EX200 Essential Tools — 20 Questions

Question 1

A system administrator needs to find all files in /var/log that have been modified in the last 2 hours. Which command should be used?

Accepted Answer

find /var/log -mmin -120. The `find` command with `-mmin -120` searches for files whose data was modified (changed content) within the last 120 minutes. This directly matches the requirement to find files modified in the last 2 hours in /var/log.

Answer

find /var/log -amin -120

Answer

find /var/log -mtime -0.08

Answer

find /var/log -cmin -120

Question 2

A user complains that the 'ls' command no longer outputs colors. The administrator suspects a change in environment variables. Which command would help diagnose the issue?

Accepted Answer

env. The `env` command displays all current environment variables, which directly affect the behavior of commands like `ls`. The `ls` command uses the `LS_COLORS` environment variable to determine color output; if this variable is missing or altered, colors will not appear. Running `env` allows the administrator to inspect the current environment and identify if `LS_COLORS` has been changed or unset.

Answer

set

Answer

declare

Answer

alias

Question 3

During a security audit, an administrator needs to list all TCP ports on which the system is listening, showing only the port numbers and the associated process names. Which command best achieves this?

Accepted Answer

sudo ss -tlnp. `sudo ss -tlnp` lists TCP listening sockets with numeric port numbers and process names. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` displays numeric addresses/ports (avoiding DNS resolution), and `-p` reveals the process name. This command requires root privileges to see process information, hence `sudo`.

Answer

netstat -tulpn

Answer

nmap -sT localhost

Answer

lsof -i TCP:1-65535

Question 4

A new Linux administrator needs to read the manual page for the 'ls' command but also wants to search for the word 'color' within the manual. Which command accomplishes this?

Accepted Answer

man ls and then type /color. The man command opens the manual page for 'ls', and typing '/color' within the pager (usually less) performs an interactive forward search for the string 'color'. This allows the administrator to read the manual and search for the term in one session.

Answer

man -k color

Answer

man ls | grep color

Answer

man color

Question 5

An administrator needs to terminate a hung process with PID 3456 that does not respond to 'kill -15 3456'. Which signal should be used next?

Accepted Answer

kill -9 3456. Kill -9 (SIGKILL) is the signal of last resort for a process that does not respond to SIGTERM (kill -15). SIGKILL cannot be caught, blocked, or ignored by the process; it forces immediate termination by the kernel. Since the process is hung and unresponsive to SIGTERM, SIGKILL is the appropriate next step.

Answer

kill -15 3456

Answer

kill -19 3456

Answer

kill -1 3456

Question 6

A backup script uses tar to create an archive, but the administrator wants to exclude the /tmp directory from the backup. Which tar option should be added?

Accepted Answer

--exclude=/tmp. The `--exclude=PATTERN` option in tar tells the command to skip files or directories matching the given pattern. By specifying `--exclude=/tmp`, the tar archive will omit the /tmp directory and all its contents, which is exactly what the administrator needs for the backup script.

Answer

--ignore-failed-read

Answer

--exclude-from=/tmp

Answer

-X /tmp

Question 7

An administrator wants to display a list of all currently logged-in users. Which command is most appropriate?

Accepted Answer

who. The `who` command displays a list of currently logged-in users along with their terminal, login time, and originating host. It is the most straightforward and appropriate command for this specific task, as it directly queries the system's utmp database to show active sessions.

Answer

w

Answer

last

Answer

users

Question 8

Which TWO commands can be used to view the contents of a compressed file named 'archive.tar.gz' without extracting it?

Accepted Answer

tar -tzf archive.tar.gz. `tar -tzf archive.tar.gz` lists the contents of a gzip-compressed tar archive without extracting it. The `-t` option tells tar to list the table of contents, `-z` filters the archive through gzip decompression, and `-f` specifies the archive file. This command reads the archive metadata directly without writing any files to disk.

Answer

gzip -d archive.tar.gz

Answer

gunzip -c archive.tar.gz

Answer

tar -xf archive.tar.gz

Question 9

Which THREE commands can be used to check the disk space usage of the /home partition?

Accepted Answer

df -h /home. `df -h /home` displays the disk space usage of the /home filesystem in human-readable format (e.g., GB, MB). The `df` command reports the total, used, and available space for mounted filesystems, making it the standard tool for checking partition-level disk usage.

Answer

fdisk -l /dev/sda

Answer

parted /dev/sda print

Question 10

Refer to the exhibit. Why does the 'bin' user have /sbin/nologin as its shell?

Accepted Answer

The user is a system account that should not log in interactively.. The /sbin/nologin shell is explicitly assigned to system accounts like 'bin' to prevent interactive logins. This shell prints a message and exits, ensuring that the account can only be used for non-interactive system processes, such as owning files or running daemons, without providing a login session.

Answer

The user's home directory is missing.

Answer

The user is locked.

Answer

The shell is not installed.

Question 11

Refer to the exhibit. Why does the /etc/shadow file have no read permissions for any user?

Accepted Answer

Only root can read it, but the permissions are not displayed correctly.. The /etc/shadow file stores hashed user passwords and must be readable only by root to prevent unauthorized access to password hashes. The displayed permissions (---------- 1 root root) indicate that no user, including root, has read access according to standard `ls -l` output, but this is misleading because root can always read the file regardless of permission bits due to Linux's superuser bypass (DAC override). The correct answer is A because root's ability to read the file is not reflected in the permission display, which only shows the file's mode bits.

Answer

The file is empty.

Answer

The file is a symbolic link.

Answer

The file is a character device.

Question 12

You are a system administrator for a company running Red Hat Enterprise Linux 8. A developer reports that a script which runs daily at 2 AM is failing. The script is located at /opt/scripts/backup.sh and is owned by root. The developer says the script runs fine when executed manually with './backup.sh' from the /opt/scripts directory. The script is scheduled via a root crontab entry: '0 2 * * * /opt/scripts/backup.sh'. However, the script fails because it cannot find a configuration file located at './config.ini'. What is the most likely cause and the correct solution?

Accepted Answer

Cron uses a different PATH. Modify the script to use absolute paths for all files, including config.ini.. The script fails because cron jobs run with a minimal environment, including a restricted PATH that typically does not include the script's directory. When the script uses a relative path like './config.ini', the cron job's working directory is not /opt/scripts (it defaults to the user's home directory, /root for root cron), so the file is not found. The correct solution is to modify the script to use absolute paths, such as /opt/scripts/config.ini, ensuring it works regardless of the cron environment.

Answer

The configuration file is missing. Copy config.ini to /root.

Answer

The cron job runs as a different user. Change the cron job to run as the developer's user.

Answer

The script is not executable. Run chmod +x /opt/scripts/backup.sh.

Question 13

You are a Linux administrator. A user reports that when they log in via SSH, they see the message 'Could not chdir to home directory /home/john: No such file or directory' and are dropped into the root directory. The user's home directory does exist at /home/john but is empty. The user's entry in /etc/passwd is: 'john:x:1001:1001::/home/john:/bin/bash'. What is the most likely cause and the correct fix?

Accepted Answer

The home directory is not owned by john. Run chown john:john /home/john.. The error 'Could not chdir to home directory /home/john: No such file or directory' occurs even though the directory exists, because the SSH daemon (or login process) cannot access it. The most likely cause is that the home directory is not owned by the user john, so the system denies permission to change into it. Running 'chown john:john /home/john' corrects the ownership, allowing the user to enter their home directory.

Answer

The home directory path in /etc/passwd has a typo. Change it to /home/john.

Answer

The home directory is missing the .bashrc file. Copy default files from /etc/skel.

Answer

The user's shell is invalid. Change shell to /bin/bash.

Question 14

A user reports that a script in their home directory fails to execute. The script has permissions -rw-r--r-- and is owned by the user. Which command will allow execution for the owner?

Accepted Answer

chmod u+x script.sh. The script currently has permissions `-rw-r--r--`, meaning the owner has read and write but not execute. To allow the owner to execute it, you need to add the execute permission for the owner only. `chmod u+x script.sh` adds the execute bit for the user (owner) without affecting group or others, which is the precise requirement.

Answer

chmod u+r script.sh

Answer

chmod a+x script.sh

Answer

chmod u-x script.sh

Question 15

A system administrator needs to find all regular files larger than 10MB in /var/log. Which find command should they use?

Accepted Answer

find /var/log -type f -size +10M. It uses `-type f` to select only regular files and `-size +10M` to match files larger than 10 megabytes. The `+` prefix in the `-size` test means 'greater than', which is the correct syntax for finding files exceeding a given size.

Answer

find /var/log -type f -size -10M

Answer

find /var/log -type d -size +10M

Answer

find /var/log -type f -size 10M

Question 16

An administrator wants to ensure that when a user presses Ctrl+C during a long-running script, the script cleans up temporary files before exiting. Which approach should the script use?

Accepted Answer

Use 'trap' to catch SIGINT and run cleanup.. The `trap` command in Bash allows a script to catch signals like SIGINT (sent when Ctrl+C is pressed) and execute a custom function or command before exiting. By setting `trap cleanup SIGINT`, the script can remove temporary files or perform other cleanup actions automatically, ensuring a graceful termination.

Answer

Use 'set -o ignoreeof' to ignore Ctrl+C.

Answer

Run the script in the background with '&'.

Answer

Use 'set -e' to exit on any error.

Question 17

A user needs to view the last 15 lines of a log file that is constantly being updated. Which command should they use?

Accepted Answer

tail -n 15 /var/log/messages. The `tail -n 15 /var/log/messages` command displays the last 15 lines of the specified log file without following it. This meets the requirement to view the last 15 lines of a file that is constantly being updated, as it provides a static snapshot of the most recent entries.

Answer

tail -f /var/log/messages

Answer

cat /var/log/messages

Answer

head -15 /var/log/messages

Question 18

An administrator needs to compress a directory 'data' into an archive named backup.tar.gz using gzip compression. Which command should they use?

Accepted Answer

tar -czf backup.tar.gz data. The `tar -czf` command creates a compressed archive: `-c` creates a new archive, `-z` filters the archive through gzip compression, `-f` specifies the archive filename `backup.tar.gz`, and `data` is the directory to archive. This produces a tarball compressed with gzip, matching the requirement exactly.

Answer

gzip -r data > backup.tar.gz

Answer

tar -cjf backup.tar.gz data

Answer

tar -xzf backup.tar.gz data

Question 19

A system administrator needs to find all files modified in the last 24 hours under /var/log. Which command accomplishes this?

Accepted Answer

find /var/log -mtime -1. `find /var/log -mtime -1` searches for files under `/var/log` whose modification time (`mtime`) is less than 1 day ago (i.e., modified within the last 24 hours). The `-mtime` flag checks the last modification time of file content, which is the standard criterion for 'modified' files.

Answer

find /var/log -ctime -1

Answer

find /var/log -atime -1

Answer

find /var/log -mmin 1440

Question 20

A user reports that they cannot use the 'systemctl' command to manage services. The user is part of the 'wheel' group. Which configuration change is required to allow this?

Accepted Answer

Ensure /etc/polkit-1/rules.d/10-admin.rules includes an admin rule for the wheel group. The 'systemctl' command requires PolicyKit authorization for non-root users to manage systemd services. The correct configuration is to add a PolicyKit rule in /etc/polkit-1/rules.d/10-admin.rules that grants the 'wheel' group administrative privileges, allowing them to invoke systemctl without a password or with appropriate authentication.

Answer

Set the 'permissive' mode for systemd via systemd.conf

Answer

Add the user to the 'systemd-journal' group

Answer

Add the user to /etc/sudoers with 'ALL ALL=(ALL) ALL'