17 of 92 questions · Page 2/2 · Troubleshooting topic · Answers revealed
A Linux administrator needs to view all listening TCP ports and the associated processes on a server. Which command should be used?
Correct: ss -tlnp shows listening TCP ports with process info.
Why this answer
The ss command with -tlnp options shows listening TCP ports with process information, replacing netstat.
During boot, the system drops into an emergency target. Which command can be used to repair the root filesystem from this environment?
Correct; fsck can be run if the partition is unmounted or mounted read-only.
Why this answer
In emergency mode, the root filesystem is often mounted read-only. fsck can check and repair filesystems, but requires the filesystem to be unmounted.
A user reports that they cannot reach a website by name, but they can reach it by IP address. Which file should be checked first for possible misconfiguration?
Correct. DNS resolver configuration.
Why this answer
The /etc/resolv.conf file contains DNS resolver settings. If it is incorrect, name resolution will fail.
A technician wants to check the disk I/O statistics, focusing on the average I/O wait time and utilization percentage. Which command provides this information?
Correct: iostat -x shows extended stats including %util and await.
Why this answer
iostat displays disk I/O statistics including %util (utilization) and await (average I/O wait time).
After modifying the network configuration on a RHEL 8 system, the administrator wants to bring up the interface without rebooting. Which command sequence should be used?
nmcli con up brings up the connection associated with the interface.
Why this answer
nmcli con up ifcfg-eth0 activates the connection. If using legacy scripts, ifup eth0 would work, but nmcli is the modern method for NetworkManager.
An administrator needs to capture network traffic on interface eth0, filtering only packets from host 192.168.1.1, and write the output to a file for later analysis. Which command accomplishes this?
Correct: host captures both directions.
Why this answer
tcpdump -i eth0 host 192.168.1.1 -w capture.pcap captures packets from the specified host on eth0 and writes to a file.
A system is experiencing high memory usage. The administrator wants to see a brief summary of memory usage in human-readable format, including buffers and cache. Which command is most appropriate?
Correct: free -h shows memory usage with buffers and cache.
Why this answer
free -h displays memory usage in human-readable format, including buffers and cache.
Which command is used to trace the network path to a destination host, showing each hop along the way, and is similar to traceroute but does not require root privileges by default?
Correct: tracepath traces the path without requiring root.
Why this answer
tracepath is similar to traceroute but uses UDP probes and does not require root, making it more accessible.
A server running RHEL 8 fails to boot with a 'Dependency failed for /data' error. The /data filesystem is an ext4 partition on /dev/sdb1. Which sequence of steps should be taken to repair the filesystem?
Rescue mode ensures filesystem unmounted; fsck repairs it.
Why this answer
To repair a filesystem, it must be unmounted; using a rescue environment (e.g., systemd emergency target) ensures the partition is not in use.
An administrator is troubleshooting a DNS issue and needs to query the authoritative name servers for example.com. Which dig command should be used?
NS record returns authoritative name servers.
Why this answer
dig example.com NS queries the name servers (NS records). A asks for IPv4, MX for mail, and ANY is often blocked.
A user wants to look up the mail exchange (MX) records for a domain. Which command should be used?
dig domain.com MX queries the MX records.
Why this answer
The `dig` command is a flexible DNS lookup utility that can query any record type by specifying it after the domain name. `dig domain.com MX` directly queries the DNS for mail exchange records, which specify the mail servers responsible for receiving email for the domain. This is the most straightforward and commonly used command for this purpose in Linux.
Exam trap
The trap here is that candidates may think `nslookup` or `host` are incorrect because they are older tools, but they can technically query MX records; however, the exam tests the understanding that `dig` is the preferred and most comprehensive DNS query tool for Linux troubleshooting.
How to eliminate wrong answers
Option B is wrong because `ping` uses ICMP to test network reachability and does not perform DNS record lookups, so it cannot retrieve MX records. Option C is wrong because `host -t mx domain.com` is a valid command, but the question asks for the command that should be used; while `host` can query MX records, `dig` is more detailed and is the standard tool for DNS troubleshooting. Option D is wrong because `nslookup -type=mx domain.com` is a valid command, but `nslookup` is deprecated in many modern Linux distributions and is less flexible than `dig`; the question expects the most appropriate command, which is `dig`.
An administrator needs to capture network traffic on interface eth0 to a file for later analysis. Which tcpdump command is correct?
Correct. The order of options does not matter; this command writes packets from eth0 to capture.pcap.
Why this answer
Both A and C are valid tcpdump commands. tcpdump accepts options in any order, so '-w capture.pcap -i eth0' (A) and '-i eth0 -w capture.pcap' (C) are functionally equivalent. Option B uses '-f' which is for filter expression, not output file. Option D is invalid because '-w' expects a filename, not an interface.
A system is experiencing high disk I/O wait. Which command can provide disk I/O statistics such as requests per second and average wait time?
iostat -x gives extended stats like r/s, w/s, await, %util.
Why this answer
iostat reports disk I/O statistics including r/s, w/s, await, %util. vmstat shows memory and CPU stats, free shows memory, sar can show I/O but iostat is I/O-specific.
A system fails to boot with a kernel panic. The administrator suspects a corrupt initramfs or missing kernel module. Which three methods could be used to recover the system? (Choose three.)
From a live environment, you can repair the initramfs or kernel modules.
Why this answer
At the GRUB menu, editing boot parameters to add 'rd.break' drops into an emergency shell; adding 'single' boots into single-user mode; booting from a live CD allows chroot and repair.
A system administrator needs to check the kernel ring buffer for hardware error messages. Which command should be used?
dmesg reads the kernel ring buffer for hardware and driver messages.
Why this answer
The `dmesg` command is the standard tool for printing the kernel ring buffer, which contains messages from the kernel, including hardware error messages, device driver initialization, and system boot logs. It directly reads from `/dev/kmsg` or the syslog system call, making it the correct choice for diagnosing hardware issues at the kernel level.
Exam trap
CompTIA often tests the distinction between `dmesg` and `journalctl -k`, where candidates mistakenly choose `journalctl -k` because it also shows kernel messages, but the question specifically asks for the kernel ring buffer, which `dmesg` accesses directly without requiring systemd journal services.
How to eliminate wrong answers
Option B is wrong because `journalctl -k` displays kernel messages from the systemd journal, but it relies on the journal daemon being active and may not capture early boot or pre-journal kernel ring buffer messages; it is an indirect method compared to `dmesg`. Option C is wrong because `vmstat` reports virtual memory statistics, process activity, and CPU usage, not kernel ring buffer or hardware error messages. Option D is wrong because `lsof` lists open files and the processes using them, which is unrelated to kernel ring buffer content.
An administrator is investigating a security incident and needs to list all open network connections on a server, including listening and established connections, with process information. Which of the following commands can provide this information? (Choose all that apply.)
lsof -i -P -n lists open files including network sockets, but the question asks for exactly two commands; netstat and ss are the standard pair.
Why this answer
All three commands (lsof -i -P -n, netstat -tulpn, and ss -tulpn) can display open network connections with process information. lsof lists open files, and the -i flag filters for network connections; netstat and ss with the -tulpn flags show TCP/UDP listening and established connections along with the associated process ID.
A Linux engineer is investigating high disk I/O on a server. Which command provides disk I/O statistics including %util, await, r/s, and w/s?
iostat -x provides extended disk I/O stats including %util, await, r/s, w/s.
Why this answer
iostat reports CPU and disk I/O statistics, with columns like %util, await, r/s, and w/s.
Ready to test yourself?
Try a timed practice session using only Troubleshooting questions.