CCNA System Management Questions — Page 1 of 3

Multi-Selectmedium

A Linux administrator needs to display the amount of disk space used by each mounted filesystem. Which two commands can be used? (Choose two.)

Select 1 answer

A.du -h /

B.mount | column -t

C.lsblk

D.fdisk -l

E.df -h

AnswersE

Correct: df -h shows disk space usage per filesystem.

Why this answer

df -h displays disk space usage in human-readable format. du -h / shows disk usage for directories but not per filesystem. lsblk shows block devices, not usage. fdisk is for partitioning. mount shows mount points but not space.

Practice this question →

MCQmedium

An administrator wants to replace all occurrences of 'oldstring' with 'newstring' in a configuration file named config.cfg, and save the changes. Which sed command should be used?

A.sed -i 's/oldstring/newstring/' config.cfg

B.sed -i 's/oldstring/newstring/g' config.cfg

C.sed -i 's/oldstring/newstring/gi' config.cfg

D.sed 's/oldstring/newstring/' config.cfg

AnswerB

Correct: in-place global substitution.

Why this answer

Option B is correct because it uses -i for in-place editing and g to replace all occurrences on each line. Option A has -i but lacks g, so it replaces only the first occurrence per line. Option C adds an unnecessary i flag for case-insensitive matching, which deviates from the requirement to replace 'oldstring' exactly as given.

Option D lacks -i, so changes are only printed to stdout and not saved.

Practice this question →

MCQmedium

A system administrator wants to change the priority of a running process with PID 1234 to a lower priority (higher nice value). Which command should be used?

A.renice -n 10 -p 1234

B.renice -n -10 -p 1234

C.chrt -p 10 1234

D.nice -n 10 -p 1234

AnswerA

renice changes the priority of a running process.

Why this answer

renice is used to change the nice value of an existing process. A higher nice value means lower priority.

Practice this question →

MCQeasy

Which command is used to display the contents of the systemd journal for a specific unit?

A.systemctl status unit

B.dmesg

C.journalctl -f

D.journalctl -u

AnswerD

-u specifies the unit.

Why this answer

journalctl -u unitname displays logs for the specified systemd unit.

Practice this question →

MCQmedium

A Linux administrator needs to locate all files in the /var/log directory that have been modified within the last 2 days and contain the word 'error' (case-insensitive). Which command accomplishes this?

A.find /var/log -mtime +2 -exec grep -li 'error' {} \;

B.find /var/log -name '*error*' -mtime -2

C.find /var/log -mtime -2 -exec grep -l 'error' {} \;

D.find /var/log -mtime -2 -exec grep -li 'error' {} \;

AnswerD

Correctly finds files modified within 2 days and searches for 'error' case-insensitively.

Why this answer

The correct command uses -mtime -2 to find files modified less than 2 days ago, and -exec grep -li 'error' to perform a case-insensitive search for 'error' in file contents, listing filenames. Option A uses -mtime +2 (files older than 2 days). Option B uses -name to match filenames, not content.

Option C uses grep -l without -i, so it would miss case variations.

Practice this question →

MCQmedium

A system administrator needs to find all files in the /etc directory that are larger than 1 MB and are regular files. Which find command accomplishes this?

A.find /etc -type f -size +1M

B.find /etc -size +1MB -type f

C.find /etc -type f -size 1M

D.find /etc -type d -size +1M

E.find /etc -size +1M -type f

AnswerA

Correct: type f for regular files, size +1M for larger than 1 MB.

Why this answer

-type f selects regular files, -size +1M selects files larger than 1 MB. The other options have incorrect syntax or type.

Practice this question →

MCQhard

A technician wants to create a symbolic link in /usr/local/bin that points to /opt/myapp/bin/start.sh. The technician has write permissions to /usr/local/bin. Which command should be used?

A.ln -s /opt/myapp/bin/start.sh /usr/local/bin/start.sh

B.ln -s /usr/local/bin/start.sh /opt/myapp/bin/start.sh

C.ln /opt/myapp/bin/start.sh /usr/local/bin/start.sh

D.cp -s /opt/myapp/bin/start.sh /usr/local/bin/start.sh

AnswerA

Creates a symbolic link.

Why this answer

ln -s target linkname creates a symbolic link. The target should be the file to link to, and the link name is the new symlink.

Practice this question →

Multi-Selectmedium

A Linux administrator needs to view real-time information about running processes, including CPU and memory usage. Which TWO commands can be used for this purpose? (Choose two.)

Select 2 answers

A.ps aux

B.top

C.systemctl list-units

D.htop

E.kill -l

AnswersB, D

Shows real-time processes.

Why this answer

top and htop provide real-time process information with CPU/memory usage. ps gives a snapshot; kill is for terminating; systemctl manages services.

Practice this question →

MCQmedium

A technician needs to kill a process with PID 1234 that is not responding to normal termination. Which command sends SIGKILL?

A.kill 1234

B.kill -15 1234

C.kill -9 1234

D.kill -1 1234

AnswerC

kill -9 sends SIGKILL, forcefully killing the process.

Why this answer

kill -9 sends SIGKILL, which forcefully terminates the process.

Practice this question →

MCQeasy

Which of the following directories in the Filesystem Hierarchy Standard (FHS) contains variable data files such as logs, spool files, and temporary files that persist across reboots?

A./opt

B./etc

C./tmp

D./var

AnswerD

Correct: /var holds variable data like logs and spool.

Why this answer

/var is for variable data like logs, spool, and temporary files that persist. /tmp is for temporary files that may be cleared on reboot. /etc is for configuration files. /opt is for optional add-on software.

Practice this question →

MCQhard

A Linux administrator wants to limit the disk space used by the /var/log directory. Which tool can be used to set disk usage quotas for a filesystem?

A.edquota

B.repquota

C.quotaon

D.quotacheck

AnswerA

edquota is used to edit user/group quotas.

Why this answer

quota is the traditional tool; however, xfs_quota is for XFS. The question is general, so quota is correct.

Practice this question →

Multi-Selectmedium

A technician wants to extract the third column of a tab-separated file and sort the output uniquely. Which three commands can be combined using pipes to achieve this? (Choose three.)

Select 3 answers

A.cut -f3

B.tee

C.wc -l

D.sort

E.uniq

AnswersA, D, E

Extracts third field.

Why this answer

cut extracts columns, sort sorts them, uniq removes duplicates. tee would write to file and stdout, not needed.

Practice this question →

Multi-Selecthard

A technician needs to remove all files in /tmp that are owned by the user 'jdoe' and have not been accessed in 10 days. Which THREE commands or options would be part of a correct solution? (Select THREE.)

Select 3 answers

A.find /tmp -user jdoe -atime +10 -exec rm {} \;

B.find /tmp -user jdoe -atime +10 -delete

C.find /tmp -user jdoe -delete

D.find /tmp -user jdoe -atime +10

E.find /tmp -user jdoe -mtime +10

AnswersA, B, D

Correct: alternative way to delete files matching the condition.

Why this answer

find /tmp -user jdoe -atime +10 -delete finds files belonging to jdoe, with last access more than 10 days ago, and deletes them. -atime measures access time. -delete is a direct action. Alternatively, using -exec rm {} \; works. The correct components include the path, -user, -atime, and action.

Practice this question →

MCQmedium

A service called 'myapp' fails to start automatically after a system reboot. The administrator wants to ensure the service starts at boot. Which systemctl command should be used?

A.systemctl daemon-reload

B.systemctl start myapp

C.systemctl enable myapp

D.systemctl reenable myapp

AnswerC

Correct: enable configures the service to start at boot.

Why this answer

The `systemctl enable myapp` command creates the necessary symlinks in the systemd unit configuration directories (typically `/etc/systemd/system/multi-user.target.wants/`) so that the `myapp` service is automatically started at boot. This is the correct approach because the question specifically asks to ensure the service starts after a reboot, not to start it immediately.

Exam trap

The trap here is that candidates often confuse `systemctl start` (immediate start) with `systemctl enable` (boot-time start), or they mistakenly think `systemctl reenable` is a valid command for re-enabling a service.

How to eliminate wrong answers

Option A is wrong because `systemctl daemon-reload` reloads the systemd manager configuration and unit files, but it does not enable a service to start at boot. Option B is wrong because `systemctl start myapp` starts the service immediately in the current session but does not configure it to start automatically after a reboot. Option D is wrong because `systemctl reenable myapp` is not a valid systemctl command; the correct command to re-enable a service is `systemctl enable myapp` (which can be run again to recreate symlinks), and `reenable` is a common misconception or typo.

Practice this question →

Multi-Selecthard

An administrator wants to locate files that have the SUID or SGID special permission set. Which three find commands can accomplish this? (Choose three.)

Select 3 answers

A.find / -perm 2000

B.find / -perm /6000

C.find / -perm /4000

D.find / -perm /2000

E.find / -perm 4000

AnswersB, C, D

This finds files with either SUID or SGID set.

Why this answer

The find command with -perm can search for permissions in symbolic or octal modes, and using -4000 or -2000 finds SUID or SGID respectively.

Practice this question →

MCQeasy

A Linux administrator needs to locate all files in /var/log that were modified more than 7 days ago. Which command should be used?

A.find /var/log -mtime +7

B.grep -mtime +7 /var/log

C.ls -mtime +7 /var/log

D.locate -mtime +7 /var/log

AnswerA

Correct: find with -mtime +7.

Why this answer

The find command with -mtime +7 finds files modified more than 7 days ago. locate uses a database and does not support -mtime; grep is for text search; ls does not filter by modification time.

Practice this question →

MCQmedium

An administrator wants to list all USB storage devices attached to the system. Which command provides this information?

A.lsblk

B.fdisk -l

C.lspci

D.lsusb

AnswerA

Correct: lsblk lists block devices including USB drives.

Why this answer

lsblk lists block devices; USB storage typically appears as sda, sdb, etc.

Practice this question →

Multi-Selectmedium

A system administrator needs to view the last 15 lines of a log file that is constantly being updated. Which TWO commands can be used to achieve this? (Choose two.)

Select 2 answers

A.tail -f /var/log/syslog

B.head -n 15 /var/log/syslog

C.cat -n /var/log/syslog | tail -15

D.tail -n 15 /var/log/syslog

E.less +15 /var/log/syslog

AnswersA, D

Follows file, showing new lines; can be used alone or with -n.

Why this answer

tail -n 15 shows the last 15 lines; tail -f shows new lines as they are written. head -n 15 shows the first 15 lines.

Practice this question →

MCQhard

A system administrator needs to install a package from a local RPM file without resolving dependencies automatically. Which command should be used?

A.rpm -i package.rpm

B.rpm -U package.rpm

C.yum localinstall package.rpm

D.dnf install ./package.rpm

AnswerA

Correct: rpm -i installs the package locally without dependency resolution.

Why this answer

The `rpm -i package.rpm` command installs the specified RPM package without automatically resolving dependencies. The `-i` flag stands for 'install' and, unlike `-U` (upgrade) or higher-level tools like `yum` or `dnf`, it does not attempt to fetch or satisfy missing dependencies from configured repositories. This is the correct choice when the requirement is to install a local RPM file while explicitly avoiding automatic dependency resolution.

Exam trap

The trap here is that candidates often confuse `rpm -i` with `rpm -U` or assume that higher-level tools like `yum` or `dnf` can be used to install local RPMs without dependency resolution, but those tools are designed to automatically resolve dependencies, which directly violates the question's constraint.

How to eliminate wrong answers

Option B is wrong because `rpm -U package.rpm` performs an upgrade or install, but it still does not resolve dependencies automatically; however, the question specifically asks for a command that installs without resolving dependencies, and `-U` is semantically an upgrade operation, not a pure install. Option C is wrong because `yum localinstall package.rpm` is a higher-level command that resolves and installs dependencies from repositories, which contradicts the requirement to avoid automatic dependency resolution. Option D is wrong because `dnf install ./package.rpm` also resolves dependencies automatically using DNF's dependency solver, making it unsuitable for the stated requirement.

Practice this question →

MCQeasy

A Linux administrator wants to change the permissions of a file to allow the owner to read, write, and execute; the group to read and execute; and others to read only. Which chmod command should be used?

A.chmod 764 file

B.chmod 744 file

C.chmod 755 file

D.chmod 754 file

AnswerD

Correct: owner rwx, group r-x, others r--.

Why this answer

Octal 754 corresponds to rwxr-xr--: owner rwx (7), group r-x (5), others r-- (4).

Practice this question →

MCQmedium

A system administrator wants to view the last 10 lines of a log file and also save those lines to another file for analysis. Which command should the administrator use?

A.head -n 10 file | tee output.txt

B.cat file | tee output.txt

C.tail -n 10 file | tee output.txt

D.tee output.txt < tail -n 10 file

AnswerC

Correct: tail shows last 10 lines, tee saves to file and displays.

Why this answer

tail -n 10 file | tee output.txt displays the last 10 lines and writes them to output.txt. Option A uses head, which shows first lines. Option C uses cat, which shows entire file.

Option D uses tee without pipe, which is incorrect.

Practice this question →

Multi-Selectmedium

A Linux administrator is configuring file permissions for a shared directory used by a development team. The administrator wants to ensure that any new files created in the directory inherit the group ownership of the directory and that the group has read and write permissions on those files. Which TWO actions should the administrator take? (Choose TWO.)

Select 2 answers

A.Use the command 'chmod g+s /shared' to set the SGID bit on the directory.

B.Use the command 'setfacl -m g:devteam:rw /shared' to set an ACL on the directory.

C.Use the command 'chmod 2770 /shared' to set permissions with SGID and full access for owner and group.

D.Use the command 'umask 0007' to set the umask for the directory.

E.Use the command 'setfacl -d -m g:devteam:rw /shared' to set a default ACL on the directory.

AnswersA, E

SGID on a directory causes new files to inherit the directory's group.

Why this answer

Setting the SGID bit (chmod g+s) on the directory ensures new files inherit the group ownership. Using an ACL with default entries (setfacl -d) can set default permissions for new files.

Practice this question →

MCQhard

An administrator runs 'rpm -V httpd' and sees output like 'S.5....T. /etc/httpd/conf/httpd.conf'. What does this indicate?

A.The file has been deleted

B.The file has incorrect permissions

C.The file is corrupted

D.The file has been modified since installation

AnswerD

The letters indicate attributes that differ from the RPM database.

Why this answer

The rpm -V command verifies installed packages. The output shows that the file size, MD5 checksum, and modification time have changed from the package's original.

Practice this question →

MCQhard

An administrator is troubleshooting a service that fails to start. The administrator wants to view the last 50 lines of the service's journal log entries from the current boot. Which journalctl command should be used?

A.journalctl -f -n 50 -u service

B.journalctl -u service --since today

C.journalctl -x -n 50 -u service

D.journalctl -u service -b -n 50

AnswerD

Correct.

Why this answer

journalctl -u service -b -n 50 shows entries for the unit (-u), from current boot (-b), last 50 lines (-n 50).

Practice this question →

MCQeasy

Which command displays the amount of disk space used and available on mounted filesystems in a human-readable format (e.g., GB, MB)?

A.df -h

B.lsblk

C.du -h

D.fdisk -l

AnswerA

Correct: df -h shows filesystem disk space usage in human-readable format.

Why this answer

The `df -h` command displays disk space usage for all mounted filesystems, with the `-h` flag converting raw block counts into human-readable units like GB or MB. This is the standard Linux utility for reporting filesystem capacity, usage, and available space, making it the correct choice for the question.

Exam trap

The trap here is that candidates confuse `du -h` (which shows directory-level usage) with `df -h` (which shows filesystem-level capacity), leading them to select option C when the question explicitly asks for disk space on mounted filesystems.

How to eliminate wrong answers

Option B is wrong because `lsblk` lists block devices (e.g., disks and partitions) and their attributes, but it does not show disk space usage or available capacity in human-readable format. Option C is wrong because `du -h` estimates file and directory space usage, not the total disk space used and available on mounted filesystems. Option D is wrong because `fdisk -l` displays partition table information for block devices, not current filesystem usage or available space.

Practice this question →

MCQhard

A developer wants to grant a user named 'john' read and write permissions to a file, but the file currently has an ACL that gives 'jane' full control. The administrator wants to add an ACL entry for 'john' without modifying existing entries. Which command accomplishes this?

A.setfacl -x u:john:rw file

B.setfacl -b u:john:rw file

C.chmod u+rw file; setfacl -m u:john:rw file

D.setfacl -m u:john:rw file

AnswerD

Correct: -m modifies ACL, u:john:rw sets user john to rw.

Why this answer

setfacl -m adds or modifies an ACL entry without affecting others.

Practice this question →

MCQmedium

A technician notices a script fails to execute because the user does not have permission. The script currently has permissions 644. The technician needs to add execute permission for the owner only. Which command accomplishes this?

A.chmod a+x script.sh

B.chmod 755 script.sh

C.chmod u+x script.sh

D.chmod 744 script.sh

AnswerC

This adds execute permission for the owner only.

Why this answer

The script currently has permissions 644, meaning the owner has read/write (6), group has read (4), and others have read (4). The requirement is to add execute permission for the owner only. The command `chmod u+x script.sh` adds (+) execute (x) permission to the user (u) — the owner — without affecting group or others.

This is the precise and minimal command to achieve the goal.

Exam trap

The trap here is that candidates often confuse 'add execute for owner only' with setting permissions to 755 or using `a+x`, not realizing that `u+x` is the precise symbolic method to add execute solely for the user class without affecting group or others.

How to eliminate wrong answers

Option A is wrong because `chmod a+x script.sh` adds execute permission for all (a) — user, group, and others — which grants more permissions than required. Option B is wrong because `chmod 755 script.sh` sets permissions to rwxr-xr-x, which gives execute to owner, group, and others, not just the owner. Option D is wrong because `chmod 744 script.sh` sets permissions to rwxr--r--, which gives execute to the owner but also changes the owner's read/write permissions to read/write/execute (which is acceptable) and leaves group and others unchanged; however, it is not the minimal command (it explicitly sets all bits rather than just adding execute) and could inadvertently change other permissions if the original permissions were different, making it less precise than `chmod u+x`.

Practice this question →

MCQhard

A process with PID 2345 is not responding. The administrator wants to force stop the process immediately. Which command should be used?

A.kill -9 2345

B.kill -1 2345

C.pkill -15 -f processname

D.kill -15 2345

AnswerA

Correct: SIGKILL (9) forces immediate termination.

Why this answer

SIGKILL (signal 9) forcefully terminates a process. kill -9 2345 sends SIGKILL to PID 2345.

Practice this question →

MCQmedium

A technician needs to search a log file for lines containing either 'ERROR' or 'FATAL' and display the line numbers. Which command accomplishes this?

A.grep -v -E 'ERROR|FATAL' logfile

B.grep -r -n 'ERROR|FATAL' logfile

C.grep -n -E 'ERROR|FATAL' logfile

D.grep -i 'ERROR|FATAL' logfile

AnswerC

Correct: -n for line numbers, -E for extended regex.

Why this answer

grep -n -E 'ERROR|FATAL' logfile uses extended regex with alternation and -n for line numbers. -i ignores case, but the stem does not mention case-insensitive; -v inverts match; -r is recursive.

Practice this question →

Multi-Selecthard

A system administrator needs to locate all regular files in /var/log that have been modified within the last 7 days and have a size greater than 10 MB. The administrator then needs to compress these files using gzip. Which THREE commands or options should be used together to accomplish this? (Choose THREE.)

Select 3 answers

A.find

B.locate

C.gzip

D.find /var/log -type f -mtime -7 -size +10M -exec gzip {} \;

E.xargs

AnswersA, C, D

find is the primary command used to locate files based on the specified criteria.

Why this answer

find locates files based on criteria like -type f for regular files, -mtime for modification time, -size for size. The -exec option runs a command on each file found. gzip compresses files.

Practice this question →

Multi-Selecthard

A system administrator is configuring a new disk partition for a database server. The disk has been partitioned as /dev/sdb1. Which three steps are necessary to make the filesystem available for use? (Choose three.)

Select 3 answers

A.Run fsck to check the filesystem

B.Mount the partition with mount

C.Add an entry to /etc/fstab

D.Create a filesystem with mkfs

E.Set a label with e2label

AnswersB, C, D

Required to attach the filesystem to the directory tree.

Why this answer

To use a new partition, you must create a filesystem (mkfs), mount it (mount), and add an entry to /etc/fstab for persistent mounting.

Practice this question →

Multi-Selectmedium

An administrator wants to monitor real-time system resource usage to identify performance bottlenecks. Which two commands are suitable? (Choose two.)

Select 2 answers

A.top

B.vmstat

C.iostat

D.htop

E.sar

AnswersA, D

top shows real-time processes and resource usage.

Why this answer

top and htop provide real-time process and resource monitoring.

Practice this question →

MCQeasy

A user wants to create a hard link named 'linkfile' to an existing file 'original'. Which command accomplishes this?

A.mv original linkfile

B.ln -s original linkfile

C.ln original linkfile

D.cp original linkfile

AnswerC

Correct: ln creates a hard link.

Why this answer

The ln command without -s creates a hard link. ln -s creates a symbolic link. cp copies the file; mv moves it.

Practice this question →

MCQmedium

An administrator needs to replace all occurrences of 'oldhost' with 'newhost' in the file /etc/hosts. Which sed command should be used?

A.sed -e 's/oldhost/newhost/' /etc/hosts

B.sed -n 's/oldhost/newhost/gp' /etc/hosts

C.sed 's/oldhost/newhost/' /etc/hosts

D.sed -i 's/oldhost/newhost/g' /etc/hosts

AnswerD

This replaces all occurrences in-place.

Why this answer

sed -i 's/oldhost/newhost/g' /etc/hosts performs an in-place substitution globally.

Practice this question →

MCQeasy

A technician wants to find all files owned by user 'jane' in the /home directory. Which command accomplishes this?

A.grep -r jane /home

B.ls -lR /home | grep jane

C.locate jane /home

D.find /home -type f -user jane

AnswerD

Correct: find with -user jane.

Why this answer

The find command with -user option searches for files owned by a specific user.

Practice this question →

MCQeasy

Which command would a Linux administrator use to locate all files in the /var/log directory that have been modified within the last 7 days?

A.ls -lt /var/log | head -n 7

B.grep -mtime -7 /var/log

C.locate -mtime -7 /var/log

D.find /var/log -mtime -7

AnswerD

Correct. find -mtime -7 finds files modified within the last 7 days.

Why this answer

The find command with -mtime -7 finds files modified less than 7 days ago. The other options are either incorrect or not suitable for this task.

Practice this question →

MCQmedium

A technician needs to check which package provides the file /usr/bin/foo on a CentOS 8 system. Which command should be used?

A.rpm -qf /usr/bin/foo

B.rpm -V /usr/bin/foo

C.rpm -qi /usr/bin/foo

D.rpm -ql /usr/bin/foo

AnswerA

-qf queries the package that owns the file.

Why this answer

On RPM-based systems, rpm -qf queries the package that owns a given file.

Practice this question →

MCQmedium

Which command would display the disk usage of each file and directory in /home in a human-readable format, but only showing one level deep?

A.du -h --max-depth=1 /home

B.du -hs /home

C.du -h /home

D.df -h /home

AnswerA

Correct: one level deep, human-readable.

Why this answer

du -h --max-depth=1 /home shows human-readable sizes for each item one level deep.

Practice this question →

MCQeasy

A Linux administrator needs to view the contents of a compressed log file without decompressing it. Which command should be used?

A.zcat

B.cat

C.bzcat

D.gunzip

AnswerA

zcat reads compressed files and outputs to stdout.

Why this answer

zcat reads compressed files and outputs the contents to stdout without decompressing them to disk.

Practice this question →

MCQmedium

An administrator wants to view the last 20 lines of a log file and continue to watch for new entries. Which command should be used?

A.tail -20

B.head -20

C.tail -f

D.less -N

AnswerC

Correct: -f follows the file for new lines.

Why this answer

tail -f follows the file and displays new lines as they are added.

Practice this question →

MCQeasy

Which command displays the current default umask value for a user?

A.chmod

B.set

C.umask

D.ls -l

AnswerC

Running umask alone shows the current value.

Why this answer

The umask command without arguments prints the current umask value.

Practice this question →

MCQeasy

Which directory in the Filesystem Hierarchy Standard (FHS) contains variable data such as logs and spool files?

A./opt

B./etc

C./var

D./tmp

AnswerC

/var contains variable data like logs.

Why this answer

/var is designated for variable data that changes frequently, such as logs, spool directories, and temporary files.

Practice this question →

MCQmedium

An administrator needs to permanently mount an ext4 filesystem on /dev/sdb1 to the /data directory. Which file must be edited to ensure the mount persists across reboots?

A./etc/sysconfig/network

B./etc/default/grub

C./etc/fstab

D./etc/mtab

AnswerC

Correct: /etc/fstab is the filesystem table for permanent mounts.

Why this answer

/etc/fstab contains filesystem mount points and options that are automatically mounted at boot.

Practice this question →

MCQmedium

A system administrator notices that a process with PID 1234 is consuming excessive CPU. The administrator wants to terminate this process gracefully. Which command should be used?

A.killall 1234

B.kill 1234

C.pkill -9 1234

D.kill -9 1234

AnswerB

Default signal is SIGTERM (15), which requests graceful termination.

Why this answer

kill sends a signal; by default it sends SIGTERM (15), which asks the process to terminate gracefully. SIGKILL (9) is forceful.

Practice this question →

MCQeasy

A Linux administrator needs to change the permissions of a file to allow the owner to read and write, the group to read only, and others to have no access. Which chmod command should be used?

A.chmod 640 file

B.chmod 600 file

C.chmod 755 file

D.chmod 644 file

AnswerA

Correct: 640 sets rw-r-----.

Why this answer

The symbolic representation rw-r----- corresponds to octal 640. rw- = 4+2+0=6, r-- = 4+0+0=4, --- = 0+0+0=0.

Practice this question →

MCQeasy

Which command displays the amount of free and used disk space on all mounted file systems in a human-readable format?

A.du -h /

B.lsblk -h

C.mount -h

D.df -h

AnswerD

Correct: df -h shows free/used space.

Why this answer

df -h shows disk space in human-readable units. du shows disk usage per directory; lsblk lists block devices; mount shows mounted filesystems but not space usage.

Practice this question →

MCQmedium

A Linux system fails to boot, and the administrator wants to access a minimal environment to repair the system. Which systemd target should be specified in the kernel command line to achieve this?

A.emergency.target

B.rescue.target

C.multi-user.target

D.graphical.target

AnswerB

Rescue.target is a single-user mode for maintenance.

Why this answer

The rescue.target provides a minimal environment for system recovery.

Practice this question →

MCQmedium

Which command displays the number of lines, words, and characters in a file?

A.wc file.txt

B.wc -w file.txt

C.cat file.txt | wc -l

D.stat file.txt

AnswerA

wc displays line, word, and byte counts.

Why this answer

The `wc` command without any options displays the number of lines, words, and characters in a file, in that order. By default, `wc` counts newline characters (lines), whitespace-delimited tokens (words), and bytes (characters) in the specified file. This makes option A the correct choice for displaying all three counts.

Exam trap

The trap here is that candidates often confuse the default behavior of `wc` (which shows all three counts) with options like `-w` or `-l` that only show one metric, or they mistakenly think `stat` provides line/word counts.

How to eliminate wrong answers

Option B is wrong because `wc -w` only counts the number of words in the file, not lines or characters. Option C is wrong because `cat file.txt | wc -l` only counts the number of lines (newline characters) in the file, not words or characters. Option D is wrong because `stat file.txt` displays file metadata such as size, permissions, and timestamps, but does not count lines, words, or characters.

Practice this question →

Multi-Selectmedium

A Linux administrator is investigating a performance issue on a server. The administrator needs to identify which processes are consuming the most CPU and memory, and then adjust their priority. Which TWO commands should the administrator use to accomplish this? (Choose TWO.)

Select 2 answers

A.kill

B.ps

C.top

D.nice

E.renice

AnswersC, E

top displays dynamic real-time information about running processes, including CPU and memory usage.

Why this answer

top shows real-time process information including CPU and memory usage. renice adjusts the priority of running processes.

Practice this question →

MCQeasy

A user wants to change the permissions of a file to give the owner full control, the group read and execute, and others no access. Which of the following chmod commands will achieve this?

A.chmod 750 file

B.chmod 700 file

C.chmod 770 file

D.chmod 755 file

AnswerA

Correct: owner rwx, group r-x, others ---.

Why this answer

750 in octal gives rwx (7) to owner, r-x (5) to group, --- (0) to others. Option A is correct. Option B is 700 (rwx------) giving group no access.

Option C is 770 (rwxrwx---) giving group write. Option D is 755 (rwxr-xr-x) giving others read/execute.

Practice this question →

MCQmedium

A user reports that they cannot access a file because permission is denied. The file's permissions are -rwsr-xr-x. What special permission is set?

A.No special permission

B.SUID

C.Sticky bit

D.SGID

AnswerB

The s in the user execute position means SUID is set.

Why this answer

The 's' in the owner execute position indicates SUID (Set User ID) is set.

Practice this question →

MCQmedium

An administrator needs to replace all occurrences of '192.168.1.1' with '10.0.0.1' in a configuration file named config.txt. Which sed command should be used to perform an in-place edit?

A.sed -i 's/192.168.1.1/10.0.0.1/g' config.txt

B.sed -i 's/192.168.1.1/10.0.0.1/' config.txt

C.sed -e 's/192.168.1.1/10.0.0.1/g' config.txt

D.sed 's/192.168.1.1/10.0.0.1/g' config.txt > config.txt

AnswerA

Correct in-place substitution.

Why this answer

sed -i 's/192.168.1.1/10.0.0.1/g' config.txt performs global replacement in-place.

Practice this question →

MCQmedium

Which of the following commands will display the last 10 lines of a log file and also output new lines as they are appended?

A.head -f logfile

B.less +F logfile

C.tail -f logfile

D.cat logfile

AnswerC

Correct: -f follows the file.

Why this answer

The `tail -f logfile` command displays the last 10 lines of the file by default and then continues to monitor the file for new lines, outputting them as they are appended. The `-f` (follow) option keeps the file open and polls for changes, making it the standard tool for real-time log monitoring.

Exam trap

The trap here is that candidates may confuse `tail -f` with `less +F` (which also works but uses a different syntax) or mistakenly think `head` can follow a file, but the exam expects precise knowledge of the `tail -f` command as the standard for real-time log viewing.

How to eliminate wrong answers

Option A is wrong because `head -f` is not a valid command; `head` does not support a `-f` flag, and even if it did, `head` reads from the beginning of the file, not the end. Option B is wrong because `less +F` does not exist; the correct syntax to follow a file in `less` is `less +F` (uppercase F) which enters follow mode, but the lowercase `+F` is invalid and will cause an error. Option D is wrong because `cat logfile` simply outputs the entire file content to stdout and does not provide any real-time monitoring or line limiting.

Practice this question →

MCQhard

A system administrator runs 'umask 027' in a Bash shell. What will be the default permissions for a new directory created in that shell? (Assume no other umask changes.)

A.rwxrwxr-x (775)

B.rwxrwxrwx (777)

C.rw-rw-r-- (664)

D.rwxr-x--- (750)

AnswerD

Correct: 777 - 027 = 750.

Why this answer

The umask value 027 subtracts permissions from the base 777 for directories. 777 minus 027 equals 750, which translates to rwxr-x---. The owner gets full permissions (rwx), the group gets read and execute (r-x), and others get no permissions (---).

Exam trap

CompTIA often tests the distinction between file and directory base permissions (666 vs 777) and the fact that umask subtracts from the base, not from a fixed value like 755.

How to eliminate wrong answers

Option A is wrong because it represents permissions 775 (rwxrwxr-x), which would result from a umask of 002, not 027. Option B is wrong because it represents permissions 777 (rwxrwxrwx), which would result from a umask of 000, not 027. Option C is wrong because it represents permissions 664 (rw-rw-r--), which is the default for files (base 666) with a umask of 002, not for directories with umask 027.

Practice this question →

Multi-Selecthard

An administrator wants to change the runlevel/target to a state where only a minimal set of processes is running, and network services are disabled. Which two systemd targets achieve this? (Choose two.)

Select 2 answers

A.graphical.target

B.rescue.target

C.poweroff.target

D.multi-user.target

E.emergency.target

AnswersB, E

Correct: rescue.target provides a minimal environment with network disabled.

Why this answer

Option B (rescue.target) is correct because it boots the system into a single-user mode with a minimal set of processes and no network services, allowing administrative tasks like filesystem repairs. Option E (emergency.target) is correct because it starts an even more minimal environment with only a root shell on the console, also disabling network services. Both targets satisfy the requirement of minimal processes and disabled networking.

Exam trap

The trap here is that candidates often confuse rescue.target with multi-user.target, thinking that disabling networking means any non-graphical target, but multi-user.target still enables network services by default.

Practice this question →

Multi-Selecthard

A system administrator is investigating a performance issue and wants to view kernel-related messages. Which three commands can be used to access kernel ring buffer messages? (Choose three.)

Select 3 answers

A.tail -f /var/log/syslog

B.dmesg

C.cat /var/log/kern.log

D.journalctl -k

E.systemctl status

AnswersB, C, D

Directly prints kernel ring buffer.

Why this answer

dmesg displays kernel ring buffer. journalctl -k shows kernel messages from systemd journal. cat /var/log/kern.log if available, but /var/log/messages often contains kernel messages; however, the question expects common commands.

Practice this question →

MCQhard

During the boot process, after the kernel is loaded and the initramfs is executed, which component is responsible for starting the user-space services and managing the system state?

A.initramfs

B.systemd

C.GRUB2

D.Kernel

AnswerB

Correct: systemd is the init system that starts services and manages targets.

Why this answer

Systemd is the init system that starts services and manages targets. GRUB2 is the bootloader that loads the kernel. The kernel itself initializes hardware.

Initramfs is an initial root filesystem used to load drivers.

Practice this question →

MCQmedium

An administrator needs to find all files in /var/log that have been modified within the last 2 days. Which find command should be used?

A.find /var/log -mtime -2

B.find /var/log -mtime +2

C.find /var/log -atime -2

D.find /var/log -ctime 2

AnswerA

Correct: -mtime -2 finds files modified in last 2 days.

Why this answer

-mtime -2 means modified less than 2 days ago (i.e., within the last 48 hours).

Practice this question →

MCQeasy

Which directory in the FHS contains essential user command binaries that are needed in single-user mode?

A./usr/bin

B./sbin

C./opt/bin

D./bin

AnswerD

Correct: /bin contains essential user binaries.

Why this answer

Option D is correct because the /bin directory, as defined by the Filesystem Hierarchy Standard (FHS), contains essential user command binaries (e.g., ls, cp, mv) that are required for booting, repairing, and operating the system in single-user mode. Single-user mode mounts only the root filesystem, so /bin must be on the root partition to provide these critical utilities without relying on other filesystems like /usr.

Exam trap

The trap here is that candidates confuse /sbin with /bin, assuming all essential binaries are in /sbin, but /sbin is specifically for system administration tools, while /bin holds the user command binaries required in single-user mode.

How to eliminate wrong answers

Option A is wrong because /usr/bin contains non-essential user binaries that are not guaranteed to be available in single-user mode, as /usr may be a separate filesystem that is not mounted during early boot or recovery. Option B is wrong because /sbin contains system administration binaries (e.g., fdisk, init) intended for system maintenance, not general user commands, and is separate from the user command binaries specified in the question. Option C is wrong because /opt/bin is not a standard FHS directory; /opt is reserved for add-on application software packages, and its binaries are not part of the essential system binaries needed in single-user mode.

Practice this question →

MCQhard

A Linux server is booting but stops at a prompt with the message 'Give root password for maintenance'. Which systemd target is the system likely trying to reach?

A.emergency.target

B.graphical.target

C.multi-user.target

D.rescue.target

AnswerA

Correct: emergency.target provides a minimal environment with a root shell for maintenance.

Why this answer

emergency.target gives a single-user root shell with minimal services. rescue.target also gives a shell but with more services loaded. The prompt 'Give root password for maintenance' is typical of emergency mode.

Practice this question →

MCQhard

A system administrator wants to ensure a service starts automatically at boot and also starts immediately without rebooting. Which systemctl commands should be used?

A.systemctl enable service && systemctl restart service

B.systemctl start --now service

C.systemctl start service && systemctl enable service

D.systemctl enable --now service

AnswerC

This starts the service now and enables it for future boots. The order can be swapped, but this works.

Why this answer

Option C is correct because 'systemctl start service' starts the service immediately, and 'systemctl enable service' configures it to start automatically at boot. Using '&&' ensures both commands execute sequentially. Option D (systemctl enable --now) is not a valid systemctl command—the '--now' flag is only applicable with 'enable' in systemd, but it is not recognized as a standalone option; thus, it does not meet the requirement.

Options A and B are incomplete: A does not enable the service for future boots, and B starts the service but does not enable it.

Practice this question →

Multi-Selecthard

A Linux administrator needs to identify which of the following filesystems are journaling filesystems commonly used in Linux. (Choose three.)

Select 3 answers

A.swap

B.ext4

C.FAT32

D.btrfs

E.xfs

AnswersB, D, E

ext4 is a journaling filesystem.

Why this answer

ext4, xfs, and btrfs are journaling filesystems. FAT32 is not journaling. swap is a swap space, not a filesystem.

Practice this question →

Multi-Selectmedium

A security analyst wants to identify all lines in a log file that contain either 'ERROR' or 'WARNING' and also contain 'timeout'. Which three commands can be used to achieve this? (Select THREE).

Select 4 answers

A.grep -v 'ERROR|WARNING' logfile | grep timeout

B.grep -E 'ERROR.*timeout|WARNING.*timeout' logfile

C.grep -E 'ERROR|WARNING' logfile | grep timeout

D.sed -n '/ERROR\|WARNING/p' logfile | grep timeout

E.awk '/ERROR|WARNING/ && /timeout/' logfile

AnswersB, C, D, E

Correct: uses regex to match both conditions on same line.

Why this answer

The question asks to select three commands, but all four options B, C, D, and E are actually correct. Option B uses grep -E with alternation to match lines containing 'ERROR' immediately followed by 'timeout' or 'WARNING' immediately followed by 'timeout'. Option C pipes the output of grep for 'ERROR|WARNING' into a second grep for 'timeout', effectively requiring both patterns.

Option D uses sed to print lines matching 'ERROR' or 'WARNING', then pipes to grep for 'timeout'. Option E uses awk with the condition '/ERROR|WARNING/ && /timeout/' to print lines containing both. Option A is incorrect because -v inverts the match and the pattern 'ERROR|WARNING' is not interpreted as alternation without -E (so it matches literal string 'ERROR|WARNING').

Thus, while the problem states 'select three,' all four listed commands (B, C, D, E) achieve the goal, so any three would be valid.

Practice this question →

MCQhard

A system administrator wants to find all files in /var/log that have been modified in the last 7 days and are larger than 10MB, then delete them interactively. Which command accomplishes this?

A.find /var/log -mtime -7 -size 10M -exec rm -i {} \;

B.find /var/log -mtime -7 -size +10M -delete

C.find /var/log -mtime +7 -size +10M -ok rm {} \;

D.find /var/log -mtime -7 -size +10M -ok rm {} \;

AnswerD

Correct flags and interactive deletion with -ok.

Why this answer

find with -mtime -7 (modified within 7 days) and -size +10M (larger than 10MB) and -ok rm {} \; (prompt before deletion) matches the requirement.

Practice this question →

MCQmedium

After making changes to /etc/grub.d/ and /etc/default/grub, an administrator needs to regenerate the GRUB2 configuration file. Which command should be used?

A.grub2-install

B.grub2-set-default 0

C.grub2-mkconfig -o /boot/grub2/grub.cfg

D.update-grub

AnswerC

Correct: regenerates grub.cfg.

Why this answer

After modifying /etc/grub.d/ scripts or /etc/default/grub, the GRUB2 configuration file must be regenerated to apply the changes. The command `grub2-mkconfig -o /boot/grub2/grub.cfg` reads the configuration snippets and defaults, then writes the final boot menu configuration to the specified output file. This is the standard method on RHEL/CentOS 7+ and other distributions using GRUB2.

Exam trap

The trap here is that candidates confuse `grub2-mkconfig` with `grub2-install` or `update-grub`, or assume any command with 'grub' in the name will update the configuration, but only `grub2-mkconfig -o` actually rebuilds the file from the source scripts and defaults.

How to eliminate wrong answers

Option A is wrong because `grub2-install` installs GRUB2 to the boot sector of a disk (e.g., MBR or GPT), not regenerate the configuration file. Option B is wrong because `grub2-set-default 0` only sets the default boot entry index in the GRUB environment, it does not rebuild the configuration file. Option D is wrong because `update-grub` is a Debian/Ubuntu-specific wrapper script that calls `grub-mkconfig`; it is not available on RHEL-based systems where `grub2-mkconfig` is the correct command.

Practice this question →

MCQeasy

Which of the following directories is defined by the Filesystem Hierarchy Standard (FHS) as containing essential user command binaries that need to be available in single-user mode?

A./sbin

B./opt/bin

C./usr/bin

D./bin

AnswerD

/bin contains essential user command binaries.

Why this answer

/bin contains essential command binaries required for booting and single-user mode.

Practice this question →

MCQmedium

A system administrator wants to find all files in /var/log that have been modified in the last 7 days and are larger than 100MB. Which command should be used?

A.find /var/log -mtime +7 -size +100M

B.find /var/log -atime -7 -size +100M

C.find /var/log -mtime -7 -size +100M

D.find /var/log -mtime -7 -size -100M

AnswerC

Correct: -mtime -7 for last 7 days, -size +100M for >100MB.

Why this answer

The -mtime -7 finds files modified within 7 days, -size +100M finds files larger than 100MB.

Practice this question →

MCQeasy

Which command is used to query the status of a service managed by systemd?

A.journalctl -u servicename

B.service servicename status

C.systemctl list-units --type=service

D.systemctl status servicename

AnswerD

Correct: systemctl status shows service status.

Why this answer

systemctl status shows whether a service is active, enabled, and recent log entries.

Practice this question →

MCQmedium

A process is consuming excessive CPU and needs to be stopped immediately. The process ID is 4582. Which command should be used?

A.kill -9 4582

B.kill -1 4582

C.kill -STOP 4582

D.kill -15 4582

AnswerA

SIGKILL (9) immediately terminates the process.

Why this answer

kill -9 sends SIGKILL, which forcefully terminates the process immediately.

Practice this question →

MCQmedium

An administrator wants to ensure a service starts automatically at boot on a systemd-based system. Which command should be used?

A.systemctl enable service

B.systemctl start service

C.systemctl status service

D.systemctl reload service

AnswerA

Enables the service to start at boot.

Why this answer

systemctl enable sets the service to start automatically at boot.

Practice this question →

MCQmedium

An administrator wants to find all files in /var/log that have been modified within the last 2 days and have a .log extension. Which command should be used?

A.find /var/log -mtime 2 -name *.log

B.find /var/log -type f -mtime -2 -name "*.log"

C.locate --mtime -2 *.log /var/log

D.ls -la /var/log | grep "\.log$" | head -20

AnswerB

This correctly finds files modified within the last 2 days with .log extension.

Why this answer

The find command with -mtime -2 finds files modified less than 2 days ago, and -name '*.log' matches the extension.

Practice this question →

MCQeasy

Which command is used to create a symbolic link named 'link' pointing to the file 'original'?

A.symlink original link

B.ln -s link original

C.ln original link

D.ln -s original link

AnswerD

This creates a symbolic link from link to original.

Why this answer

ln -s creates a symbolic link.

Practice this question →

MCQmedium

An administrator wants to grant a specific user, 'jdoe', read and write access to a file that is owned by root:root with permissions 640. The administrator does not want to change the file's owner or group. Which approach should be used?

A.Use setfacl -m u:jdoe:rw file

B.Change file owner to jdoe

C.Use chmod o+rw file

D.Add jdoe to the root group

AnswerA

Correct: ACL entry for user jdoe grants read and write without altering standard permissions.

Why this answer

ACLs allow granting permissions to a specific user without changing the file's owner or group. setfacl -m u:jdoe:rw file sets read-write ACL for user jdoe.

Practice this question →

MCQhard

A developer creates a hard link to a file and then deletes the original file. What happens to the hard link?

A.The hard link is broken and cannot be accessed.

B.The hard link still contains the data and is accessible.

C.The hard link is automatically converted to a copy of the file.

D.The hard link becomes a symbolic link.

AnswerB

Correct: The hard link still points to the same inode, so the data remains.

Why this answer

Hard links share the same inode; deleting the original file removes one link, but the data remains accessible via the hard link until all links are removed.

Practice this question →

MCQhard

An administrator wants to list all files in the current directory that are larger than 1 MB. Which find command is correct?

A.find . -type f -size +1M

B.find . -type f -size 1M

C.find . -type f -size +1MB

D.find . -size +1M -type f

AnswerA, D

This correctly finds files larger than 1 megabyte.

Why this answer

The correct syntax is 'find . -type f -size +1M'. Option D is incorrect because the order of tests matters in some implementations; the '-type f' should come before the size condition to ensure only regular files are considered before the size filter.

Practice this question →