LFCS Service Configuration Practice Question
A developer reports that a web application's logs are not being written to /var/log/myapp.log. The service runs as user 'myapp' and the log directory /var/log/myapp/ has permissions 755 owned by root. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates may focus on file permissions of the log file itself rather than the directory permissions, or incorrectly assume that SELinux or AppArmor is the default cause for permission denials without evidence of their enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service user 'myapp' does not have write permission to the log directory.
The /var/log/myapp/ directory has permissions 755, which grants read and execute access to the 'others' category but not write. Since the service runs as user 'myapp', which is not the owner (root) and not in the root group, it falls under 'others' and thus lacks write permission. Without write permission on the directory, the service cannot create or write to /var/log/myapp.log, even if the file itself might have different permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AppArmor is denying access.
Why it's wrong here
AppArmor confines specific profiles; nothing indicates a profile is loaded for this service, and the 755 root-owned directory already blocks myapp writes. AppArmor would be the answer where a profile exists and dmesg shows DENIED entries despite correct ownership.
- ✗
SELinux is blocking the write.
Why it's wrong here
SELinux denials require an enforcing policy and an AVC entry; the stated 755 root-owned directory already prevents myapp from creating files, so no SELinux rule is reached. SELinux would be the cause where permissions permit writes yet audit.log shows denials.
- ✗
The service is logging to systemd-journald instead of a file.
Why it's wrong here
The stem states logs are not written to /var/log/myapp.log, implying file logging is configured; journald redirection would not explain the failure. This would be correct where the unit file lacks StandardOutput settings and logs appear only under journalctl.
- ✓
The service user 'myapp' does not have write permission to the log directory.
Why this is correct
Directory permissions 755 grant write access only to the root owner, so user 'myapp' cannot create or append to files within /var/log/myapp/. The service therefore fails to open the log for writing, satisfying the stem's constraint that logs are absent despite the service running.
Go deeper
Related to this question
About these practice questions
This LFCS question is part of Courseiva's 406-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.