EX200 Essential Tools — 40 Questions

Question 1

Which TWO commands can be used to display the current date and time in a format like '2023-10-05 14:30:00'?

Accepted Answer

date '+%Y-%m-%d %H:%M:%S'. The `date` command with the format string `'+%Y-%m-%d %H:%M:%S'` explicitly outputs the current date and time in the requested 'YYYY-MM-DD HH:MM:SS' format. Option D (`date -Iseconds`) outputs date and time in ISO 8601 format (e.g., 2023-10-05T14:30:00+00:00) with a 'T' separator and timezone, not the requested format. Therefore, only option A is correct.

Answer

cal

Answer

timedatectl

Answer

date -Iseconds

Answer

hwclock

Question 2

Which THREE commands can be used to check the disk space usage of the /home partition?

Accepted Answer

df -h /home. `df -h /home` displays the disk space usage of the /home filesystem in human-readable format (e.g., GB, MB). The `df` command reports the total, used, and available space for mounted filesystems, making it the standard tool for checking partition-level disk usage.

Answer

fdisk -l /dev/sda

Answer

parted /dev/sda print

Question 3

Refer to the exhibit. Why does the /etc/shadow file have no read permissions for any user?

Accepted Answer

Only root can read it, but the permissions are not displayed correctly.. The /etc/shadow file stores hashed user passwords and must be readable only by root to prevent unauthorized access to password hashes. The displayed permissions (---------- 1 root root) indicate that no user, including root, has read access according to standard `ls -l` output, but this is misleading because root can always read the file regardless of permission bits due to Linux's superuser bypass (DAC override). The correct answer is A because root's ability to read the file is not reflected in the permission display, which only shows the file's mode bits.

Answer

The file is empty.

Answer

The file is a symbolic link.

Answer

The file is a character device.

Question 4

You are a system administrator for a company running Red Hat Enterprise Linux 8. A developer reports that a script which runs daily at 2 AM is failing. The script is located at /opt/scripts/backup.sh and is owned by root. The developer says the script runs fine when executed manually with './backup.sh' from the /opt/scripts directory. The script is scheduled via a root crontab entry: '0 2 * * * /opt/scripts/backup.sh'. However, the script fails because it cannot find a configuration file located at './config.ini'. What is the most likely cause and the correct solution?

Accepted Answer

Cron uses a different working directory. Modify the script to use absolute paths for all files, including config.ini.. The script fails because cron jobs run with a different working directory, not because of PATH. Cron executes the script from the user's home directory (e.g., /root for root cron), so relative path './config.ini' is resolved relative to /root, not /opt/scripts. The correct solution is to modify the script to use absolute paths, such as /opt/scripts/config.ini, ensuring it works regardless of the cron environment.

Answer

The configuration file is missing. Copy config.ini to /root.

Answer

The cron job runs as a different user. Change the cron job to run as the developer's user.

Answer

The script is not executable. Run chmod +x /opt/scripts/backup.sh.

Question 5

You are a Linux administrator. A user reports that when they log in via SSH, they see the message 'Could not chdir to home directory /home/john: No such file or directory' and are dropped into the root directory. The user's home directory does exist at /home/john but is empty. The user's entry in /etc/passwd is: 'john:x:1001:1001::/home/john:/bin/bash'. What is the most likely cause and the correct fix?

Accepted Answer

The home directory is not owned by john. Run chown john:john /home/john.. The current answer is incorrect. On Linux, chdir(2) returns ENOENT ("No such file or directory") only when the target directory or a path component does not exist. Ownership or permission problems cause EACCES and produce "Permission denied", not "No such file or directory". Since the stem states /home/john exists and /etc/passwd is correct, none of the listed options is technically correct; the premise contradicts the reported error.

Answer

The home directory path in /etc/passwd has a typo. Change it to /home/john.

Answer

The home directory is missing the .bashrc file. Copy default files from /etc/skel.

Answer

The user's shell is invalid. Change shell to /bin/bash.

Question 6

An administrator wants to edit a configuration file and ensure only the intended changes are saved. Which practice is recommended?

Accepted Answer

Use 'git' to track changes and commit after editing. Using 'git' to track changes and commit after editing provides a version control system that allows you to review, stage, and commit only the intended modifications. This ensures that unintended changes are not saved, as you can use 'git diff' to verify changes before committing and 'git checkout' to revert unwanted edits. Git is a standard tool for system administration and provides a robust method for configuration file management.

Answer

Copy the file to a temporary location, edit, and then overwrite

Answer

Use 'ls -l' to check the file size before and after editing

Answer

Edit the file in place with a backup using 'sed -i.bak'

Question 7

A server has a disk with LVM logical volumes. The administrator needs to extend a logical volume to use all remaining free space in the volume group. Which command sequence is correct?

Accepted Answer

lvextend -l +100%FREE /dev/vg/lv && xfs_growfs /mountpoint. `lvextend -l +100%FREE /dev/vg/lv` extends the logical volume to all remaining free extents in the volume group. For an XFS filesystem, the correct grow command is `xfs_growfs` run against the mounted directory (e.g., `xfs_growfs /mountpoint`), not the block device path `/dev/vg/lv`.

Answer

lvextend -L +100%FREE /dev/vg/lv && resize2fs /dev/vg/lv

Answer

lvextend -l +50%FREE /dev/vg/lv && xfs_growfs /dev/vg/lv

Answer

lvresize -L +100%VG /dev/vg/lv && resize2fs /dev/vg/lv

Question 8

Which TWO commands can be used to view the contents of a compressed gzip file without decompressing it permanently? (Choose two.)

Accepted Answer

zless file.gz. Option B (zless file.gz) is correct because zless is a pager wrapper that transparently decompresses gzip data on the fly and displays it page by page, leaving the original .gz file intact. Option E (zcat file.gz) is correct because zcat decompresses the gzip stream to standard output without modifying or removing the source file, allowing you to view its contents. Option A (zgrep file.gz) is not among the marked answers because zgrep searches for patterns within the compressed file rather than simply displaying its full contents. Option C (gunzip file.gz) and Option D (gzip -d file.gz) are incorrect because both permanently decompress the file, replacing file.gz with an uncompressed file, which violates the requirement of not decompressing permanently.

Answer

zgrep file.gz

Answer

gunzip file.gz

Answer

gzip -d file.gz

Question 9

A system administrator wants to find all files in /var that are larger than 100MB and have been modified within the last 7 days. The output should be a list of file paths with sizes in human-readable format, sorted by size descending. Which command pipeline accomplishes this?

Accepted Answer

find /var -type f -size +100M -mtime -7 -exec du -h {} + | sort -rh. It uses `find` with `-size +100M` and `-mtime -7` to match files larger than 100MB modified within 7 days, then `-exec du -h {} +` aggregates sizes in human-readable format, and `sort -rh` sorts by the first field (size) in reverse human-numeric order, producing the required descending list.

Answer

find /var -type f -size +100M -mtime -7 -ls | sort -k7 -n

Answer

find /var -type f -size +100M -mtime -7 -exec ls -lh {} \; | sort -k5 -h

Answer

find /var -type f -size +100M -mtime -7 -printf '%s %p
' | sort -n -r | head -20

Question 10

A user wants to run a command in the background after logging out of an SSH session. Which method ensures the process continues even after logout?

Accepted Answer

Run 'nohup command &' before logout. `nohup` ignores the SIGHUP signal that the shell sends to its child processes when the parent shell exits (e.g., upon logout). By running `nohup command &`, the command is placed in the background and will continue running even after the SSH session terminates, as it is immune to the hangup signal.

Answer

Run 'command', press Ctrl+Z, then type 'bg' and logout

Answer

Run 'command &' and then exit

Answer

Run 'command & disown' then logout

Question 11

A system administrator wants to monitor all files in /var/log that are currently being written to by processes. Which command shows file descriptors that are open for writing by any process?

Accepted Answer

lsof /var/log. `lsof /var/log` lists all open file descriptors for files directly under /var/log (non-recursively). The output includes the FD column, which shows the file descriptor number and mode (e.g., '3w' for write). Thus, you can see which descriptors are open for writing. However, it does not recursively scan subdirectories. Option B uses a grep pattern that incorrectly expects the write mode after the file type, but in `lsof` output, the mode appears in the FD column before the type. Therefore, the grep pattern fails to filter for write descriptors. Options A and C are incorrect because `inotifywait` monitors events and `fuser` shows processes, not file descriptors.

Answer

inotifywait -m /var/log

Answer

lsof +D /var/log | grep -E '(REG|DIR).*[0-9]+[w]'

Answer

fuser -v /var/log

Question 12

Refer to the exhibit. An administrator runs these commands on a server. The administrator suspects a performance issue. Which observation from the exhibit is most likely causing a bottleneck?

Accepted Answer

The 'create' directive requires root privileges, but the job runs as appuser.. The `create` directive in logrotate requires root privileges to create new log files with the specified ownership and permissions. Since the job runs as `appuser`, it lacks the necessary privileges to execute the `create` directive, causing the rotation to fail and potentially leading to a bottleneck as logs are not rotated properly.

Answer

The 'notifempty' directive may cause delays in rotation.

Answer

The 'compress' directive uses bzip2 by default, which is not installed.

Answer

The 'weekly' directive uses cron syntax incorrectly.

Question 13

A junior administrator is tasked with finding all files in the /var/log directory that have been modified within the last 24 hours and are owned by the 'root' user. The administrator runs the command: find /var/log -user root -mtime 0. However, the command returns no output, even though there are files that meet the criteria. What is the most likely issue with the find command?

Accepted Answer

The /var/log path is not accessible; the administrator should use sudo.. In `find`, `-mtime 0` matches files modified within the last 24 hours (ages 0–1 day rounded down), so it is not incorrect. If the command returns nothing despite matching files, the usual cause is that the user lacks read/execute permission on some directories in `/var/log`, preventing traversal; running with `sudo` would resolve this.

Answer

The -user root argument is invalid; it should be -uid 0.

Answer

The find command requires the -type f argument to search for files only.

Answer

The -mtime 0 argument is incorrect; it should be -mtime -1 to find files modified in the last 24 hours.

Question 14

A Red Hat Enterprise Linux server has multiple network interfaces, and the administrator needs to ensure that the service 'httpd' starts automatically after a reboot. The administrator has already enabled the service using 'systemctl enable httpd', but after a reboot, the service is not running. The administrator checks the status and finds that the service is enabled but not started. The system uses systemd. Which additional step is required to ensure the service starts automatically at boot?

Accepted Answer

Check that the service's unit file has an [Install] section and is properly configured.. For a service to start automatically at boot, its unit file must contain a properly configured [Install] section that defines a target (e.g., WantedBy=multi-user.target). If the [Install] section is missing or malformed, systemctl enable will fail with an error, so the service would not be marked as enabled. Since the service is reported as enabled, check the [Install] section to ensure it points to the correct boot target and that the target is active. If the configuration is broken, correct it and re-run systemctl enable (and daemon-reload if necessary).

Answer

Set the service to be started by the network target using systemctl add-wants.

Answer

Run systemctl start httpd after enabling it.

Answer

Create a symlink in /etc/rc.d/rc3.d/ for the service.

Question 15

A Red Hat Enterprise Linux 9 server has a directory /srv/reports containing roughly 40,000 files owned by various users. An administrator must archive the entire directory into a single file named /backup/reports.tar.bz2 while preserving ownership, permissions, and SELinux contexts, and must do so without writing any intermediate uncompressed file to disk. Which command accomplishes this?

Accepted Answer

tar -cjvf /backup/reports.tar.bz2 /srv/reports. Creating a bzip2-compressed tar archive requires the create, bzip2, verbose, and file flags together with the archive path placed after -f. The on-the-fly compression pipeline means no temporary uncompressed file touches the disk, and tar records ownership, mode bits, and SELinux context labels. The other invocations either list, extract, or misorder the archive and source paths.

Answer

tar -cjvf /srv/reports /backup/reports.tar.bz2

Answer

tar -xjvf /backup/reports.tar.bz2 /srv/reports

Answer

tar -tzvf /backup/reports.tar.bz2 /srv/reports

Question 16

A system administrator needs to find all files in /var/log that have been modified in the last 2 hours. Which command should be used?

Accepted Answer

find /var/log -mmin -120. The `find` command with `-mmin -120` searches for files whose data was modified (changed content) within the last 120 minutes. This directly matches the requirement to find files modified in the last 2 hours in /var/log.

Answer

find /var/log -amin -120

Answer

find /var/log -mtime -0.08

Answer

find /var/log -cmin -120

Question 17

A user complains that the 'ls' command no longer outputs colors. The administrator suspects a change in environment variables. Which command would help diagnose the issue?

Accepted Answer

env. The `env` command displays all current environment variables, which directly affect the behavior of commands like `ls`. The `ls` command uses the `LS_COLORS` environment variable to determine color output; if this variable is missing or altered, colors will not appear. Running `env` allows the administrator to inspect the current environment and identify if `LS_COLORS` has been changed or unset.

Answer

set

Answer

declare

Answer

alias

Question 18

During a security audit, an administrator needs to list all TCP ports on which the system is listening, showing only the port numbers and the associated process names. Which command best achieves this?

Accepted Answer

sudo ss -tlnp. `sudo ss -tlnp` lists TCP listening sockets with numeric port numbers and process names. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` displays numeric addresses/ports (avoiding DNS resolution), and `-p` reveals the process name. This command requires root privileges to see process information, hence `sudo`.

Answer

netstat -tulpn

Answer

nmap -sT localhost

Answer

lsof -i TCP:1-65535

Question 19

A new Linux administrator needs to read the manual page for the 'ls' command but also wants to search for the word 'color' within the manual. Which command accomplishes this?

Accepted Answer

man ls and then type /color. The man command opens the manual page for 'ls', and typing '/color' within the pager (usually less) performs an interactive forward search for the string 'color'. This allows the administrator to read the manual and search for the term in one session.

Answer

man -k color

Answer

man ls | grep color

Answer

man color

Question 20

An administrator needs to terminate a hung process with PID 3456 that does not respond to 'kill -15 3456'. Which signal should be used next?

Accepted Answer

kill -9 3456. Kill -9 (SIGKILL) is the signal of last resort for a process that does not respond to SIGTERM (kill -15). SIGKILL cannot be caught, blocked, or ignored by the process; it forces immediate termination by the kernel. Since the process is hung and unresponsive to SIGTERM, SIGKILL is the appropriate next step.

Answer

kill -15 3456

Answer

kill -19 3456

Answer

kill -1 3456