var, has 0% available space (100% used). The /var directory stores variable data such as logs, spool files, and temporary files. If /var fills up, critical services like syslog, cron, or package managers (e.g., apt, yum) cannot write to their log or spool files, causing applications that depend on /var to fail. This is why option D is correct.

Answer

Both are full; system will crash.

Answer

/dev/sda1 is full; system may become unstable.

Answer

Neither is full; available space is sufficient.

Question 12

Which TWO of the following are valid methods to run a shell script named 'script.sh' using the bash shell, assuming the script has execute permission? (Choose two.)

Accepted Answer

./script.sh. Option A, './script.sh', is correct because the './' prefix specifies the current directory explicitly, allowing the kernel to execute the file using its shebang interpreter (e.g., #!/bin/bash) since the script has execute permission. Option E, 'bash script.sh', is correct because it invokes the bash interpreter directly and passes the script file as an argument, which works regardless of the shebang line and does not require execute permission (though it is present here). Option B, 'sh script.sh', is not marked correct because it runs the script with the POSIX sh shell rather than bash, so it does not satisfy the requirement of using the bash shell. Option C, 'script.sh (if in PATH)', is not marked correct because it relies on PATH lookup and does not explicitly use bash, and it is also conditional rather than a guaranteed bash invocation. Option D, 'source script.sh', is not marked correct because sourcing executes the script in the current shell session rather than launching a new bash process, so it is not a method to run it using the bash shell as a separate interpreter.

Answer

sh script.sh

Answer

script.sh (if in PATH)

Answer

source script.sh

Question 13

A system administrator wants to list all files in a directory that have been modified in the last 24 hours. Which command would be most appropriate?

Accepted Answer

find . -mtime -1. The `find` command with `-mtime -1` searches for files whose modification time is less than 1 day ago (i.e., within the last 24 hours). The minus sign before the number means 'less than' that many days, so `-mtime -1` matches files modified in the last 24 hours. This is the standard, precise way to list files by modification time in a directory tree.

Answer

ls -l --time=mod

Answer

find . -mmin 1440

Answer

ls -lt

Question 14

A developer wants to change the ownership of all files in a directory tree to the user 'www-data' and group 'www-data', but only files that are currently owned by user 'nobody'. Which command accomplishes this?

Accepted Answer

chown -R --from=nobody www-data:www-data /path. The `chown -R --from=nobody www-data:www-data /path` command recursively changes ownership of files and directories only if they are currently owned by the user 'nobody'. The `--from` option specifies the current owner (and optionally group) to match before applying the change, and `-R` ensures recursion into subdirectories. This exactly meets the requirement to change ownership only for files owned by 'nobody'.

Answer

chown --from=nobody www-data:www-data /path

Answer

find /path -user nobody -exec chown www-data:www-data {} \;

Answer

chown -R www-data:www-data /path

Question 15

Which TWO commands can be used to display the contents of a compressed text file (e.g., .gz, .bz2) directly to standard output without decompressing to disk?

Accepted Answer

bzcat. Option E (zcat) is correct because it decompresses gzip-compressed files (and typically files compressed with compress) and writes the uncompressed data straight to standard output, leaving no file on disk. Option C (bzcat) is correct because it does the same for bzip2-compressed files, streaming the decompressed contents to stdout. Both commands are the standard tools for viewing .gz and .bz2 content without creating a decompressed copy. Option A (gzcat) is not among the marked answers, and on Linux systems it is usually just an alias for zcat rather than a distinct required command. Option B (zless) is a pager that displays compressed files interactively, not a command that simply dumps contents to standard output. Option D (lzcat) handles LZMA/.xz-style compression, not the .gz or .bz2 formats named in the scenario.

Answer

gzcat

Answer

zless

Answer

lzcat

Question 16

Refer to the exhibit. The system fails to boot with an error 'UUID=e5f6g7h8 not found'. Which is the most likely cause?

Accepted Answer

The initramfs does not contain the necessary filesystem modules.. The error 'UUID=e5f6g7h8 not found' indicates that the kernel, during early boot, cannot locate a device with that UUID. This typically occurs when the initramfs (initial RAM filesystem) lacks the necessary kernel modules (e.g., for the storage controller or filesystem driver) to access the root device. The initramfs is responsible for loading these modules before mounting the real root filesystem; if it is missing or incomplete, the kernel cannot resolve the UUID and fails to boot.

Answer

The fstab entry for /boot is incorrect.

Answer

The root filesystem is corrupted.

Answer

The disk order changed, so /dev/sda2 is no longer the correct device.

Question 17

Refer to the exhibit. Which of the following is true about SSH access to this server?

Accepted Answer

User 'charlie' is denied access regardless of authentication method.. The exhibit shows an SSH configuration with a `DenyUsers charlie` directive, which explicitly blocks user 'charlie' from any SSH access regardless of the authentication method (password, public key, etc.). This directive takes precedence over any other authentication settings, making option A correct.

Answer

User 'alice' can authenticate using a password.

Answer

Password authentication is disabled for all users.

Answer

Root can log in with a password.

Question 18

Refer to the exhibit. What is the expected outcome of the kill command?

Accepted Answer

The parent process reloads its configuration, and child processes continue serving.. The kill command with SIGHUP (signal 1) sent to the parent httpd process (PID 12345) instructs the parent to reload its configuration files and gracefully restart its child worker processes. This is the standard behavior for Apache httpd and many other daemons: the parent process rereads configuration, spawns new children, and terminates old ones without dropping existing connections.

Answer

Only the parent process (PID 12345) is terminated.

Answer

Only child processes are restarted.

Answer

All httpd processes are terminated immediately.

Question 19

Refer to the exhibit. What type of traffic is being captured?

Accepted Answer

A successful TCP three-way handshake followed by a data transfer.. The exhibit shows a TCP three-way handshake (SYN, SYN-ACK, ACK) followed by a data transfer segment (PSH, ACK). This sequence indicates a successful connection establishment and subsequent data exchange, which matches the description of a successful TCP three-way handshake followed by data transfer.

Answer

An incomplete TCP handshake.

Answer

An FTP session.

Answer

A DNS query and response.

Question 20

A junior administrator is asked to create a compressed archive of the /home/projects directory. The archive must preserve file permissions and ownership, and must be named projects.tar.bz2. Which command should the administrator use?

Accepted Answer

tar -cjf projects.tar.bz2 /home/projects. Creating a compressed tar archive requires the -c (create) option, the appropriate compression filter (-j for bzip2), and -f to specify the output filename. The command tar -cjf projects.tar.bz2 /home/projects correctly builds a bzip2-compressed archive of the specified directory while preserving metadata such as permissions and ownership.

Answer

tar -cjvf projects.tar.bz2 /home/projects

Answer

tar -xzf projects.tar.bz2 /home/projects

Answer

gzip -c /home/projects > projects.tar.bz2