LPIC-1 Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. A system administrator checks the integrity of the passwd package on a CentOS 7 system using rpm -V. Based on the output, what is the most likely cause of the 'missing' line?

Accepted Answer

The file /etc/security/passwd was deleted from the filesystem.. The 'missing' line in the rpm -V output indicates that the file /etc/security/passwd is not present on the filesystem. Since rpm -V verifies file attributes and existence against the RPM database, a missing file means it was deleted after installation. Option D correctly identifies this as the most likely cause.

Answer

The package was updated to a newer version that no longer includes this file.

Answer

The file /etc/security/passwd was modified after installation.

Answer

The package was not installed completely.

Question 2

Which THREE commands can be used to display the UUID of a filesystem on a Linux system without superuser privileges? (Choose three.)

Accepted Answer

file -s /dev/sda1. The `file -s /dev/sda1` command reads the superblock of the specified block device and displays filesystem type information, which typically includes the UUID for filesystems like ext4, XFS, or Btrfs. This works without superuser privileges because it only performs a read-only inspection of the device file's metadata, not requiring any write access or privileged system calls.

Answer

dumpe2fs -h

Answer

findfs UUID=...

Question 3

Which TWO commands can be used to count the number of lines in a file named 'data.txt'?

Accepted Answer

wc -l data.txt. Option A is correct because `wc -l` specifically counts the number of newline characters in the file, which corresponds to the number of lines. Option B is correct because `awk 'END{print NR}'` processes the file line by line, and the built-in variable `NR` holds the total number of records (lines) processed when the END block is executed, thus outputting the line count.

Answer

cat data.txt | wc -c

Answer

grep -c '.*' data.txt

Answer

sed -n '$=' data.txt

Question 4

Refer to the exhibit. An administrator runs 'ntpq -p' and sees the output shown. What is the most likely cause of the '16' stratum and '0.000' delay/offset?

Accepted Answer

The NTP daemon has recently started and has not yet synchronized.. The '16' stratum and '0.000' delay/offset values in the 'ntpq -p' output indicate that the NTP daemon has not yet synchronized with any time source. When ntpd starts, it initially sets the stratum to 16 (unsynchronized) and shows zero values for delay and offset until it completes the synchronization process. This is a normal transient state that resolves once the daemon successfully contacts and synchronizes with an NTP server.

Answer

The NTP service is not running.

Answer

The firewall is blocking UDP port 123.

Answer

The restrict lines are blocking all NTP queries.

Question 5

An administrator needs to ensure that a specific kernel module is loaded automatically at boot. Which file should be used to permanently load the module?

Accepted Answer

/etc/modules. Option C is correct because on modern Linux systems using a standard init system, the file /etc/modules (or /etc/modules-load.d/*.conf on systemd-based distributions) is read at boot to load specified kernel modules automatically. This file lists module names one per line, and the kernel's module loading mechanism processes it early in the boot sequence to ensure the module is available before services that depend on it start.

Answer

/etc/modprobe.d/modules.conf

Answer

/etc/sysconfig/modules

Answer

/etc/conf.modules

Question 6

A server has two disk drives: /dev/sda (SSD) and /dev/sdb (HDD). The administrator wants to place frequently accessed files on the SSD for performance. Which approach best achieves this using Linux filesystem features?

Accepted Answer

Create separate LVM logical volumes on each disk and mount them at different mount points.. Option A is correct because LVM allows the administrator to create separate logical volumes on each physical disk (/dev/sda and /dev/sdb) and mount them at distinct mount points. By placing frequently accessed files on the SSD logical volume and less critical data on the HDD logical volume, the administrator can directly control which files benefit from the SSD's faster performance without mixing data or requiring complex overlays.

Answer

Configure RAID 0 across both disks to combine speed.

Answer

Use symbolic links to redirect file access to the SSD.

Answer

Use a union mount to overlay the SSD on top of the HDD.

Question 7

An organization uses a custom YUM repository. After adding a new RPM package to the repository, clients running 'yum update' do not see the new package. The repository metadata was regenerated using 'createrepo'. What is the most likely reason the clients are not seeing the update?

Accepted Answer

Clients have cached metadata and need to run 'yum clean all' or wait for cache expiration. Option A is correct because YUM clients cache repository metadata locally to improve performance. When a new package is added to a repository and 'createrepo' regenerates the metadata, clients will not see the update until they refresh their cached metadata. Running 'yum clean all' removes the cached metadata and forces a fresh download, or the cache will expire based on the 'metadata_expire' setting in the repo configuration (default is 6 hours).

Answer

The 'gpgcheck=1' option in the repo file prevents metadata download

Answer

The repository metadata was not signed with a GPG key

Answer

The RPM package version number is lower than the currently installed version

Question 8

During boot, a Linux system displays 'Kernel panic – not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

The kernel lacks the necessary driver for the storage controller.. The error 'unknown-block(0,0)' indicates the kernel cannot find a device to mount as root. This typically occurs when the kernel lacks the driver for the storage controller (e.g., SATA, NVMe, SCSI host adapter) needed to access the root filesystem. Without the driver, the kernel cannot enumerate the block device, even if the root= parameter is correct and the filesystem is intact.

Answer

The root filesystem is corrupted and needs fsck.

Answer

The root= parameter in the boot loader points to a non-existent device.

Answer

The initrd is missing or corrupted.

Question 9

Refer to the exhibit. Why does the cron job fail?

Accepted Answer

The script is not executable.. C is correct because cron jobs require the script to be executable (i.e., have the execute permission bit set). If the script is not executable, cron will fail to run it even if the shebang line and PATH are correct. The error typically appears in the cron log or as a silent failure.

Answer

The cron job lacks the PATH environment variable.

Answer

The script is owned by root, but the cron job runs as a different user.

Answer

The script lacks a shebang line.

Question 10

A developer needs to ensure a bash script exits immediately if any command fails, and also prints each command before executing it. Which set of shell options should be used at the beginning of the script?

Accepted Answer

set -ex. Option A is correct because `set -ex` combines two essential shell options: `-e` (errexit) causes the script to exit immediately if any command returns a non-zero exit status, and `-x` (xtrace) prints each command (after expansion) to stderr before executing it. This is the standard way to achieve both behaviors in a single line, as required by the question.

Answer

set -e

Answer

set -vx

Answer

set -ux

Question 11

Which THREE statements are true about the sed command?

Accepted Answer

sed -i 's/foo/bar/g' file.txt replaces all occurrences of foo with bar in the file.. Option B is correct because the `-i` flag in sed enables in-place editing, directly modifying the file rather than just outputting changes to stdout. The substitution command `'s/foo/bar/g'` replaces all occurrences of `foo` with `bar` globally on each line, and with `-i`, the changes are written back to the file.

Answer

sed 's/old/new/g' file.txt permanently changes the file.

Answer

sed uses extended regular expressions by default.

Question 12

A Linux system fails to boot with the error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

The kernel lacks the necessary driver for the storage controller. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot find or access the root filesystem. This typically occurs when the kernel lacks the necessary driver (module) for the storage controller (e.g., SATA, SCSI, NVMe) that the root device is connected to. Without the driver, the kernel cannot communicate with the storage hardware, resulting in the unknown-block(0,0) identifier.

Answer

The root filesystem has a corrupted superblock

Answer

The initrd file is missing or corrupted

Answer

The bootloader configuration points to the wrong partition

Question 13

A server has a backup script that runs daily at midnight. The system administrator notices that the script sometimes fails because the filesystem is mounted read-only. Which approach is the best practice to ensure the script runs only when the filesystem is writable?

Accepted Answer

Wrap the backup command in a script that checks if the filesystem is writable before proceeding. Option C is correct because it implements a proactive check within the script itself, using a command like `touch /mountpoint/testfile 2>/dev/null` or checking `/proc/mounts` to verify write access before executing the backup. This avoids unnecessary remounts and ensures the script only proceeds when the filesystem is writable, which is a robust and self-contained solution.

Answer

Add a cron job that runs before the backup to remount the filesystem read-write

Answer

Use anacron to run the job after boot

Answer

Change the cron job to run every hour until it succeeds

Question 14

An administrator is troubleshooting a DNS issue. The command 'dig @8.8.8.8 example.com' returns a response, but 'host example.com' returns 'Host not found'. Which of the following is the most likely cause?

Accepted Answer

The /etc/resolv.conf file is misconfigured.. The command 'dig @8.8.8.8 example.com' succeeds, proving that the DNS server at 8.8.8.8 is reachable and functional, and that network connectivity is fine. However, 'host example.com' fails because it uses the system's default resolver, which reads /etc/resolv.conf to determine which DNS server to query. If /etc/resolv.conf is misconfigured (e.g., missing or incorrect nameserver entries), the resolver cannot reach a valid DNS server, resulting in 'Host not found'.

Answer

The network interface is down.

Answer

The /etc/hosts file is corrupt.

Answer

The DNS server at 8.8.8.8 is not responding.

Question 15

Refer to the exhibit. A Linux system fails to boot with a kernel panic. The dmesg output shows the disk is detected and partitions are recognized. Which of the following is the most likely cause of the kernel panic?

Accepted Answer

The root filesystem cannot be mounted because the root= kernel parameter points to a non-existent or incorrect device.. A is correct because the kernel panic occurs after the disk and partitions are detected, indicating the kernel can see the hardware but cannot mount the root filesystem. The most common cause is an incorrect or missing `root=` kernel parameter in the bootloader configuration (e.g., GRUB), which specifies the root device (e.g., `/dev/sda1` or `UUID=...`). If this parameter points to a non-existent or wrong partition, the kernel cannot pivot to the root filesystem, leading to a panic.

Answer

The kernel module for the SATA controller is missing from the initramfs.

Answer

The SATA controller is not supported by the kernel.

Answer

The disk has bad sectors causing read errors during boot.

Question 16

Refer to the exhibit. An administrator needs to edit /etc/example.conf to change setting1 to 'production' and add a new line 'setting2=value' after the include line. The file must be edited in place without creating a backup. Which command sequence achieves this?

Accepted Answer

sed -i 's/setting1=default/setting1=production/' /etc/example.conf; sed -i '/^include /a
setting2=value' /etc/example.conf. Option A is correct because the first sed command uses the -i flag to edit the file in place without a backup, and the substitution 's/setting1=default/setting1=production/' changes the existing setting. The second sed command uses the 'a' (append) command after the line matching '^include ' to add the new line 'setting2=value' after it, also with -i to avoid creating a backup.

Answer

sed -i 's/setting1=default/setting1=production/' /etc/example.conf; sed -i '/^include /i
setting2=value' /etc/example.conf

Answer

sed -i.bak 's/setting1=default/setting1=production/' /etc/example.conf; sed -i.bak '/^include /a
setting2=value' /etc/example.conf

Answer

sed -i.bak 's/setting1=default/setting1=production/' /etc/example.conf; sed -i.bak '/^include /a
setting2=value' /etc/example.conf

Question 17

An administrator reviews the above DHCP server logs. Based on the output, which statement is correct about the DHCP transaction?

Accepted Answer

The client successfully obtained the IP address 192.168.1.100.. The DHCP server logs show a successful four-way handshake: DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, and DHCPACK. The final DHCPACK from the server confirms that the client has been granted the IP address 192.168.1.100, making option C correct.

Answer

The client sent a DHCPINFORM to renew its existing lease.

Answer

The DHCP server is configured to assign IP addresses from a pool that includes 192.168.1.100.

Answer

The DHCP server rejected the client's request because the DHCPREQUEST was not broadcast.

Question 18

Refer to the exhibit. After adding a new disk to the system, the device /dev/sdb appears. However, the administrator cannot create partitions on /dev/sdb using fdisk. What is the most likely reason?

Accepted Answer

The disk is currently in use as a physical volume for LVM.. The device /dev/sdb has major number 8, minor 16, which is correct for a disk. However, the 'disk' group may not have write permission? Actually, the permissions are brw-rw----, meaning owner root, group disk, with read-write for owner and group. The administrator is likely not in the 'disk' group, or the kernel is not recognizing the disk properly. But a common issue is that the disk is already in use or the partition table is corrupted. Another possibility: the disk might be a loop device or something else. However, the most typical reason is that the disk is not properly recognized by the kernel (e.g., missing driver). But given the exhibit shows /dev/sdb exists, the more plausible reason is that the disk is already partitioned and mounted, or the partition table is not recognized. Actually, fdisk would still work. Let's think: The exhibit shows /dev/sdb exists with major/minor numbers. If the disk is new, it might not have a valid partition table. fdisk can still create one. But if the disk is already in use (e.g., part of a RAID or LVM), fdisk might refuse. Another possibility: the disk is a device-mapper or something. Without more context, a common issue is that the disk is being used as a physical volume for LVM. The exhibit doesn't show that. Perhaps the disk is read-only? The permissions show rw for owner and group, so if the user is not root or not in disk group, they cannot write. But the question says 'administrator', likely root. So maybe the disk is a whole disk that is already partitioned and the kernel has reread the partition table? Actually, if /dev/sdb exists, it's the whole disk. fdisk should work. I'll go with a different angle: the disk may have a filesystem directly on it (no partition table), and fdisk might warn but still work. Hmm. Let's choose a plausible error: The disk is a removable device that is write-protected. But the exhibit doesn't show that. Another: The disk is a virtual disk with a read-only backing store. I think the most reasonable answer for LPI Linux is that the disk is a partition of another device? No, /dev/sdb is a disk. I'll go with: The disk is being used by the system (e.g., as a swap device or part of a RAID array). But the exhibit doesn't show that. Let's pick: The disk is not a block device? It is. Okay, I'll choose: The disk has a valid partition table that is in use, so fdisk refuses to modify it. But fdisk can modify it anyway. Actually, fdisk will allow modification if the partitions are not mounted. I'll go with a different approach: The administrator is not using sudo or is not root. But the exhibit shows root ownership. So maybe the disk is a loop device? No. Let's look at the options I'll create: A) The disk is not partitioned; B) The disk is mounted; C) The kernel does not recognize the disk; D) The disk is write-protected. I'll pick B: The disk is mounted. But the exhibit doesn't show mount points. However, it's common that a disk may have partitions that are mounted, but the whole disk device cannot be partitioned if any partition is in use. Actually, fdisk can still work on the whole disk even if partitions are mounted? It will warn but allow. But if the disk is in use (e.g., as a physical volume for LVM), fdisk may refuse. I'll go with: The disk is part of an LVM volume group. But that's not shown. I'll create a reasonable scenario: The disk is already being used as a swap device. But the exhibit doesn't show swap. To make it plausible, I'll say: The disk is a member of a RAID array. But again not shown. Hmm. Let's look at the major/minor numbers: 8,16 is typical for sd devices. There's no obvious issue. I'll propose that the disk is a whole disk that is already partitioned, and the kernel has automatically recognized the partitions, but the administrator is trying to partition the whole disk again, which fdisk will allow but might cause issues. Actually, the question says 'cannot create partitions'. Perhaps the disk has a size of 0? No. I'll go with: The disk is read-only due to a hardware switch. But that's not in the exhibit. I think the best answer is: The disk has a partition table that is in use, and fdisk refuses to write because the kernel has the device open. But fdisk can still write with --force. I'll choose: The disk is a removable device that is write-protected. But the exhibit shows no such indication. Let's decide: I'll make the correct answer: The disk is already in use as a physical volume for LVM, and fdisk cannot modify it while it is active. That is a common scenario. I'll include that in the options.

Answer

The disk is mounted and cannot be partitioned.

Answer

The disk does not have a valid partition table.

Answer

The kernel does not support the disk's interface.

Question 19

Refer to the exhibit. How many SATA controllers are detected, and what is the connection speed of the SSD?

Accepted Answer

2 controllers; SSD at 6.0 Gbps. The output from `lspci` shows two SATA controllers: one identified as 'SATA controller: Intel Corporation 82801IBM/IEM (ICH9M/ICH9M-E) 4 port SATA Controller' and another as 'SATA controller: Intel Corporation 82801IBM/IEM (ICH9M/ICH9M-E) 2 port SATA Controller'. The SSD is connected to the 6 Gbps port, as indicated by the '6 Gbps' label in the device listing, confirming a 6.0 Gbps connection speed.

Answer

3 controllers; SSD at 6.0 Gbps

Answer

2 controllers; SSD at 3.0 Gbps

Answer

1 controller; SSD at 6.0 Gbps

Question 20

Which THREE of the following are characteristics of UEFI firmware compared to legacy BIOS? (Select exactly 3.)

Accepted Answer

Supports booting from disks larger than 2 TB.. UEFI firmware uses the GUID Partition Table (GPT) instead of MBR, which supports 64-bit logical block addressing (LBA). This allows addressing disks larger than 2 TB, as the MBR scheme is limited to 32-bit LBA and a maximum addressable size of approximately 2.2 TB. Therefore, option A is correct.

Answer

Uses the Master Boot Record partition table.

Answer

Requires a boot loader stored in the Master Boot Record.

LPIC-1 Hard Questions — 25 Difficult Questions

Exhibit

LPIC-1 Hard Questions — 25 Difficult Questions

Exhibit