EX200 Essential Tools Practice Test 4 — 15 Questions

Question 1

A system administrator wants to monitor all files in /var/log that are currently being written to by processes. Which command shows file descriptors that are open for writing by any process?

Accepted Answer

lsof /var/log. `lsof /var/log` lists all open file descriptors for files directly under /var/log (non-recursively). The output includes the FD column, which shows the file descriptor number and mode (e.g., '3w' for write). Thus, you can see which descriptors are open for writing. However, it does not recursively scan subdirectories. Option B uses a grep pattern that incorrectly expects the write mode after the file type, but in `lsof` output, the mode appears in the FD column before the type. Therefore, the grep pattern fails to filter for write descriptors. Options A and C are incorrect because `inotifywait` monitors events and `fuser` shows processes, not file descriptors.

Answer

inotifywait -m /var/log

Answer

lsof +D /var/log | grep -E '(REG|DIR).*[0-9]+[w]'

Answer

fuser -v /var/log

Question 2

Which TWO commands can be used to view the contents of a compressed file named 'data.log.gz' without decompressing it permanently? (Choose exactly two.)

Accepted Answer

zcat data.log.gz. B is correct because `zcat` reads the contents of a gzip-compressed file and outputs them to standard output without permanently decompressing the file. It is functionally equivalent to `gunzip -c` and is the standard tool for viewing compressed text files in place.

Answer

gunzip data.log.gz

Answer

gzip -d data.log.gz

Answer

bzcat data.log.gz

Question 3

Which THREE of the following are valid methods to schedule a recurring task in Red Hat Enterprise Linux 8? (Choose exactly three.)

Accepted Answer

Creating a systemd timer unit. Systemd timer units are the modern, recommended method for scheduling recurring tasks in RHEL 8. They replace traditional cron-based scheduling by leveraging systemd's service and timer units, providing features like monotonic timers, calendar events, and integration with systemd's logging and dependency management.

Answer

Using the 'batch' command

Answer

Using the 'at' command

Question 4

Which TWO of the following are valid examples of using redirection and pipes in bash to append the output of a command to a file while also displaying it on the terminal? (Choose exactly two.)

Accepted Answer

command | tee -a file. `tee -a file` reads from stdin and writes both to stdout and appends to the named file. The pipe `|` sends the stdout of `command` to `tee`, so the output is displayed on the terminal and appended to `file`. The `-a` flag ensures append mode, not overwrite.

Answer

command 2>&1 | tee file

Answer

command > file

Answer

command >> file

Question 5

Refer to the exhibit. An administrator runs these commands on a server. The administrator suspects a performance issue. Which observation from the exhibit is most likely causing a bottleneck?

Accepted Answer

The 'create' directive requires root privileges, but the job runs as appuser.. The `create` directive in logrotate requires root privileges to create new log files with the specified ownership and permissions. Since the job runs as `appuser`, it lacks the necessary privileges to execute the `create` directive, causing the rotation to fail and potentially leading to a bottleneck as logs are not rotated properly.

Answer

The 'notifempty' directive may cause delays in rotation.

Answer

The 'compress' directive uses bzip2 by default, which is not installed.

Answer

The 'weekly' directive uses cron syntax incorrectly.

Question 6

A system is experiencing high CPU usage. The administrator suspects a process is stuck in an infinite loop. Which command can be used to identify the most CPU-intensive process in real-time?

Accepted Answer

top. The `top` command provides a real-time, dynamic view of system processes, sorted by CPU usage by default. It continuously refreshes, making it ideal for identifying the most CPU-intensive process as it runs, which directly addresses the scenario of a suspected infinite loop causing high CPU usage.

Answer

lsof

Answer

ps aux

Answer

strace

Question 7

Which two commands can be used to display the contents of a compressed .tar.gz archive without extracting it? (Choose two)

Accepted Answer

tar -tzf archive.tar.gz. `tar -tzf` lists the contents of a gzip-compressed tar archive without extracting it. The `-t` flag tells tar to list the table of contents, `-z` handles the gzip decompression on the fly, and `-f` specifies the archive file. This is the standard way to inspect a .tar.gz file's contents without extraction.

Answer

gzcat archive.tar.gz

Answer

less archive.tar.gz

Answer

tar -xf archive.tar.gz

Question 8

Which three of the following are valid methods to view the manual page for the 'ls' command? (Choose three)

Accepted Answer

man ls. The 'man' command is the primary method for viewing manual pages in Linux. Running 'man ls' displays the full manual page for the 'ls' command, including its description, options, and usage details.

Answer

help ls

Answer

whatis ls

Question 9

A junior administrator is tasked with finding all files in the /var/log directory that have been modified within the last 24 hours and are owned by the 'root' user. The administrator runs the command: find /var/log -user root -mtime 0. However, the command returns no output, even though there are files that meet the criteria. What is the most likely issue with the find command?

Accepted Answer

The /var/log path is not accessible; the administrator should use sudo.. In `find`, `-mtime 0` matches files modified within the last 24 hours (ages 0–1 day rounded down), so it is not incorrect. If the command returns nothing despite matching files, the usual cause is that the user lacks read/execute permission on some directories in `/var/log`, preventing traversal; running with `sudo` would resolve this.

Answer

The -user root argument is invalid; it should be -uid 0.

Answer

The find command requires the -type f argument to search for files only.

Answer

The -mtime 0 argument is incorrect; it should be -mtime -1 to find files modified in the last 24 hours.

Question 10

A system administrator is trying to compress the contents of the directory /home/user/project into a tarball named project_backup.tar.gz using the command: tar -czf project_backup.tar.gz /home/user/project. The command completes without errors, but when the administrator tries to list the contents of the tarball using tar -tzf project_backup.tar.gz, it shows a leading slash (/) in the paths, like /home/user/project/file1. The administrator wants to create the tarball with relative paths instead. What change should be made to the tar command?

Accepted Answer

Use tar -czf project_backup.tar.gz -C /home/user project. The `-C` option changes the working directory to `/home/user` before archiving, so the argument `project` is interpreted as a relative path. This strips the leading slash and stores paths like `project/file1` instead of absolute paths. The `-C` option is the standard way to create tarballs with relative paths in a single command.

Answer

Use tar -czf project_backup.tar.gz --absolute-names /home/user/project

Answer

Use tar -czf project_backup.tar.gz -P /home/user/project

Answer

Use tar -czf project_backup.tar.gz -h /home/user/project

Question 11

A Red Hat Enterprise Linux server has multiple network interfaces, and the administrator needs to ensure that the service 'httpd' starts automatically after a reboot. The administrator has already enabled the service using 'systemctl enable httpd', but after a reboot, the service is not running. The administrator checks the status and finds that the service is enabled but not started. The system uses systemd. Which additional step is required to ensure the service starts automatically at boot?

Accepted Answer

Check that the service's unit file has an [Install] section and is properly configured.. For a service to start automatically at boot, its unit file must contain a properly configured [Install] section that defines a target (e.g., WantedBy=multi-user.target). If the [Install] section is missing or malformed, systemctl enable will fail with an error, so the service would not be marked as enabled. Since the service is reported as enabled, check the [Install] section to ensure it points to the correct boot target and that the target is active. If the configuration is broken, correct it and re-run systemctl enable (and daemon-reload if necessary).

Answer

Set the service to be started by the network target using systemctl add-wants.

Answer

Run systemctl start httpd after enabling it.

Answer

Create a symlink in /etc/rc.d/rc3.d/ for the service.

Question 12

A system administrator is troubleshooting a cron job that runs a script as root. The script is located at /root/scripts/backup.sh and has permissions 755. The cron job is defined in /etc/crontab with the line: 0 2 * * * root /root/scripts/backup.sh. However, the script does not run at the scheduled time. The administrator checks the cron logs and finds no errors. The administrator then runs the script manually as root and it executes successfully. What is the most likely cause of the cron job not running?

Accepted Answer

The cron job line uses absolute path to the script but the script requires an environment variable that is not set in cron's minimal environment.. Cron jobs run with a minimal environment, setting only a few variables (such as HOME, SHELL, LOGNAME, and a default PATH) and not sourcing the user's shell startup files. The script at /root/scripts/backup.sh may rely on an environment variable (e.g., a database password or directory path) defined in root's interactive shell but not in cron's environment. When run manually as root, the variable is available, but cron does not source /root/.bashrc or /root/.bash_profile, causing the script to fail silently or not execute as expected.

Answer

The script is not executable by the root user.

Answer

The cron daemon is not running.

Answer

The /etc/crontab file does not allow running scripts from /root.

Question 13

Which TWO commands can be used to view the kernel ring buffer?

Accepted Answer

dmesg. The kernel ring buffer stores kernel-related messages, such as hardware driver and boot messages. The `dmesg` command is specifically designed to print or control this buffer, making it a direct and correct tool for viewing kernel ring buffer messages.

Answer

journalctl -f

Answer

cat /var/log/messages

Answer

systemctl status

Question 14

What does the 's' in the owner execute position indicate?

Accepted Answer

SetUID. In Linux file permissions, the 's' in the owner execute position (e.g., `-rwsr-xr-x`) indicates the SetUID (Set User ID) special permission. When set on an executable file, it allows the process to run with the effective user ID of the file's owner (typically root), rather than the user who launched it. This is why option E is correct.

Answer

Mandatory access control

Answer

SetGID

Answer

Sticky bit

Answer

No special permission

Question 15

A developer needs to search for the string 'ERROR' in all files under /var/log, but wants to exclude files ending with '.gz'. Which command is correct?

Accepted Answer

grep -r --exclude='*.gz' 'ERROR' /var/log. `grep -r` performs a recursive search through all files under /var/log, and the `--exclude='*.gz'` option tells grep to skip any files matching the glob pattern '*.gz'. This combination ensures that only non-compressed log files are searched for the string 'ERROR', meeting the requirement exactly.

Option B uses `-R` instead of `-r`. In GNU grep, `-R` implies `--dereference-recursive`, which follows symbolic links into other directories. This could lead to searching outside `/var/log` if any symlinks point elsewhere, making it less precise for the stated requirement. While `-r` and `-R` are often conflated, `-R` is not equivalent to `-r` when symlinks are present, and the standard recursive option is `-r`. Therefore, B is incorrect.

Answer

grep -R --exclude='*.gz' 'ERROR' /var/log

Answer

grep -l 'ERROR' /var/log/*.gz

Answer

grep -v '*.gz' -r 'ERROR' /var/log