LFCS Operation of Running Systems Practice Question
A server is experiencing high load, and the administrator suspects a runaway process is consuming excessive CPU. The administrator wants to identify the top CPU-consuming processes and then terminate the most resource-intensive one. Which sequence of commands should the administrator use?
⚠ Common exam trap
Test-takers frequently confuse tools that show system-wide CPU statistics with those that show per-process CPU usage, and assuming a graceful signal will always stop a runaway process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'top' to identify the PID with highest CPU usage, then run 'kill -9 <PID>'.
To find the process consuming the most CPU, a tool that shows per-process CPU usage sorted dynamically is needed. top provides that view and allows the administrator to note the PID. Once the PID is known, kill -9 sends SIGKILL to forcibly terminate it. The other options either use tools that lack per-process CPU details or send signals that may not stop a runaway process, and they do not correctly identify the top CPU consumer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run 'vmstat 1' to identify the PID, then run 'pkill -f <process_name>'.
Why it's wrong here
vmstat reports system-wide statistics such as CPU, memory, and I/O but does not list individual process IDs. It cannot identify which specific process is consuming CPU. pkill -f matches by command line, which might kill multiple unrelated processes. This approach is imprecise and does not reliably target the top CPU consumer.
- ✗
Run 'ps aux --sort=-%mem' to find the top CPU process, then run 'kill -15 <PID>'.
Why it's wrong here
Sorting by memory usage does not identify the top CPU consumer; the process with highest memory may not be the one causing high load. Additionally, kill -15 sends SIGTERM, which allows graceful shutdown but may not terminate a stuck process. This sequence could target the wrong process and fail to stop it.
- ✗
Run 'iostat -c' to identify the PID, then run 'killall <process_name>'.
Why it's wrong here
iostat displays CPU and I/O statistics for devices and partitions, not per-process details. It cannot provide a PID. killall terminates processes by name, which could affect multiple instances and is not based on actual CPU usage. This method does not identify the specific runaway process.
- ✓
Run 'top' to identify the PID with highest CPU usage, then run 'kill -9 <PID>'.
Why this is correct
top provides a real-time, sorted view of processes by CPU usage, making it easy to spot the top consumer. Once the PID is known, kill -9 sends SIGKILL, which forcibly terminates the process. This combination directly addresses the goal of identifying and stopping the runaway process, though SIGKILL should be used as a last resort.
Go deeper
Related to this question
About these practice questions
One of 406 original LFCS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Linux Foundation exam blueprint
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.