LFCS Essential Commands Practice Question
A user needs to locate all regular files under /etc that are larger than 1 MB and have not been accessed in the last 30 days. Which command finds these files?
⚠ Common exam trap
Candidates often confuse access time (-atime) with modification time (-mtime), or forgetting that find requires a plus sign to indicate 'greater than' for numeric comparisons.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
find /etc -type f -size +1M -atime +30
The find command is the correct tool for complex file searches based on metadata. The -type f option restricts to regular files, -size +1M selects files larger than 1 MB, and -atime +30 identifies files not accessed in over 30 days. Together, these criteria match the administrator's needs exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
find /etc -type f -size +1M -mtime +30
Why it's wrong here
The -mtime option checks the modification time, not the access time. The requirement specifically asks for files not accessed in the last 30 days, which is tracked by -atime. Using -mtime would find files not modified in 30 days, potentially missing files that were read but not changed, or including files that were modified but not accessed.
- ✗
locate /etc -type f -size +1M -atime +30
Why it's wrong here
The locate command searches a prebuilt database of filenames and does not support options like -type, -size, or -atime. It cannot filter by file type, size, or access time. Using locate with these flags would produce errors or ignore them, making it unsuitable for this task.
- ✗
find /etc -type f -size 1M -atime 30
Why it's wrong here
Without the plus sign, -size 1M matches files exactly 1 megabyte in size, not larger than 1 MB. Similarly, -atime 30 matches files accessed exactly 30 days ago, not more than 30 days. This would miss the intended files entirely, as the criteria are exact matches rather than thresholds.
- ✓
find /etc -type f -size +1M -atime +30
Why this is correct
The find command with -type f limits results to regular files. The -size +1M matches files larger than 1 megabyte. The -atime +30 selects files whose last access time is more than 30 days ago. This combination precisely meets the requirement of locating large, infrequently accessed files under /etc.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LFCS question from scratch — 406 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Linux Foundation exam blueprint
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.