EX200 Essential Tools — 10 Questions

Question 1

A system administrator needs to find all files in /var/log that have been modified in the last 2 hours. Which command should be used?

Accepted Answer

find /var/log -mmin -120. The `find` command with `-mmin -120` searches for files whose data was modified (changed content) within the last 120 minutes. This directly matches the requirement to find files modified in the last 2 hours in /var/log.

Answer

find /var/log -amin -120

Answer

find /var/log -mtime -0.08

Answer

find /var/log -cmin -120

Question 2

A user complains that the 'ls' command no longer outputs colors. The administrator suspects a change in environment variables. Which command would help diagnose the issue?

Accepted Answer

env. The `env` command displays all current environment variables, which directly affect the behavior of commands like `ls`. The `ls` command uses the `LS_COLORS` environment variable to determine color output; if this variable is missing or altered, colors will not appear. Running `env` allows the administrator to inspect the current environment and identify if `LS_COLORS` has been changed or unset.

Answer

set

Answer

declare

Answer

alias

Question 3

During a security audit, an administrator needs to list all TCP ports on which the system is listening, showing only the port numbers and the associated process names. Which command best achieves this?

Accepted Answer

sudo ss -tlnp. `sudo ss -tlnp` lists TCP listening sockets with numeric port numbers and process names. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` displays numeric addresses/ports (avoiding DNS resolution), and `-p` reveals the process name. This command requires root privileges to see process information, hence `sudo`.

Answer

netstat -tulpn

Answer

nmap -sT localhost

Answer

lsof -i TCP:1-65535

Question 4

A new Linux administrator needs to read the manual page for the 'ls' command but also wants to search for the word 'color' within the manual. Which command accomplishes this?

Accepted Answer

man ls and then type /color. The man command opens the manual page for 'ls', and typing '/color' within the pager (usually less) performs an interactive forward search for the string 'color'. This allows the administrator to read the manual and search for the term in one session.

Answer

man -k color

Answer

man ls | grep color

Answer

man color

Question 5

An administrator needs to terminate a hung process with PID 3456 that does not respond to 'kill -15 3456'. Which signal should be used next?

Accepted Answer

kill -9 3456. Kill -9 (SIGKILL) is the signal of last resort for a process that does not respond to SIGTERM (kill -15). SIGKILL cannot be caught, blocked, or ignored by the process; it forces immediate termination by the kernel. Since the process is hung and unresponsive to SIGTERM, SIGKILL is the appropriate next step.

Answer

kill -15 3456

Answer

kill -19 3456

Answer

kill -1 3456

Question 6

A backup script uses tar to create an archive, but the administrator wants to exclude the /tmp directory from the backup. Which tar option should be added?

Accepted Answer

--exclude=/tmp. The `--exclude=PATTERN` option in tar tells the command to skip files or directories matching the given pattern. By specifying `--exclude=/tmp`, the tar archive will omit the /tmp directory and all its contents, which is exactly what the administrator needs for the backup script.

Answer

--ignore-failed-read

Answer

--exclude-from=/tmp

Answer

-X /tmp

Question 7

An administrator wants to display a list of all currently logged-in users. Which command is most appropriate?

Accepted Answer

who. The `who` command displays a list of currently logged-in users along with their terminal, login time, and originating host. It is the most straightforward and appropriate command for this specific task, as it directly queries the system's utmp database to show active sessions.

Answer

w

Answer

last

Answer

users

Question 8

Which TWO commands can be used to view the contents of a compressed file named 'archive.tar.gz' without extracting it?

Accepted Answer

tar -tzf archive.tar.gz. `tar -tzf archive.tar.gz` lists the contents of a gzip-compressed tar archive without extracting it. The `-t` option tells tar to list the table of contents, `-z` filters the archive through gzip decompression, and `-f` specifies the archive file. This command reads the archive metadata directly without writing any files to disk.

Answer

gzip -d archive.tar.gz

Answer

gunzip -c archive.tar.gz

Answer

tar -xf archive.tar.gz

Question 9

Which THREE commands can be used to check the disk space usage of the /home partition?

Accepted Answer

df -h /home. `df -h /home` displays the disk space usage of the /home filesystem in human-readable format (e.g., GB, MB). The `df` command reports the total, used, and available space for mounted filesystems, making it the standard tool for checking partition-level disk usage.

Answer

fdisk -l /dev/sda

Answer

parted /dev/sda print

Question 10

Refer to the exhibit. Why does the 'bin' user have /sbin/nologin as its shell?

Accepted Answer

The user is a system account that should not log in interactively.. The /sbin/nologin shell is explicitly assigned to system accounts like 'bin' to prevent interactive logins. This shell prints a message and exits, ensuring that the account can only be used for non-interactive system processes, such as owning files or running daemons, without providing a login session.

Answer

The user's home directory is missing.

Answer

The user is locked.

Answer

The shell is not installed.