LFCS Essential Commands Practice Question
A technician must locate every regular file beneath /var that is larger than 100 MB and was modified more than 30 days ago, then list them. Which TWO find expressions achieve this? (Choose two.)
⚠ Common exam trap
The trap here is believing -print is mandatory, so a correct expression without it looks incomplete.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
find /var -type f -size +100M -mtime +30 -print
Two variants are correct because find's implicit print makes -print optional, and both retain the -type f, -size +100M, and -mtime +30 tests. Substituting atime measures access rather than modification, dropping the type test admits non-regular entries, and using double-dash predicates is a syntax error that prevents execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
find /var -type f -size +100M -mtime +30 -print
Why this is correct
This expression combines the three needed tests: -type f restricts matches to regular files, -size +100M matches files strictly larger than 100 mebibytes, and -mtime +30 matches files whose data was last modified more than 30 full 24-hour periods ago. The default action already prints, and -print makes it explicit.
- ✗
find /var -type f -size +100M -atime +30 -print
Why it's wrong here
The -atime test checks access time, not modification time, so it selects files that were merely read long ago. A file touched by a recent backup read but never written would match incorrectly, while a file written yesterday but never read would be missed, making this the wrong criterion for the stated requirement.
- ✓
find /var -type f -size +100M -mtime +30
Why this is correct
Omitting -print is valid because find applies -print implicitly whenever the expression contains no other action. The tests are identical to the explicit form, so the same set of large, old regular files under /var is produced in the same order and with the same semantics.
- ✗
find /var -size +100M -mtime +30 -exec ls -l {} \;
Why it's wrong here
This form drops the -type f restriction, so directories and other non-regular entries that happen to exceed the size threshold also match, and the -exec action replaces the default print. It therefore can emit unwanted directory entries and does not isolate regular files as the task demands.
- ✗
find /var --type f --size +100M --mtime +30 -print
Why it's wrong here
find uses single-dash predicates such as -type and -size; double-dash forms are not valid test names and trigger an error about an unknown predicate. The command fails before producing any output, so it cannot satisfy the search requirement regardless of the values supplied.
Go deeper
Related to this question
About these practice questions
One of 406 original LFCS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Linux Foundation exam blueprint
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.