Courseiva

LFCS · domain

scenario questions

Practise Linux Foundation Certified System Administrator LFCS scenario questions practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

507 questions139 easy207 medium161 hard

Focused practice

Practice scenario questions questions

Scored sessions drawing only from this domain — pick a length below.

Start 20-question practice test →

What this domain covers

What to know about scenario questions

scenario questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common scenario questions exam traps

  • Answering from memory before reading the full scenario.
  • Missing a constraint such as cost, availability, security, scope or command context.
  • Choosing a broad answer when the question asks for the most specific fix.
  • Ignoring why the wrong options are tempting.

Question index

All scenario questions questions (507)

Click any question to see the full explanation, or start a practice session above.

1

A server has two network interfaces: eth0 (10.0.0.10/24) and eth1 (192.168.1.10/24). The server needs to act as a router for a subnet 172.16.0.0/24, forwarding packets between it and the 10.0.0.0/24 network. Which sysctl parameter must be set to a value of 1 to enable IP forwarding?

Medium
2

Which three of the following are valid reasons to use 'systemctl mask' instead of 'systemctl disable'? (Choose three.)

Hard
3

Refer to the exhibit. The output of 'iptables -L -n' shows the INPUT chain rules. What will happen to an SSH connection attempt from 10.0.0.1?

Easy
4

A system administrator needs to create a new group named 'developers' with GID 1500 and add the user 'alice' to this group. Which set of commands accomplishes this?

Medium
5

An administrator wants to ensure that a service starts automatically after a system crash. Which systemd command should be used?

Medium
6

Which TWO commands can be used to view logs for a specific systemd unit (e.g., sshd.service)?

Easy
7

A security policy requires that a user's password must expire 90 days after last change, and the user must change it immediately on next login. The last password change was 30 days ago. Which set of commands achieves this?

Medium
8

A developer reports that a custom daemon fails to start after a reboot. The daemon's unit file is located in /etc/systemd/system/custom.service. Which of the following is the most likely cause?

Easy
9

A financial firm requires all internal SSH connections to be encrypted with at least 256-bit ciphers. An administrator is configuring the SSH server. Which configuration line should be added to /etc/ssh/sshd_config?

Medium
10

Refer to the exhibit. An administrator adds user 'frank' to the group 'projectx' by editing /etc/group directly and changing the line to 'projectx:x:500:carol,dave,frank'. After saving, the administrator runs 'groups frank' and sees only 'frank' in the output. Why does frank not appear in the group 'projectx'?

Medium
11

A storage administrator wants to create a software RAID 10 (1+0) array using six disks. Which mdadm command is appropriate?

Hard
12

A server’s root filesystem on LVM is nearly full. The administrator has added a new 20GB disk and created a physical volume on it. They added the PV to the volume group containing root, then extended the root logical volume by 10GB. Next, they ran resize2fs on the mounted root filesystem. After the resize, the server continues to function. However, upon reboot, the system fails to boot and enters emergency mode. What is the most likely cause?

Medium
13

What can be concluded from the log?

Easy
14

A security policy requires that user 'svc_backup' have a password that never expires. Additionally, the account should be locked after 90 days of inactivity. Which set of commands achieves this?

Hard
15

Which THREE of the following are valid options for the `lsblk` command to display more detailed information about block devices? (Select THREE.)

Medium
16

A custom systemd service unit file has been created but the service fails to start with 'Exec format error'. What is the most likely cause?

Medium
17

After editing a service unit file, which command must be run for changes to take effect?

Easy
18

Which TWO of the following are correct statements about systemd journald configuration?

Hard
19

Which nmcli command creates a VLAN interface with tag 10 on device eth0?

Hard
20

Which THREE commands can be used to list all users currently logged into the system?

Medium
21

A user wants to find all files in /var/log that have been modified within the last 2 days. Which command should they use?

Easy
22

Which THREE of the following statements about Linux file permissions are correct?

Medium
23

A DevOps engineer wants to list all running processes sorted by memory usage in descending order. Which command should be used?

Hard
24

Which THREE of the following commands can be used to view the contents of a compressed file named 'file.gz' without permanently decompressing it? (Choose exactly three.)

Medium
25

Which THREE commands can display the current CPU utilization statistics on a Linux system?

Medium
26

An e-commerce company runs a critical application on a Linux server that occasionally becomes unresponsive. The server has 64GB RAM and runs a Java application. The operations team notices that during peak hours, the system becomes very slow and eventually the application crashes with 'OutOfMemoryError'. After restart, it works fine for a while. They suspect a memory leak but also want to ensure the system does not go down during peak hours. The system uses systemd to manage the Java service. The administrator needs to implement a solution that: (1) automatically restarts the service if it becomes unresponsive, (2) limits the memory usage of the service to prevent OOM kills on the system, and (3) provides early warning of high memory usage. Which of the following approaches best meets these requirements?

Hard
27

Which legacy command can still be used to view the IPv4 routing table on a modern Linux system?

Easy
28

You are a senior Linux administrator for a large data center. A junior admin reports that a newly deployed application server (192.168.100.50/24, default gateway 192.168.100.1) cannot communicate with a legacy server (192.168.200.50/24, default gateway 192.168.200.1). The two subnets are connected via a router (192.168.100.1 and 192.168.200.1). From the app server, you can ping the legacy server's IP successfully. However, when you try to establish an SSH session from the app server to the legacy server, it times out. You check the legacy server's firewall (ufw) and find that it allows SSH (port 22) from the entire 192.168.0.0/16 range. You also confirm that the SSH daemon is running and listening on 0.0.0.0:22. What is the most likely cause?

Hard
29

A service is using a port that conflicts with another application. Which command can be used to identify which process is listening on a specific TCP port?

Easy
30

An admin needs to change the primary group of user 'alice' from 'grp1' to 'grp2', but alice should still be a member of 'grp1' as a supplementary group. Which command accomplishes this?

Medium
31

A system administrator is setting up a high-availability cluster using shared storage. Which filesystem is best suited for this environment where multiple nodes need simultaneous read-write access to the same filesystem?

Easy
32

A system administrator needs to permanently configure a network interface named ens33 with a static IPv4 address of 192.168.1.100/24 and a default gateway of 192.168.1.1 on a system using NetworkManager. Which command should the administrator use to achieve this?

Easy
33

Which TWO commands can display the current environment variables?

Easy
34

A system administrator needs to ensure the Apache httpd service starts automatically on system boot. Which command should they use?

Easy
35

After adding a new SCSI disk to a server running Linux, the system fails to boot with the error: 'Kernel panic - not syncing: VFS: Unable to mount root fs'. The root filesystem is on LVM. What is the most likely cause?

Medium
36

Which TWO of the following are valid ways to mount a filesystem with the 'noexec' option to prevent execution of binaries?

Medium
37

A system administrator is troubleshooting a DHCP issue on a Linux client. After running 'dhclient -r eth0' and then 'dhclient eth0', the interface does not get an IP address. What command can be used to ensure the DHCP client process is fully released and restarted?

Easy
38

Based on the journalctl output, what is the most likely cause of the service failure?

Hard
39

A developer needs to extract the third column from a CSV file where columns are separated by commas, but some fields contain commas within double quotes. Which command correctly handles this?

Hard
40

Refer to the exhibit. The output of 'ps aux' shows a process named 'process_hog' with PID 1234 consuming 99.5% CPU. The process is stuck in an infinite loop and does not respond to SIGTERM. Which signal should be used to forcefully terminate it?

Hard
41

During boot, the system drops into a shell with message 'ERROR: No suitable file system found'. Filesystem corruption is suspected. Which sequence of actions should the admin take to attempt recovery?

Medium
42

You are managing a Linux server that hosts a critical web application. The server is running low on disk space in the root filesystem, and you need to free up space urgently. You run 'df -h' and see that /dev/sda1 is mounted on / and is 95% full. You also notice that /var/log/messages is over 2 GB in size. The application writes logs to /var/log/app.log, which is also large. The server has a separate /var partition that has plenty of free space. The application must continue running with minimal downtime. You need to compress and rotate logs without losing any data, and ensure that the root filesystem has at least 10% free space. Which of the following actions should you take first to achieve this goal?

Hard
43

Based on the exhibit, what is the most likely cause of the blocked task?

Hard
44

An administrator wants to terminate a process with PID 1234 and all its child processes. Which command should be used?

Medium
45

A systemd-networkd managed interface enp1s0 needs to be configured with a static IP address 192.168.1.100/24 and a default gateway via 192.168.1.1. Which .network file configuration is correct?

Hard
46

Which TWO commands can be used to display the groups to which the current user belongs? (Select exactly two.)

Medium
47

Refer to the exhibit. User 'alice' cannot log in. What is the most likely problem?

Easy
48

A junior admin runs 'systemctl restart httpd' but the httpd service fails to start. Which command should the admin use first to diagnose the problem?

Easy
49

A system administrator is setting up a new backup server. The server has two 4TB disks /dev/sda and /dev/sdb. The administrator decides to create a RAID1 array and then an LVM volume group on top of the RAID device. After creating the RAID1 array /dev/md0, they create a physical volume, volume group named vg_backup, and a logical volume lv_data of size 2TB. Then they format with ext4 and mount at /backup. During testing, they realize that the backup data volume will likely exceed 2TB eventually. They want to expand the filesystem to use all available space in the RAID array. What is the correct procedure?

Medium
50

Refer to the exhibit. Which device is the root filesystem mounted from?

Medium
51

You are a systems administrator for a company that runs a critical application on a Linux server with two network interfaces: eth0 (public IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (private IP 10.0.1.10/24, no gateway). The server must be accessible via SSH (port 22) from the internet, but only from a specific management subnet 198.51.100.0/24. Additionally, the server should be able to access the internet for package updates, but no other inbound traffic from the internet is allowed. The local firewall is iptables. After implementing rules, you find that the server cannot reach the internet (e.g., ping 8.8.8.8 fails), but SSH from the management subnet works. What is the most likely cause?

Hard
52

You are a Linux administrator at a mid-sized company. The company runs a critical PostgreSQL database on a server running CentOS 7. The database stores its data on a 500GB logical volume (lv_pgdata) in volume group vg_pg. The filesystem is XFS. Recently, the database team reports that write performance is degrading, and the disk is nearly full (95% usage). You have added a new 200GB SSD to the server, and you need to increase the storage capacity and improve write performance for the database. The database can tolerate a brief downtime (less than 5 minutes) for maintenance. You want to use LVM to add the new SSD as a physical volume, extend the volume group, and then extend the logical volume and filesystem. Additionally, you want to improve write performance by placing the frequently written database transaction log on a separate faster storage. However, the database configuration expects the transaction log to be in a subdirectory of the data directory. You have the following options: A. Create a new logical volume for the transaction log, format it as XFS, mount it on the data directory's subdirectory, and move the log files. B. Add the SSD as a PV, extend vg_pg, extend lv_pgdata, and then use LVM's pvmove to move all extents to the SSD. C. Add the SSD as a PV, create a new VG, create a new LV for the transaction log, format as ext4, mount, and reconfigure the database. D. Use LVM's striping (RAID 0) across the existing HDD and new SSD to improve performance, then extend the filesystem. Which option best meets the requirements of increasing capacity and improving write performance with minimal downtime?

Hard
53

A user 'alice' cannot log in via SSH. The administrator checks /etc/passwd and sees: alice:x:1002:1002::/home/alice:/sbin/nologin. Which command should be used to allow alice to log in with a bash shell?

Hard
54

A system administrator notices that a web server process (PID 1234) is consuming excessive CPU. They want to trace its system calls to identify the cause. Which command should be used?

Medium
55

Order the steps to recover a forgotten root password on a Linux system using single-user mode.

Medium
56

A cron job runs a script every hour but sometimes fails because the script cannot find commands like 'tar' and 'gzip'. The script works when run manually from a terminal. What is the best fix?

Hard
57

Refer to the exhibit. A server is configured with two network interfaces. A user on the 192.168.2.0/24 network reports that they cannot reach the server at IP 10.0.0.5. What is the most likely cause based on the routing table?

Medium
58

Refer to the exhibit. How many days of logs are retained before deletion?

Medium
59

A Linux administrator needs to view the UUID and filesystem type of all block devices. Which command provides this information?

Easy
60

You are a systems administrator for a company that runs a high-traffic web application on a Linux server with 32 GB of RAM and 8 CPU cores. The application uses Apache with mod_php and MySQL. Recently, the server has been experiencing intermittent slowdowns, especially during peak hours. Monitoring tools show that the CPU usage spikes to 100% for several minutes and then returns to normal. The 'top' command shows that the 'mysqld' process is often the top CPU consumer during these spikes. You notice that the MySQL slow query log contains many entries with long execution times. The database is heavily used by the web application for read-heavy workloads. After analyzing the situation, you suspect that the issue is related to MySQL configuration. Which of the following actions is most likely to resolve the performance issue?

Hard
61

Which THREE of the following are valid methods to mount an NFS filesystem on a client?

Hard
62

A system administrator needs to create a user 'john' with a home directory in /data/users and an expiry date of 2025-12-31. Which command accomplishes this?

Easy
63

You are a system administrator for a company with a strict security policy: user accounts must be disabled after 90 days of inactivity. The tool used is the chage command with the -I (inactive) option. User 'bob' has been on leave and cannot log in. You run 'chage -l bob' and see: Last password change: Jan 10, 2024; Password expires: Apr 09, 2024; Account expires: never; Minimum number of days between password change: 0; Maximum number of days between password change: 90; Number of days of warning before password expires: 7; Number of days of inactivity after password expires: 90. Bob tells you he tried to log in today (date is July 15, 2024) and received 'Your account has expired; contact your system administrator'. You need to restore Bob's account access immediately while still enforcing the inactivity lock for future periods. What should you do?

Hard
64

Which TWO options in /etc/shadow are correctly described?

Medium
65

A system administrator wants to kill a process with PID 1234 that is not responding to SIGTERM. Which command will forcefully terminate it?

Hard
66

An administrator deploys a new custom service using a unit file called myapp.service. The service needs to start automatically at system boot. Which command should the administrator run to achieve this?

Easy
67

An administrator has added a new disk (/dev/sdb) to a Linux system. The disk is to be used as a physical volume in an existing volume group 'vg_data'. Which sequence of commands should be executed to make the disk available to the volume group?

Medium
68

A user wants to continuously monitor a log file that is being written to by a running service. Which command achieves this?

Easy
69

A system administrator needs to ensure that all users in the 'developers' group have read and write access to a shared project directory /project/data, but new files created in that directory should belong to the 'developers' group automatically. Which command sequence achieves this goal?

Medium
70

Based on the exhibit, which process will be affected if the root user runs 'kill 5678'?

Hard
71

An administrator needs to check the UUID of a filesystem on /dev/sdb1. Which command should be used?

Easy
72

You are managing a Linux server that hosts web applications. Developers often need to access the server via SSH using their personal accounts. You have been asked to create a new user 'devops' who will have sudo privileges to restart services. The user 'devops' should be a member of the 'sudo' group and also have a secondary group 'devs' for file access. The user's home directory should be /home/devops. You need to create this user with a password that is set to expire immediately so that the user must choose a new password upon first login. Which command would you use to accomplish this?

Medium
73

A user 'dba' tries to login via SSH and fails. Based on the exhibit, what is the most likely cause?

Medium
74

A system administrator needs to find all files in /var/log that have been modified in the last 24 hours. Which command accomplishes this?

Easy
75

Refer to the exhibit. Assuming today is Feb 20, 2025, what happens when 'bob' attempts to log in today?

Hard
76

The command 'ss -tuln' shows port 80 is listening on a server, but a remote client cannot connect via HTTP. What is the most likely cause?

Easy
77

A system administrator is troubleshooting a user's report that a command 'myapp' is not found. The administrator checks the PATH variable and sees it includes /usr/local/bin. The administrator verifies that the binary 'myapp' exists in /usr/local/bin with permissions 755. However, running 'myapp' still fails with 'command not found'. What is the most likely cause?

Medium
78

You are a systems administrator at a company that uses a centralized LDAP server for authentication, but also maintains local users for emergency access. Recently, the compliance team mandated that all service accounts must have passwords that expire every 90 days. You have a local service account 'svc_backup' with UID 2000 and GID 2000. The account is used by a backup script that runs nightly. You have updated the password aging policy but the account still shows 'Password expires : never' when you run 'chage -l svc_backup'. You suspect that the account was created without an expiry date. Which command would you use to force the password to expire 90 days from now and also ensure that the account's password is changed at the next login?

Hard
79

A service is configured to run as a specific user. Which directive in the [Service] section sets the user?

Medium
80

A service named webserver.service is failing to start. The administrator wants to see the most recent error messages related to this service. Which command provides this information?

Easy
81

A disk in a RAID5 array fails. The array is assembled using mdadm. Which is the correct procedure to replace the failed disk with a new one?

Medium
82

Match each file system type to its typical use case.

Medium
83

A DevOps engineer wants to measure how long a specific command takes to execute. Which command should be used?

Medium
84

To display the current runlevel on a system using SysV init, which command should be used?

Easy
85

A system administrator wants to ensure that network interfaces receive predictable names based on firmware/BIOS topology rather than kernel enumeration. Which naming scheme should be enabled in GRUB?

Easy
86

A system administrator receives a report that a server with an ext4 filesystem becomes unresponsive when a particular process writes a large file. The root filesystem is not full. Which of the following is the most likely cause?

Hard
87

Which command will display all groups a specific user belongs to, including both primary and supplementary groups?

Easy
88

Refer to the exhibit. The administrator wants to extend the /data filesystem by an additional 10GB. The volume group vg_data has only 1GB of free physical extents. Which action should be taken first?

Medium
89

Refer to the exhibit. The administrator receives alerts that the root filesystem is almost full. Which command could free up space by removing old log files?

Medium
90

Order the steps to troubleshoot a DNS resolution issue from a Linux client.

Medium
91

A system administrator is managing a production web server running CentOS 7. The server hosts a critical application that depends on the 'httpd' package. Recently, the administrator attempted to install an updated version of httpd using 'yum update httpd', but the update failed with a dependency error: 'Error: Package: httpd-2.4.6-97.el7.centos.x86_64 requires libapr-1.so.0()(64bit)'. The administrator verifies that the apr package is installed (apr-1.5.2-6.el7.x86_64) and that the required library file exists at /usr/lib64/libapr-1.so.0. Despite this, yum continues to fail with the same error. After checking the yum repository configuration, the administrator notices that the base repository lists 'mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os' and the 'baseurl' is commented out. The system's /etc/yum.conf has 'keepcache=1'. What is the most likely cause of the dependency error, and which command should the administrator run to resolve it?

Hard
92

A system with systemd experiences a service that fails to start due to a 'Failed to start' error with status 203/EXEC. What is the most likely cause?

Hard
93

Which THREE of the following are valid methods to temporarily switch to a different user account without logging out entirely? (Choose three.)

Hard
94

Which two commands produce output that includes the current runlevel or target? (Choose two.)

Medium
95

An administrator needs to configure software RAID 5 on three disks /dev/sda, /dev/sdb, /dev/sdc with a spare disk /dev/sdd. Which command correctly creates the RAID array?

Medium
96

Match each Linux permission type to its symbolic representation.

Medium
97

An administrator is configuring network bonding on a RHEL 7 server with two physical NICs (eth0 and eth1) to provide redundancy. The bond interface bond0 is configured with mode 1 (active-backup). The administrator uses the following configuration in /etc/sysconfig/network-scripts/ifcfg-bond0: BONDING_OPTS="miimon=100 mode=1". The slave interfaces are configured with MASTER=bond0 and SLAVE=yes. After restarting the network service, the bond interface comes up with the active link on eth0. To test failover, the administrator disconnects the cable from eth0. The bond interface does not fail over to eth1. The administrator checks /proc/net/bonding/bond0 and sees that both slaves are listed but eth0 is still marked as active even though the cable is disconnected. What is the most likely reason for the failover failure?

Hard
98

A system administrator needs to ensure that a Linux server can communicate with other hosts on the same subnet. Which command should be used to verify the IP address and netmask configuration?

Easy
99

To permanently disable IPv6 on a network interface, which configuration should be added to /etc/sysctl.conf?

Easy
100

A user wants to set the permissions of a file to 'rwxr-xr--'. Which octal permission value should they use with chmod?

Easy
101

Which iptables command allows incoming SSH traffic only from the 10.0.0.0/8 network?

Hard
102

An administrator needs to create a user 'john' with a home directory in /data/home/john, a UID of 1500, and membership in the group 'developers' as a secondary group. The group 'developers' already exists. Which single command accomplishes this?

Medium
103

A technician configured a new network interface eth1 on a CentOS 7 server but the interface does not obtain an IPv4 address via DHCP. Which of the following is the most likely cause?

Hard
104

A system administrator needs to identify all available block devices on a Linux server. Which two commands can be used to accomplish this? (Choose two.)

Easy
105

A system administrator notices that a new 500GB SSD (/dev/sdb) is not being recognized by the system after installation. The server uses UEFI and GPT partitioning. Which command should the administrator run first to verify that the disk is detected by the kernel?

Medium
106

A service requires read-write access to a specific directory that is mounted from an NFS share. The directory is mounted via fstab with the option 'noauto'. The service starts before the mount is available. Which configuration change should be made in the service unit file to ensure the service only starts after the mount is mounted?

Medium
107

Match each Linux command to its function.

Medium
108

An administrator wants to change the primary group of user 'jane' from 'staff' to 'developers'. Which command accomplishes this?

Easy
109

Based on the exhibit, what is the correct interpretation?

Medium
110

Which two commands can add an existing user to a supplementary group?

Hard
111

Which TWO directives are typically used in a systemd service unit file to configure dependencies?

Medium
112

A Linux server is unable to resolve the hostname 'app.internal.example.com' but can resolve other names. The /etc/nsswitch.conf file contains: hosts: files mdns4_minimal [NOTFOUND=return] dns. The /etc/hosts file does not list the hostname. Which configuration change would most likely resolve the issue?

Hard
113

An administrator notices that the system clock is drifting significantly. To synchronize time using NTP, which command should be used to immediately sync with a server?

Hard
114

A process is consuming 99% CPU and is unresponsive to normal shutdown requests. After running 'top', you see the PID is 1234. What is the most appropriate command to stop the process gracefully first?

Hard
115

A Linux administrator is troubleshooting a service that is running as the 'nobody' user but keeps failing because it cannot write to its log file. The log file is located at /var/log/app.log. Which TWO of the following methods will allow the service to write to the log file while maintaining security best practices?

Medium
116

A system administrator needs to find all files in /home that are owned by user 'alice' and have been modified in the last 7 days. The administrator then wants to compress those files into a single archive named alice_recent.tar.gz. Which of the following commands accomplishes this?

Hard
117

To display the first 10 lines of a file named 'log.txt', which command is correct?

Easy
118

A server with two network interfaces needs to forward IP packets between them. Which two steps are required to enable IP forwarding? (Choose two.)

Medium
119

A system administrator wants to view the last 10 lines of the system log file '/var/log/syslog' and continue to watch for new lines as they are appended. Which command should be used?

Easy
120

A production web server is experiencing intermittent high load. The administrator suspects that a specific Apache module is causing memory leaks. Which approach is most effective for isolating the issue without restarting the server?

Hard
121

Given the routing table output in the exhibit, what will happen when the system tries to send a packet to 10.1.1.1?

Medium
122

Order the steps to set up passwordless SSH key-based authentication.

Medium
123

A system administrator manages a database server service (database.service) that experiences periodic CPU spikes, causing excessive load on the server. The administrator wants to limit the service's CPU usage to 25% of a single CPU core. The service is running on a system with cgroup v2. Which directive should be added to the [Service] section of the unit file to achieve this?

Hard
124

Which TWO commands can be used to display the current routing table on a Linux system?

Easy
125

A process is stuck in an uninterruptible sleep (D state) and cannot be killed. What is the most likely cause?

Medium
126

A system administrator wants to display a list of all currently running processes with their parent process IDs. Which command is most appropriate?

Medium
127

A server has multiple IP aliases on eth0. Remote hosts cannot reach the secondary IP addresses. What should the administrator check?

Hard
128

A user reports that they cannot execute a file even though they are in the file's group. The file has permissions 644 and group ownership 'staff'. The user is a member of 'staff'. What is the likely issue?

Hard
129

A server uses firewalld. Which command permanently allows HTTP traffic?

Hard
130

A system has a process stuck in uninterruptible sleep (D state). The administrator wants to identify which kernel function it is waiting on. Which tool should be used?

Hard
131

A server on a corporate network is intermittently losing connectivity. The administrator runs 'tcpdump -i eth0 icmp' and sees 'ICMP time exceeded in-transit' messages from a router. What is the most likely cause?

Hard
132

To ensure a service starts only after /var/lib/mysql is mounted, which directive should be used in the unit file?

Hard
133

A large company needs to create 100 user accounts from a list of names in a CSV file. Which tool is most efficient for batch user creation?

Medium
134

A junior administrator issued the command 'usermod -L alice' to lock the account of user alice. However, alice is still able to log in via SSH using a public key. What is the most likely reason?

Easy
135

Given the routing table, if the server sends a packet to destination 10.0.1.200, which interface will be used and what is the next hop?

Hard
136

Which TWO commands can be used to check the status of a service?

Easy
137

A system administrator notices that the disk space on the root filesystem is at 95% usage. After investigating, they find that a large log file named 'access.log' in /var/log is taking up significant space. The administrator deletes the file using 'rm /var/log/access.log' but the disk usage remains at 95%. Running 'df -h' still shows the same usage. What is the most likely cause and the correct next step?

Easy
138

A company runs a critical web application on a Linux server. The application is managed by a systemd service called 'myapp.service'. Recently, after a scheduled maintenance reboot, the service failed to start automatically. The administrator manually started it with 'systemctl start myapp' and it ran fine. The unit file is located at /etc/systemd/system/myapp.service and contains: [Unit] Description=MyApp After=network.target [Service] ExecStart=/usr/local/bin/myapp Restart=on-failure [Install] WantedBy=multi-user.target. The administrator wants to ensure the service starts automatically after future reboots. However, after running 'systemctl enable myapp', the service still didn't start after the next reboot. What is the most likely cause?

Hard
139

A company wants to ensure that a web server (IP 192.168.1.10) is accessible from the internet via port 443, but all other inbound traffic should be blocked. The server also needs to communicate with an internal database (IP 10.0.0.50) on port 3306. The default firewall zone is 'public'. Which iptables rules should be applied to the server?

Hard
140

Refer to the exhibit. What is the primary group ID of user 'charlie'?

Easy
141

Which THREE are valid reasons to use a swap file instead of a swap partition? (Choose three.)

Hard
142

A sysadmin set up a shared directory /data/project with group ownership project and permissions 2775 (rwxrwsr-x). Users in the project group can create files, but when they try to edit files created by other group members, they get permission denied. Which is the most likely cause?

Hard
143

A system administrator cannot restart a service because another unit 'stop' the request. The status message says 'Unit test.service is not running, but has pending stop job'. What is the most likely cause?

Hard
144

An administrator wants to ensure that a background process continues running after logout. Which command should be used to start the process?

Hard
145

A system administrator needs to monitor real-time network traffic on a specific interface (eth0). Which TWO tools can be used for packet-level analysis?

Medium
146

Order the steps to set up a LVM logical volume from a new disk.

Medium
147

You are troubleshooting a Linux server that acts as a router between two networks: 10.0.1.0/24 (eth0) and 10.0.2.0/24 (eth1). IP forwarding is enabled. Hosts on 10.0.1.0/24 can ping the server's eth0 IP (10.0.1.1), but cannot ping hosts on 10.0.2.0/24 (e.g., 10.0.2.10). The server can ping both 10.0.2.10 and 10.0.1.10. The iptables FORWARD chain policy is ACCEPT. What is the most likely cause?

Medium
148

Which TWO utilities can be used to configure network bridges on Linux?

Medium
149

An administrator wants to extend a logical volume named 'lv_data' in volume group 'vg_data' by 5GB. The volume group has free physical extents. Which command should be used?

Easy
150

A security policy requires that all users in the 'webadmin' group should have read and write access to files in /var/www/html. New files created in that directory should automatically be assigned to the 'webadmin' group and have group read/write permissions. Which combination of permissions and group ownership should be set on /var/www/html?

Medium
151

A system administrator needs to configure a static IPv4 address of 192.168.1.100/24 on interface eth0 using NetworkManager. Which command accomplishes this?

Easy
152

A Linux administrator needs to create a RAID 5 array using three disks: /dev/sdb, /dev/sdc, and /dev/sdd, each 2TB. The administrator wants to ensure the array can be reassembled automatically after a reboot. Which command should be used to create the array?

Hard
153

Which THREE methods can be used to rescue a Linux system that fails to boot past GRUB? (Choose three.)

Hard
154

A system administrator configures a web server using systemd. After creating a custom service unit file, the administrator runs `systemctl daemon-reload` but the service still fails to start with a 'Unit not found' error. What is the most likely cause?

Medium
155

Which THREE of the following are valid systemd unit types?

Hard
156

Which TWO commands can display a list of active TCP connections listening on the system? (Choose two.)

Hard
157

A Linux administrator wants to restrict user 'alice' to only be able to use the system for non-interactive tasks (e.g., running cron jobs and receiving mail) but not allow her to log in via SSH or console. Which TWO actions would achieve this goal? (Choose two.)

Medium
158

A company runs an Apache HTTP server hosting multiple virtual hosts on a single server. The server is managed by systemd. After editing the configuration file for one of the virtual hosts, the administrator notices that the entire Apache service fails to start with a syntax error. Other virtual hosts are currently down because the service failed. The administrator must resolve the issue with minimal downtime and without affecting the configuration of the working virtual hosts. Which course of action is most appropriate?

Medium
159

A Linux server cannot reach the internet, but internal LAN connectivity works. The output of 'ip route' shows a default gateway of 192.168.1.1, but pinging 8.8.8.8 fails. What is the most likely cause?

Medium
160

Refer to the exhibit. The /etc/sysconfig/network-scripts/ifcfg-eth0 file contains the above content. After reboot, eth0 still does not obtain an IP via DHCP. What is the most likely missing configuration?

Hard
161

An administrator needs to grant a user named 'john' the ability to switch to any other user without a password. Which TWO of the following steps are required to achieve this?

Easy
162

A team of developers must share files under /opt/project. All developers are members of the 'devteam' group. New files must be automatically assigned to group 'devteam' and be writable by the group. Which umask and setgid configuration should be applied?

Hard
163

A system administrator needs to stop a misbehaving process gracefully, allowing it to clean up resources. The process is unresponsive to the standard SIGTERM signal. What should the administrator do next?

Medium
164

A system administrator is managing a RHEL 8 server that requires a static IP address on interface ens192. The administrator modifies /etc/sysconfig/network-scripts/ifcfg-ens192 to set BOOTPROTO=static, IPADDR=192.168.1.100, PREFIX=24, GATEWAY=192.168.1.1, and DNS1=8.8.8.8. After saving, the administrator runs 'systemctl restart NetworkManager'. The interface obtains the correct static IP and network connectivity works. However, after a reboot of the server, the interface fails to come up with the static IP and instead obtains an IP via DHCP from the local network. The administrator verifies that the DHCP server is active and that the physical connection is good. What is the most likely cause of the issue?

Medium
165

Which bonding mode provides high availability without requiring switch configuration?

Medium
166

A system administrator needs to securely transfer files between two Linux servers using port 22. The administrator uses the following command: 'scp file.txt user@remote:/tmp/'. The transfer fails with the error 'Permission denied (publickey)'. What is the most likely cause?

Hard
167

A company's database server uses LVM for storage. The system administrator notices that the logical volume /dev/vg_db/lv_data is at 95% capacity. The server is in production and cannot be taken offline. The volume group vg_db has free physical extents. Which command sequence should the administrator use to safely increase the size of the logical volume and filesystem without unmounting?

Hard
168

A server has two network interfaces: eth0 (192.168.1.10/24) and eth1 (10.0.0.10/24). The default gateway is 192.168.1.1. The administrator wants traffic to 10.0.1.0/24 to go through eth1's gateway 10.0.0.1. Which command adds this route?

Hard
169

A system administrator wants to combine two network interfaces for increased throughput and fault tolerance. The requirement is that both links are active simultaneously and the system can tolerate a failure of one link without interruption. Which bonding mode should be used?

Easy
170

An administrator configures a systemd service with Restart=on-failure and RestartSec=10. What happens if the service exits with a non-zero exit code?

Hard
171

A system administrator needs to find all files under /var/log that have been modified within the last 7 days. Which command accomplishes this task?

Medium
172

A system administrator notices that a web server is not reachable from the internet but is reachable from the internal network. The server's IP is 10.0.1.10/24, and the gateway is 10.0.1.1. Which command should be used to verify the default gateway configuration?

Medium
173

A server runs out of inodes. The administrator needs to find which filesystem is exhausted and which directory has the most files. Which command sequence best accomplishes this?

Medium
174

Which command displays the listening UDP ports on a Linux system?

Easy
175

Which THREE statements about Linux network bonding modes are correct? (Choose three.)

Hard
176

Which THREE fields are part of a standard /etc/group entry?

Hard
177

After running 'chage -l bob', the output shows: 'Last password change: Apr 01, 2023', 'Password expires: May 31, 2023', 'Account expires: Jul 15, 2023'. What will happen on May 31, 2023?

Hard
178

A systems administrator is responsible for a production Linux server running CentOS 7 that provides SSH access to users. The administrator decides to tighten security by restricting SSH access to a specific management subnet 10.0.0.0/24. While connected to the server via SSH from a workstation on 10.0.0.50, the administrator adds the following iptables rule: iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/24 -j ACCEPT followed by iptables -P INPUT DROP. Immediately after the rule change, the administrator loses all connectivity to the server, including SSH. The administrator suspects that the new default policy dropped the existing SSH session. What is the most reliable method for the administrator to regain access to the server without rebooting?

Hard
179

A Linux administrator needs to configure VLAN tagging on a network bridge to isolate traffic from different virtual machines. The physical interface is eth0, and VLAN ID 100 should be accessible via the bridge br0. Which set of commands correctly creates this configuration using the ip command?

Hard
180

The administrator wants to create a new logical volume of 5GB for /var/log. Which of the following is the most appropriate first step?

Hard
181

A security policy requires that a user account 'temp_audit' be locked immediately without changing the password. Which command locks the account and prevents login?

Hard
182

Which command adds an existing user to a supplementary group without removing the user from other groups?

Easy
183

A system administrator wants to limit the CPU usage of a service. Which systemd resource control directive should be used?

Medium
184

A user wants to view the contents of a compressed log file /var/log/syslog.2.gz without decompressing it first. Which command should they use?

Easy
185

An administrator created an LVM snapshot of a logical volume to perform a backup. During the backup, the snapshot runs out of space. What will happen to the original logical volume?

Hard
186

A system administrator runs 'ss -tuln' and sees that port 80 is listening. What does the 'u' option represent?

Medium
187

Which THREE steps are necessary to permanently disable a systemd service from starting at boot?

Hard
188

Refer to the exhibit. Which filesystem is mounted using the XFS filesystem type?

Easy
189

Which THREE commands can show the current system time and date?

Easy
190

Which file stores the encrypted password (or password hash) for user accounts?

Easy
191

Refer to the exhibit. The administrator wants to create a RAID 1 array using /dev/sdb1 and /dev/sdc1. Which command should be used?

Easy
192

After editing /etc/resolv.conf to set a custom DNS server, the changes are reverted after reboot. What is the most likely cause?

Medium
193

You are a systems administrator for a company that runs a critical web application on a Linux server. The server has two network interfaces: eth0 (public IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (private IP 10.0.0.10/24). The web server listens on port 443 (HTTPS) and must be accessible from the internet. The server also needs to connect to an internal database server at 10.0.0.50/24 on port 3306. Recently, users reported that the website is intermittently unreachable. You SSH into the server and run 'ss -tln' and see that the web server is listening on 0.0.0.0:443. You check the routing table with 'ip route show' and see: default via 203.0.113.1 dev eth0; 10.0.0.0/24 dev eth1 proto kernel scope link src 10.0.0.10. You also run 'iptables -L -n -v' and see: Chain INPUT (policy ACCEPT), with no rules. However, you notice that the server's default gateway is unreachable from the server itself when you run 'ping 203.0.113.1' (100% packet loss). What is the most likely cause of the intermittent unreachability?

Hard
194

A Linux server experiences a kernel panic during boot. The administrator needs to capture the kernel panic message for debugging. Which of the following methods would allow capturing the panic message?

Easy
195

Match each Linux package management command to its distribution.

Medium
196

A user reports that they cannot delete a file named 'important.txt' located in their home directory. The file is owned by the user and the user has write permission on the directory. Running 'rm important.txt' produces the error: 'rm: cannot remove 'important.txt': Operation not permitted'. The user has also tried using 'sudo rm' but gets the same error. Which of the following is the most likely cause and correct solution?

Easy
197

A security policy requires that all users in the 'admin' group must have a umask of 027 set automatically upon login. An administrator adds 'umask 027' to /etc/profile. However, users report that the umask is still 022. What is a likely cause?

Hard
198

Order the steps to create a systemd service unit that runs a script at boot.

Medium
199

An administrator receives a report that a specific directory /var/log is consuming too much disk space. Which command should be used to determine the total disk space used by that directory?

Medium
200

A user reports that a shell script 'backup.sh' in /home/user/scripts fails to execute. What is the most likely cause?

Easy
201

A system administrator receives an alert that disk /dev/sda is predicted to fail soon. The server uses LVM, and /dev/sda is part of a volume group named vg_system. Which of the following is the best course of action to replace the failing disk without downtime?

Easy
202

A system administrator needs to configure a network bond on a Linux server using NetworkManager. Which TWO steps are required to create a functional bond interface?

Medium
203

An administrator needs to delete user 'obsolete' and remove its home directory and mail spool. Which command should be used?

Easy
204

A host with this routing table can ping 10.0.2.1 but cannot ping 8.8.8.8. What is the most likely cause?

Hard
205

Refer to the exhibit. A user attempts to create a file in /backup/snapshots/ but receives an error. What is the most likely cause?

Hard
206

Which TWO statements are true about systemd service unit files? (Choose two.)

Medium
207

Which TWO commands can be used to display the current working directory?

Easy
208

An administrator wants to permanently configure a static IP address on a CentOS 7 system. Which file should be edited?

Easy
209

Based on the exhibit, which port is listening only on the loopback interface?

Easy
210

Which THREE commands can be used to view the contents of a compressed archive file without extracting it? (Select three.)

Medium
211

Refer to the exhibit. A system administrator notices that SSH connections to the server are being dropped immediately. Assuming the server's external interface is eth0, which rule is responsible for this behavior?

Hard
212

A system administrator notices that logrotate did not rotate the /var/log/messages file on a CentOS 7 server despite having a configuration at /etc/logrotate.d/syslog. The admin runs 'logrotate -d /etc/logrotate.conf' and sees that the syslog file is excluded due to 'olddir' option, but the olddir does not exist. Additionally, the logrotate status file (/var/lib/logrotate/logrotate.status) shows that /var/log/messages was last rotated 30 days ago. The logrotate cron job is scheduled daily. What is the most likely reason the rotation fails?

Medium
213

A system administrator has a cron job that runs a backup script. The script requires the variable BACKUP_DIR to be set, but the administrator cannot modify the script. Which is the most appropriate place to define the variable for cron?

Medium
214

A system administrator monitors a server that periodically becomes unresponsive for a few seconds. Investigation reveals that the kernel OOM killer is being invoked, but standard memory usage monitoring tools like 'free' and 'top' show less than 50% memory usage. The server runs a web server and a database. Which of the following is the most likely cause and diagnostic step?

Hard
215

A network engineer needs to temporarily disable a network interface eth1 without bringing it down permanently. Which command?

Easy
216

Which TWO commands can be used to view the current routing table on a Linux system?

Medium
217

To permanently mount an ext4 filesystem at /data with noatime option, which entry should be added to /etc/fstab?

Medium
218

A system administrator is debugging why a service named 'myapp.service' fails to start. He runs 'systemctl status myapp.service' and sees the status 'failed' with details 'Exit code: 1' and 'Failed with result exit-code'. Which command should be used next to view the full log of the service?

Medium
219

Based on the iptables-save output, what is the default policy for the FORWARD chain and what happens to a new SSH connection from an external host on eth0?

Medium
220

Which THREE of the following are potential causes for a system failing to boot with 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block'?

Hard
221

Refer to the exhibit. What is the most likely security issue?

Hard
222

You are a system administrator for a company that runs a web server on a Linux system. The web server logs are stored in /var/log/nginx/access.log. The log file grows rapidly and rotates weekly via logrotate. The system has been running for several months. Recently, the development team reported that the web server is responding slowly. You suspect that the disk I/O might be high due to log file activity. You check the disk usage and find that /var/log/nginx/access.log is 4 GB, and the rotated logs (access.log.1.gz, access.log.2.gz, etc.) total another 10 GB. The /var partition has 20 GB total, so it's 70% full. You decide to reduce the disk usage by compressing the current log file and truncating it without stopping the nginx service. Which command sequence should you use to safely achieve this?

Hard
223

A server has two network interfaces: eth0 (public IP 203.0.113.10/24) and eth1 (private IP 10.0.0.1/8). The default gateway is 203.0.113.1. The admin wants to ensure that traffic to the private subnet 10.0.0.0/8 goes via eth1. Which command correctly adds a static route?

Medium
224

A user reports that they cannot log in via SSH. The system administrator checks that the account is not locked, the password is correct, and the shell is valid. However, the user's home directory is owned by root instead of the user. What is the most likely cause of the login failure?

Hard
225

A backup script must create a compressed archive of the /etc directory, preserving file permissions and timestamps. Which command should be used?

Medium
226

A cron job runs a script that outputs to stdout. The administrator wants to capture both stdout and stderr to a file named job.log, while also seeing output on the terminal. Which command achieves this?

Medium
227

Which three RAID levels are commonly supported in Linux software RAID? (Choose three.)

Medium
228

A developer reports that a web application's logs are not being written to /var/log/myapp.log. The service runs as user 'myapp' and the log directory /var/log/myapp/ has permissions 755 owned by root. What is the most likely cause?

Hard
229

Which command displays the amount of free and used memory in the system?

Easy
230

Refer to the exhibit. The service unit file has Restart=on-failure, but systemctl show displays Restart=no. What is the most likely reason?

Medium
231

A system administrator is troubleshooting a performance issue. They need to identify which process is consuming the most CPU time over the last 24 hours. Which command should be used?

Medium
232

Order the steps to create a new partition on a disk using fdisk.

Medium
233

A network administrator needs to block all incoming SSH traffic (port 22) from the 192.168.2.0/24 subnet. Which iptables command accomplishes this?

Medium
234

An administrator is unable to SSH into the server from a remote host at 192.168.1.100. Based on the exhibited iptables rules, what is the most likely reason?

Medium
235

A user must change their password at next login per security policy. The admin wants to expire the password immediately. Which command accomplishes this?

Medium
236

A system administrator needs to mount an ext4 filesystem with the options 'noatime' and 'errors=remount-ro'. Which mount command is correct?

Easy
237

A service that was once enabled is now failing to start. The administrator wants to immediately disable it to prevent boot delays. Which command sequence is correct?

Medium
238

A junior admin runs 'ls -l' and sees permissions '-rwxrwxr-x' on a file. What is the octal representation?

Medium
239

A system administrator is managing a web application running as a systemd service on a new Linux server. The application requires a specific environment variable, DATABASE_URL, to be set before starting. The administrator has created a custom service unit file at /etc/systemd/system/webapp.service with the following content: [Unit] Description=Web Application Service [Service] ExecStart=/usr/local/bin/webapp Restart=on-failure The administrator prefers to keep configuration separate from the unit file for easier updates. The service fails to start. Upon investigation, the administrator notices that the DATABASE_URL variable is not being passed to the process. What is the most appropriate course of action to ensure the environment variable is correctly set?

Easy
240

An administrator is troubleshooting intermittent connectivity issues. Running 'ping -c 100 -i 0.2 10.0.0.1' shows about 5% packet loss. What is the primary purpose of the '-i 0.2' option?

Hard
241

You are managing a multi-user Linux server used by a development team. The server has a shared directory /data/projects where each project has a subdirectory owned by a project lead. The requirement is that all members of the 'devteam' group need to be able to create files in any project subdirectory, but only the project lead (owner) should be able to delete files. Currently, members of devteam are unable to create files in /data/projects. You check permissions: /data/projects has drwxrwxr-x root:devteam. Each project subdirectory, e.g., /data/projects/proj1, has drwx------ lead1:devteam. The lead1 user is in devteam. What is the most likely reason that devteam members cannot create files in proj1, and what is the correct solution?

Hard
242

Refer to the exhibit. Which mount options are set for the root filesystem?

Easy
243

The backup script fails to run as user 'backup' with sudo. What is the issue?

Hard
244

A service unit has the directive 'ExecStartPre=/bin/true' and 'ExecStart=/usr/bin/myapp'. What is the effect of ExecStartPre?

Hard
245

A developer was removed from the 'developers' group but still needs to run commands that require membership in that group. The user has logged out and back in, but the issue persists. What is the most likely cause?

Medium
246

Which TWO commands can be used to display the contents of a text file that has been compressed with gzip without decompressing it to disk?

Easy
247

Which THREE of the following actions require root privileges?

Easy
248

An administrator wants to schedule a one-time task to run at 2:30 PM next Friday. Which command should be used?

Easy
249

A system administrator wants to allow incoming SSH connections from a specific IP range 192.168.10.0/24 using firewalld. Which command should be used?

Medium
250

Which TWO methods can be used to set a static IPv4 address on a CentOS 7 system? (Choose two.)

Easy
251

Which two commands can be used to set password expiration policies for a user?

Easy
252

A company follows the principle of least privilege. Several developers need sudo access to run specific commands like systemctl and journalctl. What is the best practice for granting this access?

Medium
253

A server with two network interfaces (eth0 and eth1) needs to be configured as a bridge (br0) to allow KVM virtual machines to share the host's physical network. Which steps are correct?

Medium
254

Which THREE are built-in chains in the iptables filter table? (Choose three.)

Medium
255

Refer to the exhibit. Based on the exhibit, which service is configured to accept connections only from the local machine?

Medium
256

An administrator wants to force a user to change their password at next login. Which command should be used?

Easy
257

A Linux system administrator is troubleshooting a DNS resolution issue on a Ubuntu 20.04 server. The server is configured with a static IP address on interface eth0 via /etc/netplan/01-netcfg.yaml. The administrator set the DNS servers to 8.8.8.8 and 8.8.4.4 in the cloud-config file. After applying the netplan configuration, the server can resolve hostnames correctly. However, after a few days, users report that the server can no longer resolve external hostnames. The administrator checks /etc/resolv.conf and sees that it contains only a local DNS server (127.0.0.53) and no references to the public DNS servers. The administrator wants to ensure that the public DNS servers are always used and that local DNS is bypassed. What is the best course of action?

Medium
258

After configuring iptables rules on a Linux server, a junior administrator notices that incoming SSH connections from a specific IP address (192.168.1.100) are being blocked even though there is a rule to allow all traffic from that IP. The current rule set is: 1. -A INPUT -s 192.168.1.100 -j ACCEPT; 2. -A INPUT -p tcp --dport 22 -j DROP. What is the most likely reason for the block?

Medium
259

Refer to the exhibit. An administrator tries to start myapp.service with 'systemctl start myapp.service' but receives 'Failed to start myapp.service: Unit myapp.service is not loaded properly: Invalid argument'. What is the most likely issue?

Hard
260

A system administrator needs to ensure that a custom service named 'myapp.service' starts automatically after a reboot and also restarts automatically no matter how the service stops, even if it exits normally. Which two actions should the administrator take? (Choose two.)

Easy
261

After creating an XFS filesystem on /dev/sdb1, an admin mounts it and writes data. Later, they run 'xfs_info /mnt/data' and see the filesystem was created with default settings. What is the default inode size for XFS on a typical Linux system?

Medium
262

An administrator needs to view a list of users who have logged in recently. Which command provides this information?

Medium
263

Which TWO commands can be used to display real-time process resource usage on a Linux system? (Choose two.)

Medium
264

Refer to the exhibit. The output of 'ip addr show' reveals that eth0 is in state DOWN and has no IPv4 address. Which command is most likely to bring the interface up and obtain an IP via DHCP?

Medium
265

Which TWO commands can be used to check whether a systemd service is currently running?

Easy
266

Which TWO commands can be used to list the contents of a tar archive without extracting it?

Medium
267

Which TWO commands can be used to display the contents of a text file page by page? (Select two.)

Medium
268

Which THREE conditions must be met for a Linux system to function as a router between two networks?

Hard
269

A user 'alice' is unable to log in via SSH. The administrator checks /etc/shadow and sees 'alice:!:19234:0:99999:7:::'. What does the '!' in the password field indicate?

Easy
270

Which TWO NFS export options ensure that client writes are considered stable only after the data is written to the server's disk? (Choose two.)

Medium
271

Which TWO commands can be used to display the routing table on a Linux system?

Medium
272

An engineer wants to list all processes currently running under user 'appuser'. Which command is appropriate?

Easy
273

A custom service requires that the network is fully operational before it starts. Which directive should be added to the [Unit] section of the service's unit file to ensure this dependency?

Medium
274

Which TWO commands can be used to check the status of the sshd service on a system using systemd?

Medium
275

An administrator is configuring a bridge using iproute2. Which command correctly attaches eth0 to bridge br0?

Hard
276

After configuring the /etc/network/interfaces file as shown, the administrator runs 'ifup eth0'. Which IP address will be assigned to eth0?

Easy
277

An administrator wants to temporarily disable a user account without deleting it. The account should be locked, expire immediately, and the user should not be able to log in. Which single command accomplishes this with minimum side effects?

Hard
278

A system administrator wants to create a RAID 1 array using two whole disks /dev/sdb and /dev/sdc. They plan to use mdadm. Which command creates the array and builds it with two devices?

Medium
279

A user reports that a background process (PID 3456) is consuming 95% of CPU and causing system slowness. The process name is 'crypto-miner'. The administrator needs to immediately stop this process and ensure it does not restart. Which set of commands should the administrator execute?

Easy
280

A systems administrator needs to add a new user 'jdoe' with a home directory in /export/home, a UID of 1500, and an expiry date of 2025-12-31. Which command should they use?

Hard
281

Which TWO of the following commands can be used to display the current kernel ring buffer messages? (Select TWO.)

Hard
282

A company has a server with two network interfaces: eth0 (192.168.1.10/24, gateway 192.168.1.1) and eth1 (10.0.0.10/24, gateway 10.0.0.1). The server needs to reach a remote network 172.16.0.0/16 via a VPN tunnel that terminates at 10.0.0.5 on eth1. Which command should be used to add a route for this traffic?

Medium
283

An administrator is troubleshooting a server that runs a critical application. The server has 16 GB of RAM and 8 CPU cores. The administrator notices that the server becomes very slow during peak hours. Analysis of 'iostat -x 1' shows that the average wait time (await) for the main disk (sda) is consistently above 1000 ms, while the average service time (svctm) is around 5 ms. What is the most likely cause?

Hard
284

An administrator wants to run a script daily at 2 AM. They create a timer unit and a service unit. The service unit uses Type=oneshot. Which of the following timer configurations is correct?

Hard
285

Which TWO commands will correctly add the user 'john' to the 'docker' group without removing him from any existing supplementary groups?

Medium
286

You are the Linux administrator for a medium-sized company that uses a centralized authentication system (LDAP) for user accounts, but local files (/etc/passwd, /etc/shadow, /etc/group) are also used for a few service accounts. The server is running RHEL 8. A new employee, 'jane', needs to be added to the local system for a temporary project. You create the user with 'useradd jane' and set a password with 'passwd jane'. However, when jane tries to log in via SSH using her password, she receives 'Permission denied, please try again.' The SSH server is configured to allow password authentication. Other users (both LDAP and local) can log in successfully. You verify that the password was set correctly and that the account is not locked. What is the most likely cause and solution?

Hard
287

Refer to the exhibit. The nginx service failed to start. What is the most likely immediate next step to diagnose the issue?

Medium
288

A system administrator needs to configure bonding in active-backup mode. Which line in /etc/sysconfig/network-scripts/ifcfg-bond0 defines the bonding mode and primary interface?

Medium
289

Arrange the steps to configure a new user account with sudo privileges on a Linux system.

Medium
290

Which three files contain user account information?

Medium
291

Based on the exhibit, what is the average CPU idle percentage over the last 15 minutes?

Easy
292

A user is unable to write to a file. The output of 'ls -l file' shows '-r--r--r--'. Which command will grant write permission to the owner?

Medium
293

A user is unable to execute a script in their home directory. The script has permissions -rw-r--r--. Which command will allow the user to execute the script?

Medium
294

Which TWO of the following are valid methods to check the status of a systemd service named 'httpd'? (Select TWO.)

Easy
295

To view the system's default runlevel (target) at boot, which command is used on a systemd-based system?

Easy
296

A system administrator needs to set up software RAID1 on a server for /data. The available disks are /dev/sdb (500GB) and /dev/sdc (1TB). What is the maximum usable capacity of the RAID1 array?

Easy
297

Refer to the exhibit. A Linux administrator sees that 'myapp.service' is in a failed state with exit status 1. To troubleshoot, which command should the administrator use to view the full error output that the service produced before exiting?

Hard
298

An administrator wants to enforce that users in the 'contractors' group must change their password every 30 days, with a warning 7 days before expiry. Which command should be used?

Hard
299

Which TWO of the following commands can be used to check and repair an ext4 filesystem?

Easy
300

An administrator wants to ensure that a custom service (myapp.service) starts only after the network is available and the PostgreSQL database service is running. Which systemd unit file directive should be used?

Medium
301

After a kernel update, a service fails to start with 'cannot allocate memory'. The system has 16GB RAM and 8GB swap. Which command should the administrator run first to diagnose potential memory limits?

Hard
302

Which THREE are common tools used for network troubleshooting on Linux?

Medium
303

A system administrator needs to increase the size of an existing filesystem mounted at /var/www. The filesystem resides on a logical volume /dev/vg_web/lv_web. The volume group has free space. The administrator runs: lvextend -L +5G /dev/vg_web/lv_web, and then resize2fs /dev/vg_web/lv_web. The commands complete without error, but df shows the filesystem size did not change. What is the most likely reason?

Medium
304

Refer to the exhibit. User 'alice' is a member of groups 'users' and 'projectx'? She needs to be a member of 'staff' as well. Which of the following statements is true?

Medium
305

A system administrator is troubleshooting network connectivity from a server that can reach internal resources but cannot access the internet. The server's /etc/sysconfig/network-scripts/ifcfg-eth0 file contains: BOOTPROTO=static, IPADDR=10.0.0.10, NETMASK=255.255.255.0, GATEWAY=10.0.0.1. The administrator runs 'ip route show' and sees: default via 10.0.0.1 dev eth0. However, 'ping 8.8.8.8' fails. Which is the most likely cause?

Hard
306

A developer reports that a compiled binary 'app' fails to execute with 'Permission denied' error when run from a mounted directory '/mnt/software'. The binary has execute permissions for all users. What is the most likely cause?

Medium
307

A user named 'charlie' has just been added to the 'devops' group. However, when 'charlie' runs 'sudo -l', no sudo entries are shown. What is the most likely cause?

Hard
308

A user wants to find the location of the 'grep' binary. Which command should they use?

Easy
309

Which TWO commands can be used to create a new empty file?

Hard
310

Which TWO are valid methods to configure a network interface on a Linux system?

Hard
311

Which systemd unit type is used to group services and other units together for boot execution?

Easy
312

A user needs to view the contents of a compressed log file /var/log/syslog.gz without first decompressing it. Which command should they use?

Easy
313

A Linux server at a hosting provider uses a software RAID 5 array with three 2 TB disks (sda, sdb, sdc) configured as /dev/md0, hosting a large ext4 filesystem. The server experiences a performance degradation and I/O errors. The administrator checks /proc/mdstat and sees that /dev/sda is marked as failed. The remaining two disks are still active. The administrator has a spare disk /dev/sdd of the same size. The filesystem is sparse and can tolerate downtime. What is the most appropriate course of action to restore the array to a fully functional state with redundancy?

Easy
314

Which THREE conditions can cause an 'RTNETLINK answers: File exists' error when adding a static route?

Hard
315

Your company runs a critical database server that uses a 2TB XFS filesystem mounted at /data. The filesystem resides on an LVM logical volume (lv_data) within a volume group (vg_data) that spans four physical volumes (each 600GB SSD). You have been receiving low-space alerts: /data is at 95% capacity. After reviewing usage, you determine that the database will need an additional 500GB within the next month. The server has no additional physical disks available, but there is an unused 1TB SSD in inventory that you can install. However, the server is in production and cannot be rebooted. The system uses a 5.10 Linux kernel. Which of the following is the best approach to increase the available space for /data?

Hard
316

A system administrator needs to mount the boot filesystem on a typical Linux system with MBR partitioning. Which partition should be used?

Medium
317

Which tool is the recommended method for persistently configuring network interfaces in RHEL 8?

Easy
318

You are a system administrator for a financial firm. One of your users, 'alice', has forgotten her password and is locked out of the system. The security policy requires that all passwords must be changed every 30 days. Alice's account was disabled due to inactivity; the account has been inactive for 45 days. You need to unlock the account and ensure that Alice must change her password at the next login. You have root access. Which set of commands should you run?

Medium
319

A server is running out of disk space. Which command will show the disk usage of the root filesystem in a human-readable format?

Easy
320

Order the steps to configure a cron job that runs a script every day at 2 AM.

Medium
321

Which TWO commands can be used to display the routing table on a Linux system? (Choose two.)

Medium
322

Refer to the exhibit. A user attempts to read /etc/passwd and receives "Permission denied". What is the most likely reason?

Medium
323

To compress a file while preserving the original file, which command should be used?

Easy
324

An administrator needs to encrypt a block device (/dev/sdc) using LUKS. Which command creates an encrypted LUKS container on the device?

Hard
325

Match each Linux process signal to its numeric value.

Medium
326

Refer to the exhibit. The 'developers' group has members alice, bob, and charlie. User 'charlie' is not in the 'developers' group. Which statement is true?

Medium
327

Which command shows the default target for systemd?

Easy
328

A system administrator is configuring a custom systemd service that runs a Python script. The script logs output to stdout. The administrator wants to ensure that the service restarts automatically if it crashes, but only after a 10-second delay. Which directive should be added to the [Service] section of the unit file?

Hard
329

A system administrator needs to partition a new 2TB disk using GPT. Which tool should be used?

Easy
330

Refer to the exhibit. The /var partition is 100% full. Which command can be used to find the largest files in /var/log to free up space?

Easy
331

Refer to the exhibit. The shadow entry for user 'carol' shows 18000 in the third field. What does the value 18000 represent?

Hard
332

An administrator runs 'systemctl status sshd' and sees the output above. The administrator wants sshd to start automatically at boot. Which command should be used?

Medium
333

A user 'alice' has a umask of 027 in her .bashrc, but the system administrator wants to enforce a umask of 007 for all users in the 'staff' group. Where should the administrator place the umask command to ensure it cannot be overridden by users?

Hard
334

An administrator has created an LVM thin pool. Which command should be used to create a thin logical volume named 'thinvol' of size 100GB from the thin pool 'pool1' in volume group 'vg1'?

Medium
335

Refer to the exhibit. A server has two interfaces: eth0 (public) and eth1 (internal). The firewall zone 'internal' is assigned to eth1. An administrator wants to allow TCP traffic on port 8080 from eth1 to the server. Which command will achieve this without affecting existing rules?

Hard
336

Which command enables a service to start automatically at boot in a systemd-based system?

Easy
337

You manage a Linux server that provides DHCP services to a small office network using the dhcpd daemon. The server has two network interfaces: eth0 (192.168.1.1/24) serving the internal network, and eth1 (192.168.0.1/24) connected to a DMZ. The DHCP server is configured to serve addresses only on eth0. Users on the internal network report that they are not receiving IP addresses. You check the DHCP server and find that the dhcpd service is running and listening on UDP port 67. From a client, you run tcpdump and see DHCPDISCOVER packets being sent, but no DHCPOFFER from the server. You also verify that no firewall rules are blocking DHCP traffic on either side. What is the most likely reason for the failure?

Medium
338

An administrator needs to create a system user that runs a service (no login, no home directory). Which command is appropriate?

Easy
339

An administrator is configuring a Linux server to act as a web server. The server has two network interfaces: eth0 (public IP 203.0.113.10) and eth1 (private IP 10.0.0.10). The default policy on the INPUT chain is DROP. The administrator wants to allow incoming HTTP (port 80) traffic from any source but only to the public interface. Which TWO iptables rules should be added?

Easy
340

A system administrator is troubleshooting network connectivity from a Linux server to a remote host at 10.0.0.1. The server has a default gateway of 192.168.1.1. Running `ping 10.0.0.1` fails, but `ping 192.168.1.1` succeeds. The output of `ip route show` shows a default route via 192.168.1.1. Which additional step should the administrator take to further investigate?

Hard
341

A user reports that they cannot log in via SSH, but other users can. The administrator checks /var/log/auth.log and sees 'Failed password for invalid user'. What is the most likely cause?

Medium
342

A system administrator configures a new server with multiple disks. After partitioning and formatting, they mount a partition to /data. Several days later, they notice that the /data filesystem is full, but 'du -sh /data' reports only 2 GB used, while the partition is 100 GB. 'df -h' shows /data is 98% full. What is the most likely cause and the correct action?

Hard
343

A system has a RAID 5 array that is degraded. One of the three disks failed and was replaced. The administrator runs 'cat /proc/mdstat' and sees that the array is still degraded. Which command should be used to add the new disk (/dev/sdc1) to the array?

Hard
344

A system administrator needs to list all files in the current directory, including hidden files, in a long listing format sorted by modification time (oldest first). Which command achieves this?

Medium
345

A system administrator wants to configure a custom service to start automatically at boot. Which command accomplishes this?

Easy
346

A system running RHEL 8 experiences intermittent crashes. After reboot, 'journalctl -p err -b -1' outputs: 'PID 1234 (myapp) ended due to signal: KILL'. Which diagnostic step should the administrator perform next?

Hard
347

Match each Linux networking command to its primary function.

Medium
348

Which command can be used to display the UUID of a filesystem on /dev/sdb1?

Easy
349

A user needs to view the contents of a large text file one screen at a time. Which command is best for this?

Easy
350

A process (PID 1234) is hung and cannot be killed with SIGTERM. To force termination, which signal should be sent?

Medium
351

A system administrator needs to find all files that are larger than 100MB in the /var directory. Which command accomplishes this?

Medium
352

A storage administrator notices that a newly created XFS filesystem on a logical volume shows only 90% of the expected capacity. The logical volume is 100GB. What is the most likely cause?

Hard
353

A company deploys a new web server with two network interfaces: one for public access (eth0) and one for database access (eth1). The database server is at 10.0.0.10. The web server's default gateway is via eth0, but traffic to 10.0.0.10 is being routed through eth0 instead of eth1. What is the simplest fix?

Medium
354

Which THREE of the following are valid directives for the [Service] section of a systemd unit file?

Medium
355

Which THREE commands can change the priority of an already running process?

Hard
356

What is the purpose of the chmod 755 command in this exhibit?

Medium
357

A company is designing a multi-homed server with two network interfaces: one for internal traffic (eth0) and one for external traffic (eth1). The server must prioritize traffic to the 10.1.0.0/16 network through eth0. What is the best practice to ensure traffic to 10.1.0.0/16 uses eth0?

Hard
358

A systems administrator receives reports that a web server running Nginx is intermittently unresponsive. The server has 8 GB of RAM and 4 CPU cores. The administrator runs 'free -m' and sees that available memory is low, and 'top' shows that several nginx worker processes are using a high percentage of CPU. Which of the following is the most likely cause of the issue?

Medium
359

A company's backup script fails with an error indicating 'no space left on device' on an NFS mount. The administrator checks 'df -h' on the NFS client and sees the mount is at 90% usage. However, the NFS server shows the exported filesystem is only 50% full. What is the most likely cause?

Hard
360

A Linux administrator needs to temporarily stop a service named 'httpd' without disabling it from starting automatically on subsequent boots. Which command should be used?

Easy
361

A server running Ubuntu 20.04 uses netplan for network configuration. The admin wants to set a static IP address 10.0.0.100/24 on interface enp0s3 with gateway 10.0.0.1 and DNS servers 8.8.8.8 and 8.8.4.4. Which YAML configuration is correct?

Medium
362

Which of the following commands can be used to display the total, used, and available space for all mounted ext4 filesystems?

Easy
363

Which THREE of the following are valid Linux filesystem types that can be used for root partitions on a modern Linux system?

Medium
364

A system administrator runs 'grep -r 'error' /var/log' and gets many false positives. They want to search only for the exact word 'error' as a whole word, case-insensitively, and display line numbers. Which command should they use?

Hard
365

Which TWO commands can be used to mount a filesystem on /dev/sdb1 to /mnt/data?

Easy
366

You are managing a Linux server that hosts a critical application using a 500GB ext4 filesystem on an LVM logical volume. The application writes large log files that are rotated weekly. Recently, the system has been experiencing intermittent performance degradation and occasional 'Input/output error' messages when writing to the log directory. The disk (SSD) is relatively new, and SMART tests report no errors. The filesystem is not full, with 60% usage. You notice that the errors occur more frequently during peak write times. Which of the following is the most appropriate first step to diagnose and resolve the issue?

Hard
367

An administrator runs 'df -h' and notices that /dev/sda1 is 95% full. The administrator needs to identify the largest files in the filesystem. Which command sequence is most efficient?

Hard
368

A system administrator needs to change the group ownership of a file to 'developers' and set the setgid bit on a directory. Which two commands accomplish these tasks? (Choose two.)

Medium
369

A company runs a web application stack consisting of a frontend web server (web.service) and a backend application server (app.service). The app.service uses Restart=on-failure to automatically restart if it crashes. The administrator wants the web.service to automatically restart whenever app.service restarts, so that the frontend remains in sync with the backend. Which directive should be added to the web.service unit file's [Unit] section to achieve this?

Hard
370

A user reports that they can access websites by IP address but not by domain name. Which command should the administrator use to diagnose the issue?

Easy
371

A server has two network interfaces: eth0 (10.0.1.10/24, gateway 10.0.1.1) and eth1 (192.168.1.10/24, no gateway). Both are up. The default gateway is set to 10.0.1.1. A ping to 8.8.8.8 fails, but ping to 10.0.1.1 succeeds. What is the most likely cause?

Hard
372

Refer to the exhibit. What is the most likely security issue with this configuration?

Hard
373

Based on the exhibit, what happens if the service 'myapp' crashes?

Easy
374

A developer needs to temporarily allow incoming TCP connections on port 8080 for testing. Which iptables command adds a rule to the INPUT chain to accept this traffic?

Easy
375

Refer to the exhibit. The file script.sh has permissions -rwxr-x--- and is owned by root with group 'developers'. A user named 'alice' is a member of the 'developers' group. Which command allows alice to execute the script without changing the file's group ownership?

Medium
376

A system administrator needs to create a new ext4 filesystem on /dev/sdb1 with a reserved block percentage of 2% instead of the default 5%. Which command should be used?

Medium
377

Which TWO commands can be used to display the current working directory? (Choose exactly two.)

Hard
378

A security audit reveals that a sensitive file '/etc/shadow' has been modified. The file's permissions are set to 600 and owned by root. However, the audit logs show that a service account 'webapp' was able to read the file. The 'webapp' user is not in the root group. Which of the following is the most likely method the 'webapp' user used to read the file?

Hard
379

A system administrator needs to replace all occurrences of 'oldhost' with 'newhost' in /etc/hosts, but only on lines that contain the string 'domain'. Which sed command accomplishes this?

Hard
380

A Linux server hosts a critical web application and is connected to the corporate network via a bonded interface bond0, combining eth0 and eth1 in active-backup mode. The server has a static IP 192.168.1.100/24 and default gateway 192.168.1.1. Recently, users report intermittent connectivity. The administrator runs 'ip link show' and sees that eth0 and eth1 are both state UP, but bond0 shows 'state UP' and 'NO-CARRIER'. The bond primary slave is eth0. Also, 'ping 192.168.1.1' fails. What should the administrator do next?

Easy
381

Which command displays the current status of all active services?

Easy
382

An administrator wants to view the current memory usage in a human-readable format, showing totals for used and free memory. Which command should be used?

Easy
383

Refer to the exhibit. An administrator wants to bring up the eth1 interface using the existing connection. Which command should be used?

Easy
384

You are a systems administrator for a company that runs a web application on a Linux server with 16 GB of RAM and 4 CPU cores. The application uses Apache with mod_php and PostgreSQL. Recently, the server has been experiencing high load average (above 10) and the website is responding slowly. The 'top' command shows that many 'httpd' processes are in 'D' (uninterruptible sleep) state. The 'iostat -x 1' output shows high disk utilization (over 90%) and high average wait times (await > 200 ms) on the disk where PostgreSQL data is stored. The database is write-heavy, and you suspect that disk I/O is the bottleneck. Which of the following actions is most likely to improve the performance?

Medium
385

Based on the tcpdump output in the exhibit, what can be concluded about the TCP handshake?

Easy
386

A developer wants to change the ownership of a directory and all its contents recursively to user 'appuser' and group 'appgroup'. Which command accomplishes this?

Medium
387

A user wants to view the contents of a compressed file file.txt.gz without decompressing it permanently. Which two commands can be used? (Choose two.)

Easy
388

A company runs a monitoring agent service (monitor.service) that must start after the network is fully up and the DNS resolver is ready. The service currently has the following dependencies in its unit file: [Unit] Description=Monitoring Agent After=network.target Wants=network.target [Service] ExecStart=/usr/bin/monitor The service starts, but often fails to resolve hostnames because DNS is not yet available. Which change should be made to the unit file to ensure the service only starts after DNS is ready?

Medium
389

A service unit file includes the following: [Install] WantedBy=multi-user.target. What does this directive accomplish?

Medium
390

An administrator needs to permanently set a static IPv4 address 192.168.1.100/24 on interface eth0 using NetworkManager. Which command achieves this?

Medium
391

A user needs to see the contents of a gzip-compressed file 'data.txt.gz' without decompressing it. Which command is appropriate?

Easy
392

Refer to the exhibit. What is the most likely cause of the sshd service failure?

Medium
393

A system administrator is tasked with setting up a new 2TB disk for a database server. The database requires high read/write performance and redundancy. The server has a hardware RAID controller, but the administrator wants to use Linux software RAID for flexibility. Which of the following RAID levels should the administrator choose to maximize performance while providing fault tolerance, assuming the disk will be part of a larger array in the future?

Medium
394

An administrator needs to set the reserved block percentage on an ext4 filesystem to 1% for a non-root filesystem. Which command accomplishes this?

Medium
395

Refer to the exhibit. User alice attempts to create a file in /data/project but receives 'Permission denied'. User bob can create files successfully. What is the most likely reason?

Easy
396

A system administrator needs to ensure that a specific service, 'myapp', starts automatically after a system crash and also restarts if it fails. Which systemd unit directive should be used to achieve this behavior?

Hard
397

An administrator needs to mount an XFS filesystem with options to optimize for a database workload. Which mount option would reduce metadata updates to improve performance?

Medium
398

An administrator needs to replace all occurrences of the string 'foo' with 'bar' in all files under /etc/config, but only in files ending with .conf. The replacement must be done in-place, and backup copies should be created with a .bak extension. Which command accomplishes this?

Hard
399

A server runs a custom application that listens on TCP port 8080. The administrator wants to ensure the application starts automatically on boot and restarts if it crashes. Which systemd unit file directive should be used to achieve the restart behavior?

Hard
400

A system administrator needs to configure a static IP address on a CentOS 7 server. Which file should be edited to set the IP address permanently?

Easy
401

To check the disk usage of the /var/log directory in a human-readable format, which command is appropriate?

Medium
402

An administrator runs 'ls -la' and sees the following entry for a file: 'lrwxrwxrwx 1 root root 24 Jan 10 12:00 link -> /etc/passwd'. If the target file /etc/passwd is deleted, what happens to the link file?

Hard
403

A user reports that they cannot reach a remote server by hostname but can reach it by IP address. Which configuration file is most likely misconfigured?

Easy
404

A system administrator needs to check the current CPU load and memory usage on a Linux server. Which command should be used to display a dynamic, real-time view of running processes and system resource utilization?

Easy
405

An administrator wants to print the last field of each line from a CSV file 'data.csv' (comma-separated). Which awk command accomplishes this?

Hard
406

A network interface eth0 is not receiving an IP address via DHCP. Which command can be used to troubleshoot the DHCP client process?

Medium
407

Based on the exhibit, a system administrator runs ping to 8.8.8.8 and gets 'Destination Host Unreachable'. What is the most likely cause?

Medium
408

A temporary contractor 'contractor1' has left the company. The administrator needs to remove the user account and all associated files in the home directory. Which command accomplishes this?

Medium
409

Which two statements are true about systemd socket activation? (Choose two.)

Medium
410

A system administrator notices that a process is consuming 100% CPU and is unresponsive. Which command should be used to immediately stop the process if the PID is 2345?

Easy
411

Your company has a server that hosts a critical application. The application runs under a service account 'appuser'. Due to a security audit, it was discovered that 'appuser' has a password that never expires, which is against company policy. The policy requires that all user passwords expire after 60 days. Additionally, the application developers have requested that 'appuser' should not be allowed to change its own password via the 'passwd' command to prevent accidental lockouts. You need to enforce password expiry for 'appuser' but also ensure that only root can change its password. Which of the following approaches is the best course of action?

Hard
412

An admin notices a PV in a VG has failed. The VG is still accessible with redundancy. Which command sequence should be used to replace the faulty PV with a new one (/dev/sde) while the VG is active and without data loss?

Hard
413

After extending the logical volume, the df output still shows 100G. What is the most likely reason?

Medium
414

A systems administrator is troubleshooting a server that runs a database application. The server has 64 GB of RAM and 16 CPU cores. The administrator notices that the system is using a significant amount of swap space even though there is plenty of free memory. The 'free -m' command shows: total memory = 65536, used = 50000, free = 15536, buffers/cache = 10000, swap total = 8192, swap used = 6000. Which of the following is the most likely cause?

Medium
415

An administrator runs 'pwck' and receives an error indicating a user in /etc/passwd has no matching group in /etc/group. What is the most likely cause and the appropriate corrective action?

Hard
416

Which TWO commands can be used to display the group membership of a user? (Choose two.)

Medium
417

Which THREE actions will affect the state of a systemd service that is currently running? (Choose three.)

Hard
418

An administrator has enabled quotas on the /home filesystem by adding usrquota,grpquota to /etc/fstab and remounting. Then ran quotacheck -cug /home and it completed successfully. However, users are still able to write beyond their assigned soft limits. What step is missing?

Medium
419

You are a Linux administrator for a small company. A developer has deployed a web application on a server with IP 192.168.1.50. The application needs to connect to a database server at 10.0.0.100 on TCP port 3306. Both servers are on the same physical network but different subnets (192.168.1.0/24 and 10.0.0.0/24) connected by a router. The default gateway for the app server is 192.168.1.1, and for the DB server is 10.0.0.1. You have verified that the app server can ping the DB server by IP address successfully. However, the application fails to connect to the database. You have used telnet from the app server to test connectivity on port 3306 and it fails (connection refused). On the DB server, you check that the MySQL service is listening on 0.0.0.0:3306 and that the local firewall (firewalld) allows incoming connections on port 3306. What is the most likely cause of the connection failure?

Easy
420

Refer to the exhibit. An administrator attempts to mount all filesystems using mount -a, but it fails. The error message indicates that UUID=jkl012 is not found. Which of the following is the most likely cause?

Hard
421

A server with multiple network interfaces has intermittent connectivity issues. The administrator suspects routing table misconfiguration. Which command would show the current routing table?

Hard
422

You are managing a Linux server that hosts a shared project directory /projects/alpha, owned by the group 'alpha' (GID 2001). The directory has permissions 2770 (setgid, rwx for owner and group, no access for others). User 'jane' (UID 1501) has a primary group 'staff' (GID 1001) and is not in the 'alpha' group. She reports being unable to list or modify files in /projects/alpha. You need to give her access as a member of the 'alpha' group without changing her primary group. Which command sequence should you use?

Medium
423

Which TWO commands can be used to view the last 10 lines of a file and also follow new lines as they are written?

Medium
424

Based on the exhibit, which process is using the most physical memory (RES)?

Medium
425

You administer a Linux server that acts as a network gateway. It has two network interfaces: eth0 (external, with IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (internal, with IP 192.168.1.1/24). The server is running firewalld and has IP forwarding enabled. Internal hosts (192.168.1.0/24) can access the internet through NAT, which is configured using firewalld's masquerade on the external zone. However, you need to allow a specific internal server (192.168.1.100) to be reachable from the internet on TCP port 443 (HTTPS). You add a port forwarding rule using firewall-cmd: 'firewall-cmd --zone=external --add-forward-port=port=443:proto=tcp:toport=443:toaddr=192.168.1.100'. After reloading the firewall, external users still cannot connect to 203.0.113.10:443. You verify that the internal server is running HTTPS and that its local firewall allows port 443. What is the most likely reason the port forwarding is not working?

Medium
426

An administrator needs to set up a shared directory /project for the group 'projectteam' (GID 5000). All members of the group should be able to create and delete files, but only the file owner can modify their own files. The directory should also ensure that new files inherit the group ownership. Which set of commands achieves this?

Hard
427

A server needs to forward packets between two networks: 10.0.1.0/24 on eth0 and 10.0.2.0/24 on eth1. Which sysctl parameter must be enabled?

Medium
428

Which THREE of the following commands can be used to search for a string in multiple files and display the matching lines?

Hard
429

Refer to the exhibit. The /data directory needs to be resized to 15GB. What is the first step?

Easy
430

An administrator wants to limit the CPU usage of a service to at most 50% of a single CPU core. Which directive should be set in the [Service] section of the unit file?

Hard
431

Order the steps to configure a static IP address on a CentOS/RHEL 7 system using ifcfg files.

Medium
432

Match each logical volume management (LVM) term to its definition.

Medium
433

Which TWO commands are used to modify user account attributes such as password age, expiration, or lock status? (Choose two.)

Easy
434

Which two statements are true about LVM snapshots? (Choose two.)

Medium
435

A Linux server experiences intermittent high load averages but low CPU utilization. The administrator suspects an I/O bottleneck. Which command best identifies the specific device causing the bottleneck?

Hard
436

A system administrator needs to check the firewall rules on a Linux server using firewalld. Which two commands can be used to list the current rules? (Choose two.)

Easy
437

Scenario: You are managing a Linux server that hosts a web application. The application runs under the user 'webapp' and the group 'webgroup'. Recently, a new intern 'john' (username 'john') needs to be able to view and modify files in /var/www/html, which is owned by root:webgroup with permissions 775. John is currently a member of the group 'staff', but not 'webgroup'. The security policy requires that John must be able to edit files without using sudo, and his primary group must remain 'staff'. Which of the following actions should you take to meet the requirements?

Medium
438

A database administrator wants to compress a large directory of log files for archival. The administrator uses the command: tar -cvf logs.tar.gz logs/. The command completes successfully but the resulting archive is only 10 MB while the original directory is 100 MB. What is the most likely reason?

Hard
439

Which THREE files or directories are commonly used to configure network interfaces on a RHEL/CentOS system?

Hard
440

A storage administrator is troubleshooting a system where a new SCSI disk is detected by the kernel but not visible in /dev/disk/by-id/. What is the most likely cause?

Hard
441

Which TWO commands can change a user's primary group?

Medium
442

Which TWO commands can be used to check and repair an ext4 file system that is mounted as /data? (Choose two.)

Medium
443

An administrator is configuring LVM and wants to display information about physical volumes, volume groups, and logical volumes. Which two commands provide this information? (Choose two.)

Medium
444

A system administrator is troubleshooting a server that fails to mount an XFS filesystem on /dev/sdb1 during boot. The filesystem was recently created. Which command should the administrator run to check the filesystem for corruption?

Medium
445

A system administrator needs to find all files in /var/log that have been modified in the last 7 days. Which command accomplishes this?

Easy
446

A user reports that they cannot run a script because it says 'Permission denied'. The script is owned by root and has permissions -rw-r--r--. Which command would allow the user to execute the script?

Easy
447

An administrator needs to grant a user 'bob' the ability to run all commands as root without a password prompt. Which configuration in /etc/sudoers accomplishes this?

Easy
448

A DevOps engineer is writing a continuous integration pipeline that runs a script to deploy an application. The script is stored in a Git repository and is executed on a build server. The script works locally on the engineer's workstation, but when executed on the build server, it fails with '/bin/sh: line 12: somecommand: command not found'. The 'somecommand' is a standard Linux tool that is installed on the build server. The build server uses a minimal Docker container. Which of the following is the most likely cause and solution?

Medium
449

A large e-commerce platform runs on a database server that uses LVM thin provisioning. The thin pool is overcommitted at 200% (pool size 1TB, thin volumes total 2TB). Suddenly, the database reports write errors and performance degrades drastically. The administrator checks the system and finds that the thin pool is completely full. What is the immediate effect on the thin volumes, and what should the administrator do to restore normal operation without data loss?

Hard
450

A developer reports that a web application is running out of file descriptors. Which sysctl parameter should be reviewed and potentially increased?

Medium
451

A system administrator needs to create a shared group 'projectx' and add existing users 'bob' and 'carol' to it. The users need to collaborate on files in a directory /projectx. What is the correct sequence of commands to set up the group and ensure new files created in /projectx are automatically owned by the group 'projectx'?

Medium
452

Which TWO commands can display disk space usage of mounted filesystems? (Choose two.)

Easy
453

Which of the following statements is true about this unit?

Hard
454

After deleting user 'alice', the system administrator wants to also remove the home directory and mail spool. Which command should be used?

Hard
455

Match each Linux boot component to its description.

Medium
456

Which TWO commands should the administrator run to identify and fix the duplicate PV?

Hard
457

Given the network interface configuration in the exhibit, which command should be run to apply the configuration without rebooting?

Hard
458

A technician needs to display the contents of a compressed file named archive.tar.gz without extracting it. Which command should be used?

Medium
459

An administrator wants to see the disk usage of the /var directory in a human-readable format. Which command should be used?

Easy
460

A Linux system reports 'Out of memory' errors frequently. The administrator checks memory usage with 'free -m' and notices that most memory is used by file cache. Which command can the administrator run to immediately free up the cache without affecting running processes?

Medium
461

After attempting to log in as user 'alice', the system rejects the password. The admin checks /etc/passwd and sees 'alice:x:1001:1001::/home/alice:/bin/bash'. The /etc/shadow shows 'alice:!!:18200:0:99999:7:::', indicating the account is locked. Which command will unlock the account?

Hard
462

An administrator is troubleshooting DNS resolution and wants to query the SOA record for a domain. Which three commands can be used? (Choose three.)

Hard
463

A server has two NICs bonded in mode 1 (active-backup). If the active NIC fails, what occurs?

Medium
464

An administrator needs to configure a service to run as a non-root user for security reasons. Which systemd unit file directive accomplishes this?

Easy
465

An administrator wants to add user 'bob' to the supplementary group 'docker' without removing bob from any existing groups. Which command accomplishes this?

Easy
466

Which TWO configuration files are commonly used to set DNS resolver settings on a Linux system?

Easy
467

After adding a new disk and creating an ext4 filesystem on /dev/sdc1 with mke2fs, the administrator added an entry to /etc/fstab to mount it at /data. However, after reboot, the filesystem is not mounted. Which of the following is the most likely cause?

Hard
468

Existing user 'jdoe' is a member of groups 'users' (primary) and 'staff'. The administrator needs to add 'jdoe' to group 'projectx' while preserving existing supplementary group memberships. Which command achieves this?

Medium
469

A user with uid 1000 tries to read /etc/shadow and gets 'Permission denied'. The user is not in the shadow group. Which of the following actions would allow the user to read the file without changing the file's group or permissions?

Medium
470

An administrator needs to find the process ID of the cron daemon. Which combination of commands is most effective?

Hard
471

A system administrator needs to create a user account for a temporary contractor. The account should have a home directory under /home/contractors, the login shell should be /bin/bash, and the user should be a member of the 'contractors' group. Which command accomplishes this?

Easy
472

Which THREE commands can be used to view the contents of a file?

Medium
473

Which THREE files are directly related to user and group management in a Linux system? (Select three.)

Hard
474

A system administrator needs to find all files in /var/log that have been modified in the last 7 days. Which command accomplishes this?

Easy
475

Match each systemd unit type to its purpose.

Medium
476

A system administrator notices that '/var/log/syslog' has grown very large and is consuming significant disk space. The administrator wants to identify the largest log files in the '/var/log' directory hierarchy. Which command should the administrator use?

Easy
477

An administrator needs to schedule a cron job that runs a script every day at 3:00 AM, but the system is in a different time zone (UTC) than the administrator's local time (EST). The administrator wants the job to run at 3:00 AM local time regardless of system time zone changes. What is the best approach?

Medium
478

A script needs to search for lines containing 'ERROR' in /var/log/syslog and count them. Which command pipeline achieves this?

Medium
479

A sysadmin is troubleshooting an issue where a software RAID1 array fails to assemble after a reboot. The array was created with mdadm using /dev/sdb1 and /dev/sdc1. The administrator checks /proc/mdstat but the array is not present. They attempt to assemble manually with mdadm --assemble /dev/md0 /dev/sdb1 /dev/sdc1, but it requires a repair. After repair, the array works. To prevent this from happening again, what should the administrator do?

Medium
480

A system administrator is troubleshooting a production web server running CentOS 7 that became unresponsive. The server is still pingable, but SSH connections timeout. The admin performs an out-of-band console login. The server appears frozen; typing commands shows no output. The admin is able to trigger a Magic SysRq key sequence (Alt+SysRq+f) to kill the hung processes. After that, the server resumes normal operation. However, the admin wants to understand the root cause. Upon checking 'dmesg', they see repeated messages: 'NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s!' followed by stack traces from a kernel thread. Which action should the admin take to prevent recurrence while maintaining system stability?

Medium
481

Which TWO commands can be used to resolve a hostname to an IP address?

Easy
482

Which THREE factors can cause a system to fail to boot after changing kernel boot parameters in GRUB?

Hard
483

To check the details of a failed systemd service unit, including the last log entries, which command is most appropriate?

Easy
484

Refer to the exhibit. What is the most likely issue with the Apache web server?

Hard
485

Which TWO commands can be used to display listening TCP ports on a Linux system?

Easy
486

Refer to the exhibit. Which filesystem is close to full capacity?

Easy
487

An administrator is troubleshooting a server that cannot mount an XFS filesystem on /dev/sdb1. The command mount /dev/sdb1 /data fails with 'wrong fs type, bad option, bad superblock'. Which three commands can help diagnose the issue? (Choose three.)

Hard
488

Which two commands can be used to create an ext4 filesystem on a Linux block device? (Choose two.)

Easy
489

Match each Linux filesystem hierarchy standard (FHS) directory to its purpose.

Medium
490

Refer to the exhibit. The administrator attempted to create a user 'newuser' but received an error. Which command should be used to check if the user already exists?

Easy
491

An administrator wants to ensure that a specific LVM logical volume is automatically resized when the underlying physical volume is extended. Which steps are required?

Medium
492

An administrator needs to compress a directory named 'project' into a tarball with maximum compression using gzip. Which command is appropriate?

Easy
493

A developer accidentally deleted a critical file /var/log/app.log. The system administrator knows that the file was recently backed up using a cron job that runs 'tar -czf /backup/logs.tar.gz /var/log/'. Which command should the administrator use to restore the file from the backup without extracting the entire archive?

Medium
494

A database server is running out of space in its /var/lib/mysql directory. The system admin wants to add a new 100GB disk to increase storage. Which of the following steps should be performed to mount the new filesystem at /var/lib/mysql without data loss?

Medium
495

After editing /etc/sysconfig/network-scripts/ifcfg-eth0, the network service fails to start. Which is the best command to investigate?

Medium
496

A user's account needs to be set to expire on a specific date. Which command should the administrator use?

Medium
497

An administrator wants to ensure that a service is listening on TCP port 8080 and accessible from remote hosts. Which command will confirm that the service is listening on the correct interface?

Easy
498

A junior administrator needs to display the first 10 lines of a file named 'data.csv'. Which command should they use?

Easy
499

Which command displays the UUID of all filesystems on the system?

Easy
500

An administrator is investigating why the 'tomcat' service fails to start on a RHEL 8 server. The output of 'systemctl status tomcat' shows: 'Loaded: loaded (/etc/systemd/system/tomcat.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since ... Process: 4567 ExecStart=/opt/tomcat/bin/startup.sh (code=exited, status=1/FAILURE)'. The 'journalctl -u tomcat' shows: 'Error: JAVA_HOME is not defined correctly, cannot execute /usr/lib/jvm/java-11-openjdk/bin/java'. The admin checks /opt/tomcat/bin/startup.sh and sees it references JAVA_HOME. The admin verifies that Java 11 is installed at /usr/lib/jvm/java-11-openjdk. Which action should the admin take to fix the service?

Hard
501

A user reports that a script fails with 'Permission denied' when executed. The script has permissions -rw-r--r-- and is owned by the user. Which command should the user run to make the script executable for the owner only?

Medium
502

Which THREE of the following statements about the user private group (UPG) scheme are true?

Hard
503

Order the steps to mount an ext4 filesystem from an external USB drive automatically at boot.

Medium
504

An administrator receives an alert that the /var/log partition is 95% full. The partition is an LVM logical volume. The volume group has available free extents. Which of the following is the most efficient method to increase the size of the filesystem to 120GB (from current 100GB) without unmounting it?

Hard
505

Which THREE steps are required to create a new ext4 filesystem on /dev/sdc1 and ensure it is automatically mounted at /mnt/data at boot? (Choose three.)

Medium
506

Based on the exhibit, what is the most likely cause of the nginx failure and the appropriate first step to resolve it?

Hard
507

An administrator created a new user 'john' with the default settings, but 'john' cannot log in. The error message indicates an invalid shell. Which command should the administrator use to fix this issue?

Easy

Frequently asked questions

What does the scenario questions domain cover on the LFCS exam?
scenario questions questions test whether you can apply the concept in context, not just recognise a definition.
How many questions are in this domain?
This page lists all 507 scenario questions questions in the LFCS question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
What is the best way to practise this domain?
Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
Can I practise only scenario questions questions?
Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.