75 of 96 questions · Page 1/2 · Lxp Troubleshooting topic · Answers revealed
An administrator wants to monitor disk I/O performance in real-time, focusing on metrics like wait time and I/O queue size. Which tool is best suited for this?
iostat -x extended statistics every 1 second.
Why this answer
iostat provides detailed disk I/O statistics including await, svctime, %util, and queue size.
A technician needs to check the kernel ring buffer for hardware errors detected during system boot. Which command should be used?
Correct.
Why this answer
dmesg displays kernel ring buffer messages, which include hardware detection and errors.
A Linux administrator needs to check which services are listening on TCP port 22. Which command should be used?
ss -tlnp shows listening TCP ports with process info; grep filters for port 22.
Why this answer
The 'ss -tlnp' command shows listening TCP sockets with process information, making it suitable for checking services on port 22.
A system administrator wants to review kernel-related log messages from the current boot session. Which journalctl command should be used to filter the kernel messages?
-k displays kernel messages.
Why this answer
journalctl -k shows kernel messages from the current boot.
A Linux system is running slowly. The administrator runs `vmstat 1 5` and sees a high 'wa' value (waiting for I/O). Which of the following commands would help identify which processes are causing the I/O?
strace traces system calls of a process, including I/O calls like read/write.
Why this answer
The 'wa' column indicates I/O wait. The `iotop` command shows per-process I/O usage, but it is not in the options; among the given, `lsof` can show open files, but `strace` can trace system calls including I/O operations.
During boot, a Linux system displays a kernel panic with the message 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?
A missing driver in initramfs prevents mounting the root filesystem.
Why this answer
The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or access the root filesystem. This is most commonly caused by a corrupted or missing initramfs that lacks the necessary storage drivers (e.g., for SATA, NVMe, or LVM) to communicate with the root device. Without these drivers, the kernel cannot read the root filesystem, resulting in a panic.
Exam trap
The trap here is that candidates often confuse this error with filesystem corruption on the boot partition (Option D), but the 'unknown-block(0,0)' message specifically points to the kernel's inability to find the root device, which is a driver/module issue in the initramfs, not a filesystem problem.
How to eliminate wrong answers
Option A is wrong because an incorrect GRUB timeout setting only affects the boot menu delay, not the kernel's ability to mount the root filesystem. Option B is wrong because a faulty RAM module typically causes random crashes, segmentation faults, or memory errors, not a specific VFS mount failure with an unknown block device. Option D is wrong because filesystem corruption on the boot partition would prevent GRUB from loading the kernel or initramfs, but the error here occurs after the kernel is loaded and fails to mount the root filesystem, indicating the initramfs is the issue.
A Linux technician is troubleshooting a system that is experiencing high disk I/O wait times. Which TWO commands can be used to identify disk I/O performance issues? (Choose two.)
vmstat displays system processes, memory, paging, block I/O, traps, and CPU activity, including I/O wait.
Why this answer
iostat provides detailed disk I/O statistics including %util and await. dmesg may show disk errors but not performance stats. vmstat shows I/O wait (wa) column. free shows memory, lsof lists open files.
A system fails to boot with a kernel panic. The administrator wants to recover by accessing a root shell. Which THREE methods can be used to achieve this?
Boots into single-user mode.
Why this answer
Option B is correct because appending 'single' to the kernel command line in GRUB instructs the kernel to boot into single-user mode, which provides a root shell without requiring a password. This is a standard method for recovering from a kernel panic by allowing the administrator to repair filesystems or troubleshoot boot issues.
Exam trap
The trap here is that candidates may confuse the GRUB command line with a Linux shell, mistakenly thinking filesystem repair commands like fsck can be run directly from GRUB, or they may think removing 'quiet' alone grants root access when it only affects verbosity.
A server fails to boot with a kernel panic after a system update. The administrator suspects a corrupt initramfs. Which GRUB boot parameter should be added temporarily to boot into an emergency shell where the filesystem can be repaired?
Correct. rd.break drops to a shell before the root filesystem is mounted, allowing initramfs repair.
Why this answer
The `rd.break` parameter causes systemd to break before the initramfs transitions to the real root, providing an emergency shell for repair. 'single' boots to single-user mode but requires a working initramfs.
A technician needs to check the current memory usage on a Linux system, including buffers and cache. Which command provides the most user-friendly output?
free -h shows memory usage with buffers/cache in human-readable form.
Why this answer
The `free -h` command displays memory usage in a human-readable format (e.g., KiB, MiB, GiB) and explicitly breaks down total, used, free, shared, buffers/cache, and available memory. This makes it the most user-friendly option for quickly assessing current memory usage including buffers and cache.
Exam trap
The trap here is that candidates may choose `cat /proc/meminfo` because it contains all the raw data, but the question specifically asks for the 'most user-friendly' output, which `free -h` provides with its human-readable scaling and clear summary columns.
How to eliminate wrong answers
Option B is wrong because `cat /proc/meminfo` provides raw, detailed memory statistics in a machine-readable format without any human-friendly scaling or summary, making it less user-friendly for a quick check. Option C is wrong because `iostat -m` reports CPU and I/O statistics (in megabytes), not memory usage, buffers, or cache. Option D is wrong because `vmstat -s` displays a summary of virtual memory statistics (including paging, swapping, and CPU events) but does not present buffers/cache in a clear, human-readable layout like `free -h`.
An administrator is troubleshooting a service that fails to start. They want to trace the system calls made by the service binary. Which command should they use?
Correct tool for system call tracing.
Why this answer
strace traces system calls and signals. It is used to debug what a program is doing at the kernel level.
A system administrator needs to capture network traffic on interface eth0, filtering for packets to or from host 10.0.0.1, and save the output to a file for later analysis. Which command accomplishes this?
Correct syntax for interface, host filter, and output file.
Why this answer
tcpdump -i eth0 host 10.0.0.1 -w capture.pcap captures packets with host filter and writes to file.
During boot, a Linux system displays a kernel panic. The administrator suspects a corrupt initramfs. Which GRUB boot parameter can be added to boot into an emergency shell before the initramfs is loaded, allowing repair?
Correct: rd.break breaks before initramfs pivot.
Why this answer
The rd.break parameter stops the boot process before the initramfs is fully loaded, dropping to a shell for troubleshooting.
A system administrator wants to collect network performance statistics over time, including packet loss and latency, to diagnose intermittent connectivity issues. Which tool combines the functionality of ping and traceroute into a single continuous monitoring command?
Correct. mtr is the tool that combines ping and traceroute with continuous monitoring.
Why this answer
mtr (My TraceRoute) continuously sends packets and displays real-time statistics including loss and latency for each hop, combining ping and traceroute.
A technician needs to check the DNS A record for example.com using a specific DNS server at 8.8.8.8. Which command accomplishes this?
Correct syntax: dig @server name type.
Why this answer
dig @8.8.8.8 example.com A queries the specified DNS server for the A record.
An administrator wants to capture network traffic on interface eth0, writing the output to a file for later analysis, without resolving hostnames. Which command accomplishes this?
This captures on eth0, writes to a file, and disables name resolution.
Why this answer
tcpdump -i eth0 -w file.pcap -n captures packets without name resolution and writes to a file.
An administrator needs to capture network traffic on interface eth0 for packets destined to port 443 from host 10.0.0.1, while also writing the capture to a file for later analysis. Which three tcpdump options should be used together? (Choose three.)
Specifies the interface.
Why this answer
tcpdump -i eth0 host 10.0.0.1 and port 443 -w capture.pcap captures the specified traffic and writes to a file.
A user reports that they cannot reach a website. The administrator wants to check the path that packets take to the destination server. Which command should be used?
traceroute shows the hop-by-hop path to the destination.
Why this answer
The `traceroute` command is used to trace the path packets take from the source to a destination host, showing each hop (router) along the way. It uses ICMP echo requests (or UDP packets on Linux) with incrementing TTL values to elicit ICMP Time Exceeded messages from intermediate routers, which reveals the network path. This directly addresses the administrator's need to check the path to the destination server.
Exam trap
Cisco often tests the distinction between `ping` (reachability and latency) and `traceroute` (path discovery), and the trap here is that candidates may choose `ping` because it can indicate connectivity issues, but it does not reveal the specific path or intermediate hops.
How to eliminate wrong answers
Option A is wrong because `ip addr` displays IP addresses and network interface configuration on the local host, not the path packets take to a remote destination. Option B is wrong because `ss` (socket statistics) shows information about local sockets and connections, not the network path or routing hops. Option D is wrong because `ping` tests reachability and measures round-trip time using ICMP echo requests, but it does not show the intermediate hops or the path packets traverse.
A Linux administrator wants to check the history of CPU usage for the past two days using the system activity reporter. Which sar option retrieves data from the daily history file for a specific date?
Correct: -f specifies the history file for a specific date.
Why this answer
sar -f /var/log/sa/saDD reads from the history file for a specific day (DD is the day of month).
An administrator is troubleshooting a service that fails to start with a 'Permission denied' error. The administrator runs `strace -f -o /tmp/strace.log systemctl start myservice`. Which of the following best describes what this command achieves?
Correct: strace traces syscalls, -f follows forks, -o outputs to file.
Why this answer
strace traces system calls; -f follows child processes; -o writes output to file.
A technician needs to trace the system calls made by a running process to debug a performance issue. Which tool should be used?
strace traces system calls.
Why this answer
Option D is correct because `strace -p PID` intercepts and records system calls (kernel-level operations like file I/O, network, and process control) made by a running process, which is exactly what is needed to trace system calls for debugging performance issues. The `-p` flag attaches strace to an existing process by its PID, allowing real-time monitoring of kernel interactions.
Exam trap
The trap here is that candidates confuse `ltrace` (library calls) with `strace` (system calls), as both trace function calls but at different layers of the operating system stack.
How to eliminate wrong answers
Option A is wrong because `gdb -p PID` is a debugger for inspecting and modifying program state at the source-code or assembly level, not for tracing system calls; it focuses on user-space debugging, not kernel call tracing. Option B is wrong because `lsof -p PID` lists open file descriptors (files, sockets, pipes) for a process, but it does not trace system calls or their timing; it provides a static snapshot of open handles, not dynamic call tracing. Option C is wrong because `ltrace -p PID` traces library calls (user-space function calls to shared libraries like glibc), not system calls; it intercepts calls to dynamically linked library functions, whereas the question specifically asks for system calls.
A system administrator is troubleshooting a network issue where a server cannot reach the internet. The server's IP address is 192.168.1.10/24, and the default gateway is 192.168.1.1. Which command should be used to verify the default gateway configuration?
Shows the routing table, including default route.
Why this answer
The `ip route show` command displays the kernel's IPv4 routing table, which includes the default gateway entry (destination 0.0.0.0/0 via 192.168.1.1). This directly verifies whether the default gateway is configured correctly for the server to reach external networks.
Exam trap
The trap here is that candidates often confuse `ip addr show` (which shows IP addresses) with `ip route show` (which shows routing table), leading them to select the wrong command when asked to verify the default gateway.
How to eliminate wrong answers
Option A is wrong because `ip neigh show` displays the ARP cache (neighbor table), showing MAC-to-IP mappings for directly connected hosts, not the default gateway configuration. Option B is wrong because `ip addr show` displays IP addresses and interface properties, not routing information such as the default gateway. Option D is wrong because `ip link show` shows link-layer (Layer 2) interface status and MTU, not Layer 3 routing entries.
A Linux administrator needs to verify which network interfaces are up and their IP addresses on a server. Which command provides this information?
Correct. ip addr shows detailed interface information including IP addresses and status.
Why this answer
The `ip addr` command displays all network interfaces along with their IP addresses, MAC addresses, and status (UP/DOWN).
A Linux administrator needs to check the listening TCP ports on a server. Which command should be used to view only listening TCP ports and the associated processes?
Correctly shows listening TCP ports with process info.
Why this answer
Option D is correct because the `ss -tlnp` command displays only TCP sockets (`-t`), listening sockets (`-l`), numeric addresses/ports (`-n`), and the associated process information (`-p`). This is the modern replacement for `netstat` and is the most direct way to view listening TCP ports and their processes on a Linux system.
Exam trap
The trap here is that candidates often choose `netstat -tlnp` (option C) because it is a familiar legacy command, but the exam expects knowledge of the modern `ss` utility, which is the recommended tool on current Linux distributions and is more likely to be available by default.
How to eliminate wrong answers
Option A is wrong because `lsof -iTCP -sTCP:LISTEN` does show listening TCP ports and processes, but it is not the most standard or efficient command for this task; it is a file-descriptor-based tool that can be slower and less commonly used for this specific purpose in Linux administration. Option B is wrong because `nmap -sT localhost` performs a TCP connect scan against the local host, which is a network scanning tool that can disrupt services and is not designed to simply list listening ports with their associated processes; it also requires root privileges for certain scans and does not show process IDs. Option C is wrong because `netstat -tlnp` does show listening TCP ports and processes, but `netstat` is deprecated on many modern Linux distributions (e.g., RHEL 7+, Ubuntu 16.04+) in favor of `ss`, and may not be installed by default.
A user reports that a web server is unreachable. The administrator runs 'curl -I https://example.com' and gets no response. Which command should be used next to check if the server is reachable at the network level?
Ping tests ICMP echo to verify network reachability.
Why this answer
The `curl -I` command failed to get a response, which could be due to a network-level issue rather than an application-layer problem. The `ping` command uses ICMP echo requests to test basic IP-level connectivity to the host, bypassing higher-layer protocols like HTTP/TLS. If the server is unreachable at the network layer, `ping` will show packet loss or timeouts, confirming a routing or firewall issue.
Exam trap
The trap here is that candidates may choose `ss` or `lsof` because they are familiar with checking local services, but these commands cannot test remote reachability, which is the core of the question.
How to eliminate wrong answers
Option B is wrong because `dig -x example.com` performs a reverse DNS lookup, which checks if an IP address resolves to a hostname, not whether the server is reachable at the network level. Option C is wrong because `lsof -i :443` lists local processes listening on TCP port 443, which only checks if a service is running locally, not if the remote server is reachable. Option D is wrong because `ss -tlnp | grep 443` shows local TCP listening sockets on port 443, which is a local diagnostic tool and cannot verify network-level reachability to a remote host.
A Linux server fails to boot and drops into a GRUB prompt. The administrator needs to boot into single-user mode to repair the system. Which GRUB command should be added to the kernel line temporarily?
Adding 'single' boots into single-user mode.
Why this answer
Adding 'single' to the kernel boot parameters boots into single-user mode.
A technician needs to perform a DNS query to retrieve the mail exchange (MX) record for example.com using a specific DNS server at 8.8.8.8. Which command accomplishes this?
Correct syntax: dig queries the specified server for MX record.
Why this answer
The `dig` command with `@server` specifies the DNS server, and the type can be specified as MX.
During boot, a Linux system displays a kernel panic indicating 'not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?
The initramfs contains drivers needed to mount the root filesystem; if missing or corrupt, mount fails.
Why this answer
The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate or access the root filesystem. This is most commonly caused by a missing or corrupt initramfs (initial RAM filesystem), which contains the necessary drivers and modules to mount the root filesystem. Without a valid initramfs, the kernel has no way to load storage drivers (e.g., for SATA, NVMe, or LVM) and thus fails to mount the root device.
Exam trap
Cisco often tests the distinction between a missing initramfs and a filesystem corruption error; the trap here is that candidates may confuse a 'dirty filesystem' (which causes a different error) with the 'unknown-block(0,0)' message, which is specifically about the kernel's inability to find the root device due to missing drivers in the initramfs.
How to eliminate wrong answers
Option A is wrong because a network configuration error would not prevent the kernel from mounting the root filesystem; network issues typically cause problems later in the boot process (e.g., during network service startup). Option B is wrong because a failed filesystem check due to a dirty filesystem would produce a different error (e.g., 'fsck failed' or 'mount: wrong fs type') and would not result in an 'unknown-block(0,0)' message, which indicates the block device itself is unrecognized. Option C is wrong because an incorrect GRUB timeout value only affects the boot menu countdown; it does not affect the kernel's ability to locate or mount the root filesystem.
An administrator is investigating a network issue where a server cannot connect to an external website. They run `ping 8.8.8.8` successfully, but `ping google.com` fails. Which TWO of the following are the most likely causes? (Choose TWO.)
DNS resolution fails, so hostname cannot be resolved.
Why this answer
Successful ping to IP but failure to hostname indicates DNS resolution problem or incorrect DNS server configuration.
An administrator needs to capture network traffic on interface eth0, filter for packets to/from host 10.0.0.1, and save the output to a file for later analysis. Which command should be used?
Correct syntax: interface, host filter, and -w for output.
Why this answer
Option C is correct because the `tcpdump` command with the `host` filter captures all traffic (both source and destination) to or from the specified IP address, which matches the requirement to filter for packets to/from host 10.0.0.1. The `-i eth0` specifies the interface, and `-w capture.pcap` writes the output to a file for later analysis.
Exam trap
The trap here is that candidates often confuse `src` and `dst` filters as sufficient for capturing all traffic to/from a host, forgetting that `host` is the correct primitive for bidirectional capture.
How to eliminate wrong answers
Option A is wrong because `src 10.0.0.1` only captures packets where the source IP is 10.0.0.1, missing packets destined to that host. Option B is wrong because `dst 10.0.0.1` only captures packets where the destination IP is 10.0.0.1, missing packets sourced from that host. Option D is wrong because the `-n` flag disables name resolution (which is not required by the question) but does not affect the filter; however, the primary issue is that it includes an unnecessary flag, and the question asks for the correct command, not an equivalent one with extra options.
A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?
ss -tlnp shows listening TCP ports with process info, replacing netstat.
Why this answer
The ss command is the modern replacement for netstat, and ss -tlnp shows listening TCP ports with process information.
An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?
strace -p attaches to a process and shows system calls.
Why this answer
strace can attach to a running process with -p PID and display all system calls made by the process.
An administrator wants to check the amount of free memory and swap usage on a system in a human-readable format. Which command should be used?
free -h shows memory in human-readable format.
Why this answer
free -h displays memory and swap usage in human-readable units (e.g., GiB).
An administrator needs to identify which processes are consuming the most CPU and memory resources. Which two commands can provide this information? (Choose two.)
top provides real-time per-process CPU and memory usage.
Why this answer
The `top` command provides a real-time, dynamic view of running processes, displaying CPU and memory usage by default and allowing sorting by resource consumption. The `ps aux --sort=-%mem` command lists all processes with detailed memory and CPU statistics, sorted by memory usage in descending order, making it easy to identify the most resource-intensive processes.
Exam trap
Cisco often tests the distinction between system-wide monitoring commands (like `free`, `vmstat`, `iostat`) and per-process commands (like `top`, `ps`), so candidates mistakenly choose `free -h` or `vmstat` thinking they show per-process CPU/memory details.
An administrator wants to view the kernel ring buffer messages to check for hardware errors. Which command should be used?
dmesg prints kernel ring buffer messages.
Why this answer
dmesg displays kernel ring buffer messages, often used for hardware diagnostics.
A user reports that they cannot access a website by domain name but can access it by IP address. Which of the following is the most likely cause?
Domain name cannot be resolved to IP.
Why this answer
The user can access the website by IP address but not by domain name, which directly indicates that the system is unable to resolve the domain name to its corresponding IP address. This is a classic symptom of a DNS resolution problem, where the DNS client cannot query a DNS server or the DNS server fails to return the correct A or AAAA record. The fact that the web server is reachable by IP confirms that network connectivity and the web service itself are functioning correctly.
How to eliminate wrong answers
Option B is wrong because if the web server were down, the website would be inaccessible by both domain name and IP address, not just by domain name. Option C is wrong because a firewall blocking port 80 would prevent HTTP traffic regardless of whether the destination is specified by domain name or IP address, so both methods would fail. Option D is wrong because an incorrect default gateway would prevent all traffic destined for external networks, including both domain name resolution and direct IP access, so the user would not be able to access the site by IP address either.
An administrator needs to check the current routing table on a Linux system. Which command should be used?
ip route shows the routing table.
Why this answer
The `ip route` command displays the kernel routing table, showing the paths that packets take to reach network destinations. This is the standard tool on modern Linux systems for viewing and manipulating routing entries, replacing the older `route -n` command.
Exam trap
The trap here is that candidates confuse `ip neigh` (which shows ARP entries) with `ip route` (which shows the routing table), as both involve network path information but serve entirely different layers of the network stack.
How to eliminate wrong answers
Option A is wrong because `dig -t A` is a DNS lookup tool that queries for A records, not a routing table viewer. Option B is wrong because `ss -r` is not a valid flag combination; `ss` is used for socket statistics, and the `-r` flag does not exist (the correct flag for resolving hostnames is `-r` in `route`, not `ss`). Option C is wrong because `ip neigh` displays the neighbor table (ARP cache), which maps IP addresses to MAC addresses on the local link, not the routing table.
A technician is troubleshooting a network connectivity issue. They need to trace the path packets take to a remote server and see the round-trip time for each hop. Which command should they use?
Traceroute shows each hop and its RTT.
Why this answer
traceroute (or tracepath) shows the path and RTT per hop.
A user cannot access a website, but other websites work. The administrator wants to see the HTTP response headers from the web server. Which command is most appropriate?
Correct: -I fetches only headers.
Why this answer
curl -I fetches the HTTP headers only, which is useful for debugging web server responses.
A Linux administrator is troubleshooting a slow system. They decide to use vmstat to get an overall picture. Which two of the following fields in vmstat output are most directly related to CPU performance issues? (Choose two.)
High sy indicates CPU is busy with kernel tasks.
Why this answer
The 'us' field shows user time, 'sy' shows system time, 'id' shows idle, and 'wa' shows I/O wait. High 'us' or 'sy' can indicate CPU-bound issues.
An administrator needs to verify DNS resolution for a web server. Which TWO commands can be used to query DNS A records for a given hostname? (Choose two.)
nslookup queries DNS and can return A records.
A technician wants to capture network traffic to analyze a web server issue. Using tcpdump, which THREE options are useful for writing the capture to a file and avoiding name resolution? (Choose three.)
-n disables name resolution.
Why this answer
-w writes to file, -n avoids name resolution, and -i specifies interface.
A system administrator notices that a web server is running but users cannot connect to port 443. Which ss command will show if the server is listening on that port?
Shows TCP listening sockets with process info.
Why this answer
ss -tlnp shows listening TCP sockets with numeric ports and process info. -t for TCP, -l listening, -n numeric, -p process.
A system administrator is troubleshooting a network issue and wants to use a tool that combines ping and traceroute functionality to identify packet loss and latency along the path. Which TWO tools can provide this combined functionality? (Choose two.)
mtr combines ping and traceroute.
Why this answer
mtr combines ping and traceroute. traceroute/tracepath show path but not continuous pings; only mtr does both.
A system administrator notices that the server is performing poorly. Running 'vmstat 1 5' shows high 'wa' values. Which subsystem is most likely experiencing a bottleneck?
Correct. High wa means the CPU is waiting for disk I/O.
Why this answer
wa stands for I/O wait time, indicating the CPU is waiting for disk I/O. High wa suggests a disk bottleneck.
A system administrator is investigating a slow website. The web server is responding but pages load slowly. Which THREE commands can help identify network latency or packet loss?
mtr shows per-hop loss and latency.
Why this answer
B is correct because `mtr` (My TraceRoute) combines the functionality of `ping` and `traceroute` into a single diagnostic tool. It continuously sends ICMP packets to each hop along the path to the target, displaying per-hop latency and packet loss statistics in real time. This makes it ideal for identifying where network latency or packet loss is occurring between the server and the client, which directly addresses the symptom of a slow website.
Exam trap
Cisco often tests the distinction between `traceroute` (which shows a single snapshot of path latency) and `mtr` (which provides ongoing, aggregated statistics including packet loss per hop), leading candidates to overlook `mtr` as a superior tool for diagnosing intermittent or persistent network issues.
An administrator needs to check the kernel ring buffer for hardware error messages after a system crash. Which command should be used?
dmesg displays kernel ring buffer messages.
Why this answer
dmesg shows kernel ring buffer messages including hardware errors. journalctl -k shows kernel messages from systemd journal, but dmesg is the direct command for the ring buffer.
A Linux server is experiencing high CPU usage. Which TWO commands can be used to identify which processes are consuming the most CPU? (Choose two.)
ps with sorting shows processes by CPU usage.
Why this answer
top and ps are standard process monitoring tools that show CPU usage.
Which command displays the current routing table on a Linux system?
Correct.
Why this answer
ip route shows the routing table. The older route command is deprecated.
A web server is not responding on port 443. Using tcpdump to capture traffic on the server, which filter would capture only HTTPS packets?
Correct filter: tcp port 443 captures TCP traffic on port 443.
Why this answer
Port 443 is HTTPS. The filter 'port 443' captures traffic on that port.
A Linux administrator is troubleshooting a service that fails to start. Which TWO commands can be used to view the last 20 lines of the systemd journal for the sshd unit?
Correct: -u for unit, -n for number of lines.
Why this answer
journalctl -u sshd -n 20 shows last 20 lines for the unit. journalctl -u sshd | tail -20 also works. The others use wrong options or units.
A Linux system fails to boot, displaying a 'kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' error. Which of the following is the most likely cause?
A missing or corrupted initramfs can prevent the root filesystem from being mounted.
Why this answer
This error indicates the kernel cannot find the root filesystem, often due to a missing driver or incorrect root= parameter in the boot configuration.
A Linux administrator wants to view all listening TCP ports and the associated processes on a system. Which command should be used?
Correct command.
Why this answer
The `ss -tlnp` command is correct because it displays all TCP listening sockets (`-t` for TCP, `-l` for listening) with numeric addresses (`-n`) and shows the associated process information (`-p`). This is the modern replacement for `netstat` and is the recommended tool on current Linux distributions for socket statistics.
Exam trap
The trap here is that candidates may choose `netstat -tulpn` (Option B) because it is historically familiar, but the XK0-005 exam emphasizes modern tools like `ss` over deprecated commands.
How to eliminate wrong answers
Option A is wrong because `lsof -i TCP` lists all open files associated with TCP connections, including non-listening sockets, and does not filter to only listening ports without additional flags. Option B is wrong because `netstat -tulpn` is a legacy command that may not be installed by default on modern systems and is deprecated in favor of `ss`; while it would show listening TCP ports, it is not the best or recommended command. Option D is wrong because `nmap -sT localhost` performs a TCP connect scan against the local host, which is a network scanning tool used for security auditing, not a standard system administration command to view listening ports and processes.
A server is experiencing intermittent network connectivity issues. The administrator wants to run a continuous test that combines ping and traceroute to monitor the path and packet loss to a target host. Which command should be used?
mtr continuously displays the route and packet loss per hop.
Why this answer
mtr combines ping and traceroute functionality, continuously showing each hop and packet loss statistics.
A Linux administrator is troubleshooting a DNS resolution issue. The system uses /etc/resolv.conf. Which two of the following directives are commonly found in this file? (Choose two.)
nameserver specifies a DNS server.
Why this answer
/etc/resolv.conf typically contains nameserver entries and optionally search and domain directives.
A Linux administrator needs to view all current IPv4 addresses assigned to network interfaces on a system. Which command should be used?
ip addr shows all IP addresses on interfaces.
Why this answer
The 'ip addr' command displays all IP addresses assigned to network interfaces. 'ifconfig' is deprecated, 'ip link' shows link-layer info, and 'hostname -I' only shows primary IPs.
A Linux administrator is troubleshooting a slow web server. They suspect high disk I/O. Which TWO commands can be used to monitor disk I/O statistics?
iostat provides disk I/O utilization and performance metrics.
Why this answer
iostat directly reports disk I/O stats; sar can collect and report I/O statistics historically.
A system administrator is investigating high disk I/O on a server. Which command can provide disk utilization statistics, including average wait time (await) and percentage of CPU time during which I/O requests were issued (%util)?
iostat -x provides extended disk stats including await and %util.
Why this answer
The `iostat` command reports disk I/O statistics including await and %util.
An administrator needs to check the status of NetworkManager connections and devices. Which TWO commands provide this information?
Shows device status (connected, disconnected, etc.).
Why this answer
The `nmcli dev status` command (option B) displays a summary of all NetworkManager-managed devices and their connection states, such as 'connected' or 'disconnected'. The `nmcli con show` command (option C) lists all configured connections (profiles) and their current status, including whether they are active. Together, these two commands provide the administrator with both device-level and connection-level status information required by the question.
Exam trap
The trap here is that candidates often confuse `nmcli device show` (detailed device info) with `nmcli dev status` (summary status), or assume that legacy commands like `ifconfig` or `ip link show` can report NetworkManager-specific connection states, which they cannot.
A system is running slowly and the administrator suspects a memory leak. Which THREE commands or tools can be used to analyze memory usage and identify processes consuming excessive memory? (Choose three.)
ps lists processes sorted by memory usage.
Why this answer
free shows overall memory. ps can sort by RSS. vmstat shows memory stats. iostat is disk I/O. strace traces system calls, not memory usage directly.
An administrator wants to test SMTP connectivity to a mail server without actually delivering an email. Which curl command is most appropriate?
curl can handle smtp:// and shows verbose output.
A technician suspects a process is leaking file descriptors. Which command can be used to list open files associated with a specific PID?
lsof -p lists open files for the process.
Why this answer
lsof -p PID lists open files for that process. strace traces system calls, ltrace library calls, and top shows resource usage.
A technician wants to check the current IP address and subnet mask of the eth0 interface. Which command should they use?
Correct: ip addr shows IPv4/IPv6 addresses and masks.
Why this answer
The `ip addr show dev eth0` (or `ip addr`) displays IP addresses and subnet masks.
A system is experiencing high load average. The administrator runs 'vmstat 1 5' and sees a high 'wa' value. What does this indicate?
wa stands for I/O wait time.
Why this answer
The 'wa' column in vmstat output indicates the percentage of time the CPU is waiting for I/O operations to complete. A high 'wa' value means the CPU is idle because it is blocked waiting for disk I/O, which directly points to high disk I/O wait. This is a classic indicator of a storage bottleneck.
Exam trap
The trap here is that candidates confuse 'wa' with memory swapping or CPU usage, but vmstat columns are distinct: 'wa' is specifically I/O wait, while swapping is shown in 'si' and 'so', and CPU usage in 'us' and 'sy'.
How to eliminate wrong answers
Option B is wrong because high memory swapping activity is indicated by high 'si' (swap in) and 'so' (swap out) columns in vmstat, not the 'wa' column. Option C is wrong because high CPU usage by user processes is shown in the 'us' column, not 'wa'. Option D is wrong because high network I/O is not directly measured by vmstat; it would be diagnosed using tools like netstat or iftop, and 'wa' specifically reflects disk I/O wait, not network.
Which command shows the IP address, link status, and other configuration details for all network interfaces on a Linux system?
Correct: ip addr displays interface configuration.
Why this answer
ip addr shows IP addresses and link information for all interfaces.
A technician suspects that a DNS resolution issue is causing connectivity problems. Which command can be used to query the DNS server for an A record for 'example.com'?
dig queries DNS for A record.
Why this answer
The `dig` command is a flexible DNS lookup utility that can query specific record types. Using `dig example.com A` directly queries the DNS server for the IPv4 address (A record) of 'example.com', making it the correct choice for diagnosing DNS resolution issues.
Exam trap
Cisco often tests the distinction between commands that perform name resolution (like `ping` or `traceroute`) versus those that directly query DNS servers for specific record types, leading candidates to choose `ping` or `traceroute` when a DNS-specific query is needed.
How to eliminate wrong answers
Option A is wrong because `traceroute` traces the network path to a host but does not perform DNS queries for specific record types; it relies on the system's resolver for name resolution. Option C is wrong because `ping` tests network connectivity using ICMP echo requests and uses the system resolver to resolve names, but it cannot query for a specific DNS record type like an A record. Option D is wrong because `nslookup` can query DNS records, but the syntax `nslookup example.com A` is incorrect; the proper syntax is `nslookup -type=A example.com` or `nslookup` in interactive mode, and the given form will likely fail or return unexpected results.
A server running RHEL 8 has intermittent network connectivity. The administrator wants to view the current DNS resolver configuration. Which file should be examined?
Contains nameserver IP addresses.
Why this answer
/etc/resolv.conf contains nameserver entries. /etc/nsswitch.conf defines order, /etc/hosts for static mapping, and /etc/sysconfig/network-scripts/ifcfg-* for interface config.
After a kernel panic, the system fails to boot. The administrator suspects a missing kernel module. Which command line should be added to the GRUB boot parameters to access a rescue shell and investigate?
rd.break stops before pivot_root, giving a shell to inspect initramfs.
Why this answer
Adding 'rd.break' breaks before pivot_root and drops to a shell for troubleshooting. 'single' boots to single-user mode but may not help if module is missing. 'emergency' is for systemd targets.
A system administrator is troubleshooting a service that fails to start. They want to see the recent logs for that specific service unit. Which journalctl command should be used?
Correct: -u filters by unit.
Why this answer
The `-u` option in `journalctl` filters logs by the systemd unit name, allowing you to view recent logs specifically for a service. This is the correct approach when troubleshooting a service that fails to start, as it isolates the relevant log entries without noise from other system messages.
Exam trap
The trap here is that candidates may confuse `journalctl -u` with other common options like `-k` (kernel) or `-p` (priority), or fall back to legacy syslog commands like `tail -f /var/log/syslog`, which do not directly filter by systemd unit and may miss critical journal-only logs.
How to eliminate wrong answers
Option A is wrong because `journalctl -k` shows kernel messages only, not service-specific logs. Option C is wrong because `tail -f /var/log/syslog` is a traditional syslog command that does not filter by systemd unit and may not capture all journald entries, especially on systems using only journald. Option D is wrong because `journalctl -p err` filters by priority level (error and above), which may omit informational or debug messages that are crucial for diagnosing a startup failure.
A user reports that they cannot access a web server at 192.168.1.100. The administrator wants to check if the server is reachable and measure round-trip time. Which command is most appropriate?
ping tests connectivity and shows RTT.
Why this answer
The `ping` command sends ICMP Echo Request packets to the target host and waits for ICMP Echo Reply packets, which directly tests reachability and measures round-trip time (RTT). This is the most appropriate tool for the administrator's stated goal of checking if the server is reachable and measuring RTT.
Exam trap
The trap here is that candidates confuse `nmap -sn` (host discovery) with connectivity testing and RTT measurement, or they think `traceroute` measures end-to-end RTT when it actually measures per-hop latency.
How to eliminate wrong answers
Option A is wrong because `nmap -sn` performs a ping sweep (ICMP, TCP SYN to port 443/80, or ARP) to discover live hosts, but it does not provide round-trip time measurements; it only reports whether the host is up. Option B is wrong because `traceroute` shows the path (hops) packets take to reach the destination and measures per-hop latency, not the end-to-end round-trip time to the server itself. Option D is wrong because `ss -tlnp` lists listening TCP sockets on the local system and cannot be used to test reachability to a remote host; it would not even accept an IP address as a filter in that syntax.
A Linux administrator is troubleshooting a DNS resolution issue. They need to query the MX record for example.com using a specific DNS server at 8.8.8.8. Which command should they use?
Correct: dig MX example.com @8.8.8.8 queries the MX record from the specified server.
Why this answer
dig @server type name queries a specific DNS server for the specified record type.
A Linux administrator needs to find which process is using a specific file. Which command provides this information?
lsof shows processes that have the file open.
Why this answer
The `lsof` command (List Open Files) is the correct tool to identify which process is using a specific file. When invoked with a file path as an argument, `lsof` displays the PID, process name, and other details of any process that has the file open. This directly answers the administrator's need to find the process using that file.
Exam trap
The trap here is that candidates may confuse `fuser` with `lsof` because both can identify processes using a file, but `fuser` is less detailed and not the primary tool for this task in the exam context.
How to eliminate wrong answers
Option B is wrong because `fuser` identifies processes using a file or socket, but it outputs only PIDs by default, not process names or detailed information like `lsof` does; while it can work, `lsof` is the more comprehensive and standard command for this task. Option C is wrong because `strace` is a debugging tool that intercepts and records system calls made by a process, not a command to find which process is using a file. Option D is wrong because `ltrace` intercepts library calls, not system calls, and is used for debugging dynamic library interactions, not for identifying processes that have a file open.
After modifying the network configuration on a RHEL 8 system using NetworkManager, what command should be used to apply the changes without restarting the network service?
Brings up the connection with updated settings.
Why this answer
nmcli con up <connection> activates the connection with new settings. nmcli connection reload reloads from disk but does not apply to active connections.
A Linux system experiences intermittent network connectivity. The administrator suspects a faulty network cable or switch port. Which TWO of the following commands can provide information about link status, errors, and packet drops on the interface? (Choose TWO.)
Shows state (UP/DOWN) and error counters.
Why this answer
ip link show displays link status and error counters; ethtool can show detailed link and error statistics.
An administrator needs to check the kernel ring buffer for hardware error messages from the current boot. Which command displays this information?
Correct: dmesg shows kernel ring buffer messages.
Why this answer
dmesg displays the kernel ring buffer, which includes hardware-related messages from the current boot.
Ready to test yourself?
Try a timed practice session using only Lxp Troubleshooting questions.