LPIC-1 Hard Questions — 25 Difficult Questions

Question 1

The system is unable to mount a filesystem that should be identified by UUID 1234-5678. The administrator checks /etc/fstab and finds the entry: UUID=1234-5678 /data ext4 defaults 0 2. What is the most likely cause of the mount failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The symlink for UUID 1234-5678 is broken.. The most likely cause is that the symbolic link for UUID 1234-5678 is broken. In Linux, UUID-based mounts in /etc/fstab rely on symlinks in /dev/disk/by-uuid/ that point to the actual block device. If the symlink is missing or points to a non-existent device (e.g., after a disk reorder or hardware change), the system cannot resolve the UUID to a device, causing the mount to fail even if the filesystem itself is intact.

Answer

The /data mount point does not exist.

Answer

The device /dev/sda1 is not formatted with ext4.

Answer

The UUID in the fstab entry is incorrect.

Question 2

A Linux system's hostname resolution does not consult /etc/hosts before querying DNS. Which file controls the order of name resolution services?

Accepted Answer

/etc/nsswitch.conf. The /etc/nsswitch.conf file controls the order of name resolution services by defining the 'hosts' database entry, which specifies the sources (e.g., files, dns) and their lookup order. If the entry is 'hosts: dns files', the system queries DNS before /etc/hosts, bypassing the local file. This file is part of the GNU C Library's Name Service Switch (NSS) framework, which governs all system databases like passwd, group, and hosts.

Answer

/etc/host.conf

Answer

/etc/resolv.conf

Answer

/etc/dnsmasq.conf

Question 3

A system reports 'No space left on device' but 'df -h' shows only 60% usage. Which command would help identify the cause?

Accepted Answer

df -i. The 'No space left on device' error can also occur when the filesystem runs out of inodes, even if disk space is not full. The command 'df -i' shows inode usage; if inodes are exhausted, no new files can be created, causing the error. 'lsof +L1' lists deleted open files, which consume disk blocks but not inodes, so it is not the right tool when disk space is only 60% used.

Answer

stat /

Answer

lsof +L1

Answer

du -sh /

Question 4

Which THREE statements are true about the sed command?

Accepted Answer

sed -i 's/foo/bar/g' file.txt replaces all occurrences of foo with bar in the file.. The `-i` flag in sed enables in-place editing, directly modifying the file rather than just outputting changes to stdout. The substitution command `'s/foo/bar/g'` replaces all occurrences of `foo` with `bar` globally on each line, and with `-i`, the changes are written back to the file.

Answer

sed 's/old/new/g' file.txt permanently changes the file.

Answer

sed uses extended regular expressions by default.

Question 5

A system administrator is troubleshooting a server where the /var partition is full, causing services to fail. The administrator deletes old log files in /var/log, but the available space does not increase. Which step should be taken next?

Accepted Answer

Use 'lsof /var/log' to find processes holding deleted file handles, then restart those processes.. When a file is deleted while a process still holds an open file descriptor to it, the file's data blocks are not freed until that process releases the handle. The `lsof /var/log` command identifies such processes, and restarting them forces the kernel to release the deleted inodes, thereby reclaiming the disk space. This is why option C is the correct next step.

Answer

Run 'sync; echo 3 > /proc/sys/vm/drop_caches' to clear cache.

Answer

Remount the /var partition with the 'noatime' option.

Answer

Run 'df -i' to check inode usage.

Question 6

A systems administrator maintains a Linux web server running Apache HTTP Server (version 2.4) with three virtual hosts. The server logs are stored in /var/log/httpd/ and are rotated using logrotate, which is configured with the default settings that came with the Apache package. The administrator has noticed that after the nightly log rotation, the main access log file (access_log) is empty, while the rotated log files (e.g., access_log.1, access_log.2) contain the previous day's data. Furthermore, new HTTP requests are being logged into the most recent rotated file (access_log.1) instead of the current access_log file. The administrator has verified that the logrotate cron job runs successfully, and that the log files are owned by the root user with read/write permissions for the root group. No errors appear in the system logs. The Apache service continues to run and serve web pages. Which of the following actions should the administrator take to ensure that Apache writes new log entries to the current access_log file after rotation?

Accepted Answer

Add a postrotate script to the logrotate configuration that sends a USR1 or HUP signal to the Apache process to cause it to reopen the log files.. The issue is that after logrotate moves the current access_log to access_log.1, Apache continues writing to the old file descriptor (now pointing to access_log.1) because it never reopened the log file. Sending a USR1 or HUP signal to Apache causes it to close and reopen its log files, creating a new access_log and writing new entries there. This is the standard method for log rotation with Apache and other daemons that keep file handles open.

Answer

Modify the Apache configuration to set the 'RotateLogs' directive and restart the service.

Answer

Change the logrotate frequency to 'weekly' so that the log is not rotated as often.

Answer

Set the 'copytruncate' directive in the logrotate configuration to copy the log file and truncate the original, so Apache can continue writing without interruption.

Question 7

A company's server administrator needs to replace an existing DNS server (192.168.1.10) with a new one (192.168.1.20). Which file must be updated on all DHCP clients to ensure they use the new DNS server?

Accepted Answer

/etc/dhcp/dhcpd.conf. The DHCP server configuration file /etc/dhcp/dhcpd.conf contains the 'option domain-name-servers' directive that specifies which DNS servers are handed out to DHCP clients. When a client renews its lease, it receives the new DNS server IP (192.168.1.20) from the DHCP server, updating the client's /etc/resolv.conf automatically. This is the proper way to centrally manage DNS server assignments across all DHCP clients.

Answer

/etc/resolv.conf

Answer

/etc/nsswitch.conf

Answer

/etc/hosts

Question 8

Which TWO commands can be used to display the current firewall rules in a system using nftables? (Choose two.)

Accepted Answer

nft list ruleset. `nft list ruleset` is the primary command in nftables to display the entire ruleset, including all tables, chains, and rules, regardless of the address family. Option D is also correct because `nft list table inet filter` specifically displays the rules within the 'filter' table of the 'inet' family, which is a valid way to show a subset of the firewall rules. Both commands rely on the nftables framework, which is the modern replacement for iptables on Linux.

Answer

systemctl status nftables

Answer

iptables -L -n

Answer

firewall-cmd --list-all

Question 9

A database server on a Linux system is configured to listen on TCP port 3306. The administrator wants to restrict access to the database server to only the local network (192.168.1.0/24) using iptables. Which of the following iptables rules achieves this?

Accepted Answer

iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -j ACCEPT. It adds an INPUT chain rule that accepts TCP traffic destined for port 3306 only when the source address is within the 192.168.1.0/24 subnet. This effectively restricts incoming database connections to the local network, while all other sources are implicitly dropped by the default INPUT policy or subsequent rules.

Answer

iptables -A INPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j DROP

Answer

iptables -A OUTPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j ACCEPT

Answer

iptables -A OUTPUT -p tcp --sport 3306 -s 192.168.1.0/24 -j ACCEPT

Question 10

A system administrator is responsible for a production Debian 10 (buster) server that hosts a critical web application. The application requires the package 'libssl1.1' version 1.1.1 or higher, but the official Debian 10 repository only provides version 1.1.0. The administrator has already attempted to install the newer version from Debian 11 (bullseye) sources, but this caused dependency conflicts with the existing libc6 version. The server cannot be upgraded to Debian 11 due to application compatibility. The administrator needs to resolve this situation without breaking the existing system or introducing unofficial packages. Which of the following is the most appropriate course of action?

Accepted Answer

Add the Debian Backports repository for buster and install libssl1.1 from there.. Debian Backports provides newer versions of select packages (like libssl1.1) that are recompiled against the stable release's libraries (e.g., libc6 from buster), avoiding dependency conflicts. This allows the administrator to obtain libssl1.1 version 1.1.1 or higher without upgrading the entire system or introducing unofficial packages, maintaining system stability and security.

Answer

Upgrade the entire system to Debian 11 using a rolling upgrade.

Answer

Use dpkg --force-depends to force the installation of libssl1.1 from Debian 11.

Answer

Download the libssl1.1 source package from Debian 11 and compile it on the buster system with custom flags.

Question 11

A mail server using Postfix is rejecting emails from a partner domain. The administrator checks the maillog and sees 'relay access denied'. Which Postfix configuration parameter is most likely misconfigured?

Accepted Answer

mynetworks. (mynetworks) is correct because it defines which client IP addresses are allowed to relay mail through the server. The 'relay access denied' error indicates that the partner domain's mail server is not in the trusted network list. Option A (mydestination) specifies local destination domains, not relay permissions. Option B (inet_interfaces) controls listening interfaces. Option C (relayhost) sets the next-hop relay for outbound mail. Therefore, mynetworks is the likely misconfiguration.

Answer

mydestination

Answer

inet_interfaces

Answer

relayhost

Question 12

Refer to the exhibit. A user tries to execute a script on a mounted filesystem but gets a permission denied error. The script has execute permissions. What is the most likely cause?

Accepted Answer

The filesystem is mounted with the 'noexec' option.. The 'noexec' mount option prevents execution of any binary or script on the filesystem, regardless of file permissions. Even if the script has execute permissions set, the kernel will refuse to execute it when the filesystem is mounted with 'noexec'. This is a common security measure on filesystems like /tmp or /home to prevent unauthorized code execution.

Answer

The script is not executable for the user.

Answer

The user does not have read permission on the script.

Answer

The filesystem is full.

Question 13

Refer to the exhibit. Why does the cron job fail?

Accepted Answer

The script is not executable.. C is correct because cron jobs require the script to be executable (i.e., have the execute permission bit set). If the script is not executable, cron will fail to run it even if the shebang line and PATH are correct. The error typically appears in the cron log or as a silent failure.

Answer

The cron job lacks the PATH environment variable.

Answer

The script is owned by root, but the cron job runs as a different user.

Answer

The script lacks a shebang line.

Question 14

In the /etc/shadow file, a user's password hash begins with '$6$'. What hash algorithm does this prefix indicate?

Accepted Answer

SHA-512. The prefix '$6$' in the /etc/shadow file indicates that the password hash was generated using the SHA-512 (Secure Hash Algorithm 512-bit) algorithm. This is defined in the crypt(3) function's modular crypt format, where $1$ is MD5, $5$ is SHA-256, and $6$ is SHA-512. SHA-512 is the strongest of the commonly used hash algorithms in Linux password hashing, providing a 512-bit digest.

Answer

SHA-256

Answer

MD5

Answer

Blowfish

Question 15

Refer to the exhibit. An admin attempts to execute a shell script located in /tmp but gets 'Permission denied'. Which mount option is most likely causing this?

Accepted Answer

noexec. The 'noexec' mount option prevents execution of any binary or script directly from the filesystem, regardless of file permissions. Since the script is in /tmp and the admin gets 'Permission denied' despite correct execute bits, the /tmp partition is likely mounted with noexec, which is a common security hardening practice.

Answer

relatime

Answer

nodev

Answer

nosuid

Question 16

Which TWO of the following are valid methods to run a shell script named 'script.sh' using the bash shell, assuming the script has execute permission? (Choose two.)

Accepted Answer

./script.sh. './script.sh' explicitly invokes the script using the current shell's shebang interpreter (e.g., #!/bin/bash) and requires execute permission. Option E is correct because 'bash script.sh' runs the script as an argument to the bash interpreter, which reads and executes the file line by line, also requiring execute permission.

Answer

sh script.sh

Answer

script.sh (if in PATH)

Answer

source script.sh

Question 17

Which THREE files are used by CUPS to manage printer queues? (Choose THREE.)

Accepted Answer

/etc/cups/classes.conf. CUPS uses /etc/cups/printers.conf to define printer queues and their associated options, /etc/cups/classes.conf to manage printer classes (groups of queues), and /etc/cups/cupsd.conf as the main daemon configuration file that controls access, logging, and other server settings. These three files are directly read by the CUPS daemon to manage and serve printer queues.

Answer

/etc/cups/lpoptions

Answer

/etc/cups/ppd/

Question 18

A system administrator is responsible for a Linux server running a critical application. The server recently experienced an unplanned power outage. Upon rebooting, the system fails to reach the default target and drops into an emergency shell. The administrator notices that the root filesystem (/) is mounted read-only. The /etc/fstab file contains the following lines:

UUID=abc123 / ext4 errors=remount-ro 0 1
UUID=def456 /home ext4 defaults 0 2
UUID=ghi789 none swap sw 0 0

The administrator suspects that the /home filesystem has a corrupt superblock and is causing the boot failure. The administrator needs to check and repair the /home filesystem without causing data loss. Which of the following is the correct course of action?

Accepted Answer

Boot from a live USB, run 'fsck /dev/sdb1' on the unmounted filesystem, then reboot.. The /home filesystem is suspected to have a corrupt superblock, and running fsck on an unmounted filesystem from a live USB is the safest way to check and repair it without risking further damage. The emergency shell mounts the root filesystem read-only, and /home cannot be reliably checked while mounted or without proper access to its device node. Booting from a live USB ensures the filesystem is not in use, allowing fsck to safely repair the superblock or use an alternate superblock if needed.

Answer

Reinstall the system from backup because the superblock corruption is fatal.

Answer

Run 'fsck /dev/sdb1' from the emergency shell after remounting /home read-write.

Answer

Run 'fsck -y /dev/sdb1' from the emergency shell, but first run 'mount -o remount,rw /home' to make the filesystem writable.

Question 19

Refer to the exhibit. The /var partition is nearly full. Which of the following is the most appropriate first step to free up space?

Accepted Answer

Delete old log files in /var/log and clear package cache.. The most common cause of a full /var partition is accumulated log files in /var/log and cached package data. Deleting old logs (e.g., via logrotate or manual cleanup) and clearing the package manager cache (e.g., apt-get clean or yum clean all) directly reclaims space without requiring disk resizing or additional hardware. This is the safest and fastest first step before considering more invasive actions.

Answer

Move some files from /var to / and create a symbolic link.

Answer

Increase the size of /dev/sdb2 using resize2fs.

Answer

Add a new disk and mount it to /var.

Question 20

A script uses 'set -e' and then executes 'grep pattern file'. If the pattern is not found, the script exits. Which of the following modifications would prevent the script from exiting while still allowing detection of the pattern's absence?

Accepted Answer

set +e; grep pattern file; exit_code=$?; set -e. It temporarily disables 'set -e' with 'set +e', runs the grep command, captures its exit code in a variable, then re-enables 'set -e'. This allows the script to continue executing after a non-zero exit from grep, while still preserving the exit code for later conditional checks. The other options either fail to preserve the exit code or do not prevent the script from exiting under 'set -e'.

Answer

grep -q pattern file || true

Answer

grep pattern file; exit_code=$?

Answer

grep pattern file | head -1