LFCS Operation of Running Systems Practice Question
A user reports that a background process (PID 3456) is consuming 95% of CPU and causing system slowness. The process name is 'crypto-miner'. The administrator needs to immediately stop this process and ensure it does not restart. Which set of commands should the administrator execute?
⚠ Common exam trap
The trap here is that candidates focus only on stopping the process immediately (kill -9) and overlook the requirement to ensure it does not restart, leading them to choose an option that fails to address persistence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kill -9 3456, then locate the cron job or systemd service that starts it, and disable/remove it.
It addresses both immediate termination and persistence removal. The SIGKILL signal (kill -9) immediately terminates the process, and disabling the cron job or systemd service prevents automatic restart, which is critical for a malicious or unwanted process like 'crypto-miner'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
kill -9 3456, then locate the cron job or systemd service that starts it, and disable/remove it.
Why this is correct
SIGKILL (kill -9) cannot be caught or ignored, so PID 3456 terminates immediately despite consuming 95% CPU. Removing the cron job or disabling the systemd unit eliminates the persistence mechanism, satisfying the requirement that the process must not restart.
- ✗
renice -n 19 -p 3456 and let it run with lower priority.
Why it's wrong here
renice lowers scheduling priority but leaves the crypto-miner running, so it still consumes CPU and the slowness persists. Renicing is appropriate when a legitimate long-running job should yield to interactive workloads; here the requirement is to stop the process and prevent it restarting.
- ✗
kill -9 3456 and then notify the user.
Why it's wrong here
kill -9 terminates PID 3456 immediately but leaves no mechanism preventing the process from being relaunched, by cron, systemd or the user. It is tempting because SIGKILL guarantees the CPU spike stops now; ensuring it does not restart requires disabling its unit or scheduled job as well.
- ✗
kill -15 3456 and hope it terminates.
Why it's wrong here
SIGTERM (kill -15) can be caught or ignored, so a crypto-miner may survive; the stem demands immediate termination and no restart. It is tempting because SIGTERM allows graceful shutdown, which is correct for well-behaved services that clean up resources, not for stubborn or malicious processes.
Go deeper
Related to this question
About these practice questions
This LFCS question is part of Courseiva's 406-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.