How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the LFCS exam, each with detailed explanations and wrong-answer analysis.

How should I approach LFCS scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Linux Foundation Certified System Administrator LFCS questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Linux Foundation Certified System Administrator LFCS practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

LFCS

exam code

Linux Foundation

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A system administrator is troubleshooting a user's report that a command 'myapp' is not found. The administrator checks the PATH variable and sees it includes /usr/local/bin. The administrator verifies that the binary 'myapp' exists in /usr/local/bin with permissions 755. However, running 'myapp' still fails with 'command not found'. What is the most likely cause?

A
The user's PATH does not include /usr/local/bin
Why wrong: The administrator checked the PATH and it includes the directory, but this is the administrator's PATH, not the user's. However, the question implies the administrator is testing as the user or the user's environment is similar.
B
The binary is a shell script missing a shebang
Why wrong: If it's a binary, no shebang needed. If it's a script, missing shebang would cause different error.
C
The shell's hash table is stale; run 'hash -r'
Correct: the shell caches command locations, and may not have updated after the binary was added.
D
The binary does not have execute permission for the user
Why wrong: Permissions are 755, so execute is allowed.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

An administrator is troubleshooting a server that runs a critical application. The server has 16 GB of RAM and 8 CPU cores. The administrator notices that the server becomes very slow during peak hours. Analysis of 'iostat -x 1' shows that the average wait time (await) for the main disk (sda) is consistently above 1000 ms, while the average service time (svctm) is around 5 ms. What is the most likely cause?

A
The CPU is overloaded, causing processes to wait for CPU time.
Why wrong: CPU overload would show high CPU utilization and possibly high run queue, but the iostat output shows high I/O wait, not CPU wait.
B
The system is using swap space heavily, causing disk I/O.
Why wrong: Heavy swap usage would cause high disk utilization, but the svctm would likely be higher because swapping involves random I/O, and the await would be high as well. However, the low svctm suggests the disk is serving requests quickly once they start, which is not typical of swap.
C
The disk is experiencing hardware errors.
Why wrong: Hardware errors typically cause high svctm (due to retries) and may show errors in dmesg, not low svctm with high await.
D
There is a large queue of I/O requests waiting to be serviced.
A high await with low svctm indicates that the disk is fast but there are many requests queued, so each request spends a long time waiting before being serviced.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

A user is unable to write to a file. The output of 'ls -l file' shows '-r--r--r--'. Which command will grant write permission to the owner?

A
chmod o+w file
Why wrong: Adds write permission for others, not the owner.
B
chmod u+w file
Adds write permission for the owner.
C
chmod a+w file
Why wrong: Adds write permission for all (including group and others), but the question specifies the owner.
D
chmod g+w file
Why wrong: Adds write permission for the group, not the owner.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

A developer reports that a compiled binary 'app' fails to execute with 'Permission denied' error when run from a mounted directory '/mnt/software'. The binary has execute permissions for all users. What is the most likely cause?

A
SELinux is blocking execution.
Why wrong: SELinux would generate an AVC denial, not a simple 'Permission denied'.
B
The binary is linked against missing libraries.
Why wrong: Missing libraries produce a different error message.
C
The filesystem is mounted with the 'noexec' option.
The 'noexec' mount option prevents execution of binaries.
D
The binary is setuid but owned by a user other than root.
Why wrong: Setuid without root ownership is ignored but does not cause 'Permission denied'.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A system administrator configures a web server using systemd. After creating a custom service unit file, the administrator runs `systemctl daemon-reload` but the service still fails to start with a 'Unit not found' error. What is the most likely cause?

A
The administrator forgot to run `systemctl enable` before starting the service.
Why wrong: Enable creates symlinks for automatic start, but is not required for manual start.
B
The unit file is placed in /usr/lib/systemd/system/ instead of /etc/systemd/system/.
Unit files for custom services should be in /etc/systemd/system/; /usr/lib/systemd/system/ is for distribution-provided units.
C
The administrator is not in the 'systemd' group.
Why wrong: No special group is required to manage systemd services; root or sudo is sufficient.
D
The service name was misspelled in the `systemctl start` command.
Why wrong: While possible, the 'Unit not found' error specifically indicates the unit file is not known to systemd, not a spelling mistake.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

An administrator is troubleshooting intermittent connectivity issues. Running 'ping -c 100 -i 0.2 10.0.0.1' shows about 5% packet loss. What is the primary purpose of the '-i 0.2' option?

A
It sets the TTL to 0.2
Why wrong: TTL is an integer, not a fraction; set with -t.
B
It sets the timeout to 0.2 seconds
Why wrong: Timeout is set with -W.
C
It sets the packet size to 0.2 bytes
Why wrong: Packet size is set with -s.
D
It sets the interval between pings to 0.2 seconds
This speeds up the test to detect intermittent loss.

Full breakdown with real-world context →

Question 7hardmultiple choice

Review the full routing breakdown →

A host with this routing table can ping 10.0.2.1 but cannot ping 8.8.8.8. What is the most likely cause?

Exhibit

Refer to the exhibit.

# ip route show
10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.10
10.0.2.0/24 dev eth1 proto kernel scope link src 10.0.2.10
default via 10.0.1.1 dev eth0

A
The default route is missing
Why wrong: The table shows a default route via 10.0.1.1.
B
The default gateway 10.0.1.1 does not have internet connectivity
Even though the host can reach the gateway, the gateway itself may not have a path to the internet.
C
The host has no route to 10.0.2.0/24
Why wrong: The table shows a direct route to 10.0.2.0/24 via eth1.
D
The host has no route to 10.0.1.1
Why wrong: The host has a direct route to 10.0.1.0/24, so it can reach 10.0.1.1.

Full breakdown with real-world context →

Question 8hardmulti select

Full question →

Which THREE methods can be used to rescue a Linux system that fails to boot past GRUB? (Choose three.)

A
Append 'systemd.unit=emergency.target' to kernel command line.
Emergency target provides a minimal shell.
B
Boot into single-user mode by adding 'single' to kernel command line.
Single-user mode starts a minimal shell.
C
At GRUB prompt, press 'e' to edit and add 'init=/bin/bash' to boot.
Allows booting directly to a bash shell.
D
From GRUB menu, run 'linux /vmlinuz-... root=/dev/sda1 init=/bin/bash'.
Why wrong: This is init=/bin/bash, not 'reinstall kernel'.
E
Use the system rescue image by selecting 'Rescue' from boot media.
Official rescue environment.

Full breakdown with real-world context →

Question 9hardmultiple choice

Review the full subnetting walkthrough →

You are a systems administrator for a company that runs a critical application on a Linux server with two network interfaces: eth0 (public IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (private IP 10.0.1.10/24, no gateway). The server must be accessible via SSH (port 22) from the internet, but only from a specific management subnet 198.51.100.0/24. Additionally, the server should be able to access the internet for package updates, but no other inbound traffic from the internet is allowed. The local firewall is iptables. After implementing rules, you find that the server cannot reach the internet (e.g., ping 8.8.8.8 fails), but SSH from the management subnet works. What is the most likely cause?

A
The server's DNS resolver is not configured
Why wrong: Ping uses IP address, not DNS.
B
The SSH rule is misconfigured and accidentally blocks all traffic
Why wrong: SSH works, so the SSH rule is fine.
C
The iptables rules do not include a rule to allow established and related connections
Without a state tracking rule, return traffic for outbound connections is blocked, breaking internet access.
D
The default policy on the INPUT chain is DROP
Why wrong: If the policy were DROP without any rules, SSH would not work either.

Full breakdown with real-world context →

Question 10mediummultiple choice

Full question →

An administrator is unable to SSH into the server from a remote host at 192.168.1.100. Based on the exhibited iptables rules, what is the most likely reason?

Network Topology

A
The SSH rule only allows connections from 10.0.1.0/24, and 192.168.1.100 is not in that subnet
The second rule allows SSH only from 10.0.1.0/24, and the third rule drops all other SSH.
B
SSH is not allowed from any source
Why wrong: SSH is allowed from the local subnet.
C
The INPUT chain policy is ACCEPT, so SSH should be allowed
Why wrong: The explicit DROP rule overrides the default policy.
D
The DROP rule for SSH is not matching because of packet count zero
Why wrong: The packet count is zero because no packets have matched yet; it will match if traffic arrives.

Full breakdown with real-world context →

Question 11mediummultiple choice

Full question →

After adding a new SCSI disk to a server running Linux, the system fails to boot with the error: 'Kernel panic - not syncing: VFS: Unable to mount root fs'. The root filesystem is on LVM. What is the most likely cause?

A
The /etc/fstab entry for the new disk is missing.
Why wrong: Missing fstab entry for the new disk does not affect boot since root is on LVM.
B
The GRUB configuration is incorrect.
Why wrong: GRUB configuration is not automatically changed by adding a disk.
C
The new disk's partition table is corrupt.
Why wrong: A corrupt partition table on a new disk does not prevent root filesystem mount.
D
The initramfs was not regenerated after the disk addition, missing LVM tools.
Correct: initramfs needs to include LVM support; adding disk may change device order and require initramfs rebuild.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

A storage administrator is troubleshooting a system where a new SCSI disk is detected by the kernel but not visible in /dev/disk/by-id/. What is the most likely cause?

A
The device mapper target is not set for the disk.
Why wrong: Device mapper is for LVM/multipath, not for by-id links.
B
The disk does not have a valid partition table.
Why wrong: Partition table is not required for /dev/disk/by-id links.
C
The scsi_mod kernel module is not loaded.
Why wrong: If the disk is detected, scsi_mod is loaded.
D
The udev daemon has not processed the device yet; run 'udevadm trigger' to generate links.
udev creates symbolic links; if not triggered, links may not appear immediately.

Full breakdown with real-world context →

Question 13hardmulti select

Full question →

Which THREE of the following are potential causes for a system failing to boot with 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block'?

A
The SATA cable for the root disk is loose, causing the disk to be detected intermittently.
Why wrong: Would cause device not found, not unknown-block.
B
The partition table on the root disk uses GPT but the BIOS is set to legacy boot.
Why wrong: This affects bootloader, not VFS mount.
C
The initramfs image is missing the necessary tools to mount the root filesystem, e.g., missing filesystem driver.
If initramfs lacks the driver, mount fails.
D
The root filesystem is corrupted and cannot be read by the kernel.
Corruption can cause mount failure.
E
The root filesystem is located on a device that requires a kernel module not included in the initramfs.
If the driver for the root device is missing, kernel can't mount.

Full breakdown with real-world context →

Question 14mediumdrag order

Read the full DNS explanation →

Order the steps to troubleshoot a DNS resolution issue from a Linux client.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15hardmultiple choice

Review the full routing breakdown →

A system administrator is troubleshooting network connectivity from a server that can reach internal resources but cannot access the internet. The server's /etc/sysconfig/network-scripts/ifcfg-eth0 file contains: BOOTPROTO=static, IPADDR=10.0.0.10, NETMASK=255.255.255.0, GATEWAY=10.0.0.1. The administrator runs 'ip route show' and sees: default via 10.0.0.1 dev eth0. However, 'ping 8.8.8.8' fails. Which is the most likely cause?

A
The default gateway is missing from the routing table.
Why wrong: The default route is present, as shown.
B
The gateway 10.0.0.1 is not configured to forward traffic to the internet (no NAT or upstream route).
The private IP gateway cannot route to the internet without NAT or a public IP.
C
DNS resolution is not configured.
Why wrong: DNS is not required for pinging an IP address directly.
D
A firewall is blocking outbound ICMP traffic.
Why wrong: There is no evidence of a firewall; the issue is more fundamental.

Full breakdown with real-world context →

These LFCS practice questions are part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style LFCS questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related LFCS topic practice pages

User and Group Management practice questions

Operation of Running Systems practice questions

Essential Commands practice questions

Networking practice questions

Service Configuration practice questions

Storage Management practice questions

LFCS fundamentals practice questions

LFCS scenario practice questions

LFCS troubleshooting practice questions

Practice scenarios

A user is unable to write to a file. The output of 'ls -l file' shows '-r--r--r--'. Which command will grant write permission to the owner?

A developer reports that a compiled binary 'app' fails to execute with 'Permission denied' error when run from a mounted directory '/mnt/software'. The binary has execute permissions for all users. What is the most likely cause?

A system administrator configures a web server using systemd. After creating a custom service unit file, the administrator runs `systemctl daemon-reload` but the service still fails to start with a 'Unit not found' error. What is the most likely cause?

An administrator is troubleshooting intermittent connectivity issues. Running 'ping -c 100 -i 0.2 10.0.0.1' shows about 5% packet loss. What is the primary purpose of the '-i 0.2' option?

A host with this routing table can ping 10.0.2.1 but cannot ping 8.8.8.8. What is the most likely cause?

Exhibit

Which THREE methods can be used to rescue a Linux system that fails to boot past GRUB? (Choose three.)

An administrator is unable to SSH into the server from a remote host at 192.168.1.100. Based on the exhibited iptables rules, what is the most likely reason?

After adding a new SCSI disk to a server running Linux, the system fails to boot with the error: 'Kernel panic - not syncing: VFS: Unable to mount root fs'. The root filesystem is on LVM. What is the most likely cause?

A storage administrator is troubleshooting a system where a new SCSI disk is detected by the kernel but not visible in /dev/disk/by-id/. What is the most likely cause?

Which THREE of the following are potential causes for a system failing to boot with 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block'?

Order the steps to troubleshoot a DNS resolution issue from a Linux client.