Troubleshooting practice questions

ping domain.com

Why it fails: ping sends ICMP echo requests and reports reachability, not DNS resource records, so it cannot return MX entries. It is tempting because it does resolve a hostname to an address, which suits confirming basic name resolution or connectivity, but querying mail exchanger records requires a DNS lookup tool.

host -t mx domain.com

Why it fails: host -t mx does query MX records, but the question's expected answer is the equivalent nslookup form; host is a valid alternative tool rather than the one this exam targets. It is tempting because it genuinely performs the required lookup, and would be correct where host is the available or preferred DNS utility.

nslookup -type=mx domain.com

Why it fails: nslookup -type=mx does query MX records, but the question's expected answer is the equivalent host form; nslookup is a valid alternative tool rather than the one this exam targets. It is tempting because it genuinely performs the required lookup, and would be correct where nslookup is the available or preferred DNS utility.

journalctl -k

Why it fails: journalctl -k shows kernel messages from systemd journal, but not the ring buffer directly.

vmstat

Why it fails: vmstat reports virtual memory, CPU, paging and I/O statistics sampled over intervals; it never exposes kernel log messages or hardware error text. It tempts because it is a diagnostic tool for performance and resource problems, which is a different task from reading the kernel ring buffer.

lsof

Why it fails: lsof lists open files and the processes holding them, including sockets and devices, but it does not read kernel log output. It tempts because it can reveal which process owns a device, useful when tracing a hardware fault, yet it cannot display the ring buffer's error messages.

ip link set eth0 up

Why it fails: ip link set eth0 up only changes the link-layer administrative state; it does not re-read the modified configuration files or apply addressing, so the new settings stay unloaded. It is tempting for quickly toggling an interface, but nmcli connection up or systemctl restart NetworkManager is needed to apply RHEL 8 changes.

systemctl restart network && nmcli dev connect eth0

Why it fails: RHEL 8 uses NetworkManager, and the legacy network.service is not enabled by default, so systemctl restart network fails or does nothing. It is tempting because restarting a service then reconnecting looks thorough, but nmcli connection up or nmcli dev connect alone applies the configuration.

ifconfig eth0 up

Why it fails: ifconfig belongs to the deprecated net-tools package, which is not installed by default on RHEL 8, and it only toggles the link state without applying the modified configuration. It is tempting from familiarity with older distributions, but nmcli connection up re-reads and activates the updated settings.

domain localdomain

Why it fails: The domain directive sets the local domain name appended to unqualified hostnames, not a name server or search list. It would be correct when defining that default domain, but the question asks for directives commonly present alongside nameserver entries.

options timeout:2

Why it fails: While options can appear, it is less common than nameserver and search.

hosts: files dns

Why it fails: The hosts line belongs in /etc/nsswitch.conf, which controls the name service switch order; placing it in /etc/resolv.conf has no effect on resolution. It is tempting because files dns describes lookup precedence, and would be correct when editing nsswitch.conf to make the hosts file consulted before DNS.

Run 'fsck /dev/sda1' from the GRUB command line

Why it fails: fsck repairs filesystem inconsistencies; it cannot rebuild a corrupt initramfs or load a missing kernel module, so it does not address the suspected fault. It is tempting because fsck is a familiar recovery tool, but it is the correct choice for filesystem corruption, not initramfs or module failures.

Use 'systemctl rescue' from the boot prompt

Why it fails: systemctl rescue is a runtime target switch executed from a running system; it cannot be issued at the boot prompt before the kernel and init have loaded. It is tempting as a recovery mode, but it is correct only when the system boots far enough to reach a shell.

tcpdump -i eth0 -f capture.pcap

Why it fails: The -f flag prints foreign IPv4 addresses numerically; it is not a filename argument, so tcpdump treats capture.pcap as a filter expression and no file is written. It is tempting because -f looks like a file switch, but -w is the write option.

tcpdump -w eth0 capture.pcap

Why it fails: The -w flag expects the output filename immediately after it, so tcpdump reads eth0 as that file and capture.pcap as a filter expression, failing. It is tempting because -w does write a pcap file, but the interface must be named separately with -i.

systemd.unit=emergency.target

Why it fails: emergency.target mounts only the root filesystem read-only and starts a minimal shell, but it does not load additional kernel modules or bring up networking, so investigating a suspected missing module is hampered. It is tempting because it does reach a shell, and it would suit recovering from a broken fstab or failed service dependency.

single

Why it fails: The single parameter is a SysV init convention that older init systems interpret as runlevel 1; on a systemd-based RHEL host it is largely ignored, so no rescue shell appears. It is tempting because it historically booted into single-user mode, which would be correct on a legacy SysV distribution rather than a modern systemd one.

nomodeset

Why it fails: nomodeset disables kernel mode setting for graphics drivers, addressing blank or corrupted displays during boot, not a missing kernel module. It is tempting because it is a common GRUB troubleshooting parameter, and it would be the right addition when a system hangs at the graphical splash due to an incompatible GPU driver.

curl --resolve mail.example.com:25:10.0.0.1 smtp://mail.example.com

Why it fails: Using curl's `--resolve` only overrides DNS resolution for the hostname; it still performs a full SMTP transaction and would deliver the message. It is tempting because `--resolve` is genuinely useful for testing virtual-host routing or bypassing stale DNS during migrations, where you need the real protocol exchange against a specific backend IP.

curl -o /dev/null smtp://mail.example.com

Why it fails: Using `-o /dev/null` discards response output but still performs a full SMTP transaction, so a message could be delivered. It is tempting because `-o` is the standard curl flag for redirecting output, and `smtp://` does select the SMTP protocol — but testing connectivity without delivery requires `--mail-rcpt` with an empty message body instead.

curl -I smtp://mail.example.com

Why it fails: The -I flag issues a HEAD request, which SMTP does not support, so the connection test fails rather than exercising the protocol. It is tempting because -I verifies HTTP endpoints cheaply, but SMTP testing needs curl's smtp:// URL with --mail-from and --mail-rcpt to reach the server without sending.

nmcli device show

Why it fails: Shows detailed device info, not a summary status.

ifconfig -a

Why it fails: ifconfig reads kernel interface state directly, so it cannot report NetworkManager connection profiles, their active status or managed devices. It is tempting because it lists interfaces, addresses and flags, and would suit legacy troubleshooting on systems without NetworkManager running.

ip link show

Why it fails: ip link show queries kernel link-layer state, so it cannot display NetworkManager connection names, profiles or their activation status. It is tempting because it enumerates interfaces and operational flags, and would be the right choice for checking link state, MTU or interface up/down status outside NetworkManager.

journalctl -k

Why it fails: journalctl -k reads the systemd journal's kernel entries, not the kernel ring buffer directly; dmesg queries the buffer itself. It is tempting because journald does capture kernel messages on systemd distributions, making it the right choice when you need persistent, timestamped kernel logs across reboots rather than the volatile ring buffer.

iostat

Why it fails: iostat reports per-device I/O throughput and CPU utilisation from /proc/diskstats, exposing no kernel log messages at all. It is tempting because hardware faults often surface as I/O errors, making iostat the correct tool when diagnosing slow disks or high await times rather than reading error text.

vmstat

Why it fails: vmstat samples process, memory, paging and CPU statistics from /proc, containing no kernel ring buffer output. It is tempting because memory or swap pressure can indicate failing hardware, making vmstat the right choice when you need periodic virtual-memory and run-queue counters rather than logged error strings.

fuser /path/to/file

Why it fails: fuser can also identify processes using a file, but lsof is more common and comprehensive.

strace /path/to/file

Why it fails: strace traces the system calls a specified program makes; it cannot report which existing processes currently hold a file open. It is tempting for diagnosing file access failures, but that requires launching the process under strace, whereas the stem needs a query against an already-running process.

ltrace /path/to/file

Why it fails: ltrace traces library calls made by a program you launch, not which running processes hold a file open. It is tempting for diagnosing dynamic linking or library-level failures, but the stem requires identifying current holders of a file, which ltrace cannot report.

traceroute example.com

Why it fails: traceroute maps the network path to a host by varying TTL values; it never queries DNS for an A record. It is tempting when connectivity fails, but it diagnoses routing hops, whereas an A-record lookup requires a resolver tool that sends an explicit DNS query.

ping example.com

Why it fails: ping resolves the name and sends ICMP echo requests, testing reachability rather than querying the DNS server for an A record. It is tempting because resolution failure surfaces as a ping error, but ping reports the symptom instead of returning the record itself.

nslookup example.com A

Why it fails: nslookup syntax is 'nslookup example.com' or 'set type=A'.

tcpdump -n port 10.0.0.1 -w capture.pcap

Why it fails: port expects a port number, so 10.0.0.1 is parsed as an invalid port and host filtering never occurs. It is tempting because -n and -w are both valid, but the correct filter for that address is host 10.0.0.1.

tcpdump -i eth0 -host 10.0.0.1 > capture.pcap

Why it fails: Redirecting stdout writes tcpdump's human-readable text, not the binary pcap stream, so the file cannot be reopened for analysis. It is tempting because redirection appears to save output, but the correct approach is the -w flag, which writes raw packet data in pcap format.

free -h

Why it fails: free -h reports memory and swap usage, not disk I/O counters. It is tempting because swap activity can indirectly indicate memory pressure affecting disk, but it exposes no read/write throughput or utilisation figures; iostat or iotop are the correct tools for disk statistics.

vmstat 1

Why it fails: vmstat 1 reports CPU, memory, and swap statistics, with disk I/O limited to block-in/block-out counts, not per-device utilisation or await. It is tempting because it shows some I/O figures, and would suit general system load monitoring, but iostat provides the required disk I/O detail.

lsof

Why it fails: lsof lists open files and the processes holding them; it shows no throughput, latency, or utilisation metrics. It is tempting because it can reveal which process is accessing a disk, and is correct for identifying file locks or open handles, but not for monitoring I/O statistics.

tcpdump -i any

Why it fails: tcpdump captures and displays packet contents, not a socket-to-process mapping; ss -tulpn or netstat -tulpn list connections with owning processes. It tempts because tcpdump inspects network traffic, which suits packet-level forensic analysis rather than enumerating open sockets.

nmap -sT localhost

Why it fails: nmap scans ports externally but does not list local connections with process info.

lsof -iTCP -sTCP:LISTEN

Why it fails: Lsof can show listening ports but the question asks for the ss command specifically.

nmap -sT localhost

Why it fails: nmap -sT probes ports from outside and reports their state, but it cannot reveal which local process owns each listener. It is tempting because nmap excels at port scanning, and would be correct when auditing a remote host's exposed services rather than local ownership.

netstat -tlnp

Why it fails: Netstat is deprecated; ss is the modern replacement.

dig @8.8.8.8 example.com -t MX

Why it fails: Incorrect. The `dig` command with `-t` flag is not the correct syntax; use `dig @8.8.8.8 example.com MX` or `dig example.com MX @8.8.8.8`.

/etc/nsswitch.conf

Why it fails: /etc/nsswitch.conf controls the order in which name service sources are consulted, but a misordered entry there would affect all lookups, not one hostname. It is the right file when configuring whether DNS, files, or LDAP take precedence system-wide, not for correcting a single stale host entry.

/etc/hosts

Why it fails: /etc/hosts resolves names locally before DNS, so a stale or incorrect entry there would override the correct DNS record and break hostname resolution while IP connectivity still works. It is the correct first check for exactly this symptom, which is why it is not the failing option here.

/etc/sysconfig/network

Why it fails: /etc/sysconfig/network holds hostname and default gateway settings for the local machine, not mappings for remote names. It is the right file when configuring the system's own identity or routing defaults, but it cannot cause a single remote hostname to resolve incorrectly while its IP remains reachable.

rd.break

Why it fails: rd.break is a dracut parameter that interrupts the initramfs before the root filesystem is mounted, dropping to a switch_root prompt rather than single-user mode. It suits recovering a forgotten root password by remounting the real root. Booting the installed system into single-user mode needs a systemd target parameter.

systemd.unit=rescue.target

Why it fails: This is correct for systemd, but the question specifies 'single' as traditional method.

debug

Why it fails: The debug parameter streams verbose kernel messages to the console but does not alter the boot target, so it never reaches single-user mode. It is used when diagnosing hardware or driver initialisation failures, whereas this scenario requires appending single or systemd.unit=rescue.target to the kernel line.

nmcli dev show eth0

Why it fails: nmcli dev show eth0 reports device details including IP4.ADDRESS, which carries the address and prefix, but the question asks for the subnet mask specifically, which ip addr show eth0 presents directly. It is tempting because nmcli is the modern NetworkManager tool for inspecting interfaces.

ip route show

Why it fails: ip route show lists the routing table's destinations, gateways and metrics, and never reports an interface's own address or subnet mask. It is tempting because it is an ip subcommand, but the correct choice for interface addressing is ip addr show eth0, which prints the inet line.

ifconfig eth0

Why it fails: ifconfig eth0 does display the address and netmask, but ifconfig belongs to the deprecated net-tools package, removed from many current distributions, so it may not exist on the system. It is tempting because it is the traditional command, but ip addr show eth0 is the correct modern equivalent.