Hard Difficulty Questions

userdel -Z alice

Why it fails: userdel -Z applies or removes SELinux user mappings via -Z, leaving the home directory and mail spool intact. It is tempting because -Z appears in other account-management commands for SELinux contexts, but here it only alters labelling; the required behaviour needs -r, which removes the home directory and mail spool.

userdel -f alice

Why it fails: -f forces deletion even if logged in, but does not remove home.

userdel --remove alice

Why it fails: userdel --remove is not a valid long option; userdel accepts -r or --remove-home, and the mail spool is only removed when -r is combined with the correct flag. It is tempting because the wording matches the intent, but the actual option name differs, so the command fails rather than deleting the home directory.

chown root:projectteam /project; chmod 2775 /project; setfacl -m g:projectteam:rwx /project

Why it fails: Default ACL not set, so new files may not inherit group permissions.

chown root:projectteam /project; chmod 2775 /project

Why it fails: Sticky bit (1) prevents deletion of others' files, which is not desired.

chown root:projectteam /project; chmod 1770 /project; setfacl -m m::rwx /project

Why it fails: Sticky bit (1) prevents deletion; mask not inherited.

newgrp groupname

Why it fails: Changes the current group ID, not user.

login username

Why it fails: login requires logging out first and starts a new session.

find /home -user alice -mtime -7 -exec tar -rf alice_recent.tar.gz {} +

Why it fails: Uses `tar -rf` which appends files to a tar archive but does not compress them. The resulting file is a plain tar archive, not a .tar.gz compressed file, so it does not meet the requirement for compression.

find /home -user alice -mtime -7 -print | cpio -o > alice_recent.tar.gz

Why it fails: Pipes `find` output to `cpio -o`, which creates a cpio archive, not a tar archive. The output is then redirected to a file named .tar.gz, but the content is not gzip compressed, resulting in an incorrect format.

find /home -user alice -mtime -7 | tar -cvf alice_recent.tar.gz

Why it fails: Pipes `find` output directly to `tar -cvf`, but `tar` expects a list of files on the command line, not via stdin. This command will fail to create the archive because `tar -cvf` does not read file names from stdin.

sed 's/oldhost/newhost/g' /etc/hosts | grep domain

Why it fails: Incorrect. Only outputs matching lines without editing the file.

sed -i '/domain/s/oldhost/newhost/' /etc/hosts

Why it fails: Incorrect. Lacks the `g` flag, so only replaces first occurrence per line.

sed -ne '/domain/s/oldhost/newhost/gp' /etc/hosts

Why it fails: The -n flag suppresses automatic printing, and only lines where a substitution occurred are printed via p, so the file is never modified and unmatched lines vanish from output. It suits previewing changes, not in-place editing of /etc/hosts.

Bob's account will be locked.

Why it fails: Account lock occurs only after the account expiry date, not on password expiration.

Bob's password will be disabled.

Why it fails: Password is not disabled; the user must change it.

Bob will receive a warning message only.

Why it fails: Warnings are sent before expiration, but on the due date the user is forced to change password.

ntpdate -u pool.ntp.org

Why it fails: Deprecated; chrony is now standard.

ntpd -g

Why it fails: Starts ntpd, not immediate single sync.

timedatectl set-ntp true

Why it fails: Enables NTP service, not immediate sync.

The umask 0027 ensures files created are NOT readable by the group.

Why it fails: umask 0027 means the default permissions subtract 0027 from the base permissions. For files (base 666), this results in 640 (owner read/write, group read, others none). So group read permission is granted, not denied. To deny group read, umask would need to be 0037 or higher.

The primary group of a user is a system group with GID less than 1000.

Why it fails: In UPG scheme, the primary group is the user's private group, which has a GID usually matching the UID (often >= 1000 for regular users). System groups have GID < 1000 and are not used as primary groups for regular users under UPG.

The script has a restrictive umask.

Why it fails: umask affects the permissions of newly created files, not whether sudo permits execution; sudo checks the invoking user's authorisation before the script's mode bits matter. A restrictive umask would be relevant when creating files, not when running an existing script through sudo.

The script is not owned by 'backup'.

Why it fails: sudo runs the command as the target user regardless of the script's owner, so ownership does not gate execution. Ownership matters for setuid binaries or for permission checks performed as the invoking user, not for a sudo invocation that already passed authorisation.

The 'backup' user is not in the sudoers file.

Why it fails: If 'backup' were absent from sudoers, sudo would refuse outright with a policy error, but the stem says the script fails to run as that user, implying sudo itself succeeded. sudoers membership governs authorisation to invoke sudo, not the execution of the script once sudo has granted it.

cut -d',' -f3 file.csv

Why it fails: cut splits strictly on every comma delimiter and ignores quoting, so fields containing embedded commas shift the column boundaries and the wrong data is returned. It is tempting because it is the simplest delimiter tool, but it would be correct only for CSV files whose fields never contain the delimiter.

awk -F',' '{ print $3 }' file.csv

Why it fails: Simple comma split fails on quoted commas.

sed 's/[^,]*,[^,]*,\\([^,]*\\).*/\1/' file.csv

Why it fails: sed regex fails on quoted commas.

crontab -e

Why it fails: crontab -e opens the user's crontab file for editing, which is used for recurring jobs. While it can schedule a job to run on July 15 at 2:30 AM, it would repeat annually unless removed. It is not designed for one-time execution, so it is not the best choice.

systemd-run --on-calendar="*-07-15 02:30:00"

Why it fails: systemd-run with --on-calendar creates a transient timer unit that can schedule tasks, but it is more complex and typically used for recurring events. While it can be configured for a one-time run, it is not the standard or simplest method for a single future execution as described.

batch

Why it fails: batch schedules commands to run when system load averages drop below a certain threshold, typically 0.8. It does not accept a specific time or date, so it cannot be used to run a job at 2:30 AM on July 15. It is intended for deferrable, low-priority tasks.

ip link set br0 master eth0

Why it fails: The syntax inverts the relationship: master must be set on the enslaved interface, so the correct form is ip link set eth0 master br0. It is tempting because it uses the right iproute2 command and keywords, only reversing which device is named as the master.

nmcli device modify eth0 master br0

Why it fails: nmcli manages NetworkManager connection profiles, not iproute2 bridge enslavement, and requires an existing connection profile for eth0. It is tempting because nmcli device modify genuinely enslaves interfaces on NetworkManager-managed hosts, which is the supported approach there.

brctl addif br0 eth0

Why it fails: brctl belongs to the legacy bridge-utils package, not iproute2, so it is unavailable on systems where only iproute2 tooling is installed. It is tempting because brctl addif is the classic documented syntax for attaching an interface to a bridge, and remains correct on hosts still carrying bridge-utils.

The umask command in /etc/profile has a syntax error that is silently ignored.

Why it fails: A malformed umask line would produce an error message, and the stated value 027 is valid syntax, so silent failure does not explain the retained 022. Syntax errors are tempting to blame because they are common in shell scripts, but they would be the cause only if the command itself were mistyped.

The admin placed the umask command after the call to /etc/bash.bashrc which resets it.

Why it fails: /etc/profile does not call /etc/bash.bashrc; the ordering is the reverse, and bash.bashrc is read by non-login interactive shells. This is tempting because later configuration files can override earlier settings, which would be the cause if a subsequent profile script reset the umask.

The admin forgot to run 'source /etc/profile' on each user's session.

Why it fails: /etc/profile is read by the login shell at each login, so no manual sourcing is needed; the change applies automatically to new sessions. Re-sourcing is tempting because it forces a shell to re-read configuration, which is the correct fix only when testing edits in an already-running interactive shell.

useradd -u 1500 -d /export/home/jdoe -c 2025-12-31 jdoe

Why it fails: The -c flag sets the GECOS comment field, so 2025-12-31 becomes jdoe's description rather than an account expiry; -e is the expiry flag. It is tempting because -c and -e look similar and both accept a date-like string, but -c is for the comment field only.

useradd -u 1500 -m -e 2025-12-31 jdoe

Why it fails: The -m flag creates a home directory using the default base path from /etc/default/useradd, not /export/home, so jdoe's home lands in /home. It is tempting because -m is the standard way to request home directory creation, and it would be correct once -b /export/home sets the base.

useradd -u 1500 -b /export/home -e 2025-12-31 jdoe

Why it fails: The -b flag only sets the base directory for future accounts; without -m, no home directory is created for jdoe, so the requirement fails. It is tempting because -b correctly names /export/home, and it would be the right choice when combined with -m to create the directory.

:> /var/log/nginx/access.log && cp /var/log/nginx/access.log /var/log/nginx/access.log.bak && gzip /var/log/nginx/access.log.bak

Why it fails: Truncating first empties the file, so the subsequent copy captures nothing and the original 4 GB of content is lost before compression. The sequence compresses an empty backup. Copying the file to a separate path, then truncating the original and gzipping the copy, preserves the data.

rm /var/log/nginx/access.log && touch /var/log/nginx/access.log && chmod 644 /var/log/nginx/access.log

Why it fails: Deleting the file discards all 4 GB of log data and leaves nginx holding the unlinked inode, so space is not freed until restart. It is tempting because removal appears to reclaim space instantly, and would be correct when the logs are genuinely unwanted and no audit retention applies.

mv /var/log/nginx/access.log /var/log/nginx/access.log.bak && touch /var/log/nginx/access.log && gzip /var/log/nginx/access.log.bak

Why it fails: Renaming the file leaves nginx writing to the original inode, so the 4 GB is never reclaimed and the new access.log stays empty. This pattern is tempting because it mirrors logrotate's create mode, and would be correct when the daemon reopens its log on SIGHUP or restart.

It sets an environment variable.

Why it fails: ExecStartPre specifies a command executed before ExecStart, not an environment assignment; environment variables come from Environment= or EnvironmentFile=. It is tempting because pre-start hooks often configure runtime context, but here /bin/true simply runs and exits successfully, leaving the environment unchanged.

It runs a post-start script.

Why it fails: ExecStartPre runs before ExecStart, not after the service has started; post-start commands belong to ExecStartPost. It is tempting because both directives sit adjacent in unit files, but ordering is defined by the name, and /bin/true here executes prior to myapp launching.

It runs a pre-start script; if it fails, the service still starts.

Why it fails: A failing ExecStartPre command prevents the unit from starting — systemd aborts the start sequence rather than continuing. It is tempting to assume pre-start scripts are advisory, but systemd treats any non-zero exit from ExecStartPre as a failure, so the service never reaches ExecStart.

find /home -type f -size +100000000c

Why it fails: The `c` suffix counts bytes, so `+100000000c` matches files exceeding 100,000,000 bytes — roughly 95 MiB, not 100 MB. It is tempting because byte-precise sizing is genuinely useful when exact byte thresholds matter, such as matching a quota or API limit expressed in bytes rather than binary mebibytes.

find /home -type f -size +100MB

Why it fails: Incorrect: `MB` is not a valid size suffix; find expects `M` for mebibytes or `k` for kibibytes.

find /home -type f -size 100M

Why it fails: Incorrect: `-size 100M` matches files exactly 100 MB in size, not larger than 100 MB.

The service configuration file has a syntax error.

Why it fails: A syntax error in a configuration file causes the service to fail immediately and repeatedly at parse time, with the parser naming the offending line in the journal, not the runtime errors shown. It would be the cause where journalctl logs a parse failure before the unit ever starts.

The system is out of memory.

Why it fails: Memory exhaustion would surface as OOM-killer messages or allocation failures in the journal, not the specific error recorded in the stem. It tempts because OOM kills do stop services, and would be correct if the log showed the kernel terminating the process.

The service is trying to write to a read-only filesystem.

Why it fails: A read-only filesystem produces EROFS write errors naming the mount, which the stem's journal excerpt does not show. It tempts because failed writes do crash services, and would be correct if the log recorded write attempts rejected by a read-only mount.

Set up a cron job to run every minute that checks memory usage with free and if > 90%, restart the service with systemctl restart. Also configure MemoryMax=32G in the systemd unit.

Why it fails: Polling via cron cannot detect an unresponsive service, only host-wide memory pressure, and restarts blindly without systemd's own watchdog or MemoryMax enforcement. MemoryMax=32G alone is sound, but the monitoring half fails requirement (3): systemd's OnFailure or MemoryHigh units give early warning where free does not.

Configure sysctl vm.overcommit_memory=2 to prevent overcommit, and allocate huge pages for Java. Also set Restart=always in the systemd unit.

Why it fails: Disabling overcommit and huge pages address allocation policy, not per-service cgroup limits, so the Java process can still exhaust RAM and trigger system OOM kills. Restart=always recovers after a crash but gives no early warning. This suits tuned database workloads, not leak containment.

Use ulimit -v 33554432 in the service script to limit virtual memory, and set Restart=always. Also configure a cron job to send alerts when dmesg shows OOM.

Why it fails: ulimit -v caps virtual address space, which the JVM reserves far in excess of heap, causing startup or allocation failures rather than a real memory ceiling. dmesg OOM alerts arrive after the kill. systemd's MemoryMax and watchdog handle both requirements natively.

The CPU is overloaded, causing processes to wait for CPU time.

Why it fails: High await with low svctm points to I/O queueing, not CPU contention; CPU saturation would show high load or run-queue delays, not disk wait. It is tempting because slow peak-hour performance often stems from CPU, and would be correct if vmstat showed runnable processes waiting.

The system is using swap space heavily, causing disk I/O.

Why it fails: Heavy swap usage would cause high disk utilization, but the svctm would likely be higher because swapping involves random I/O, and the await would be high as well. However, the low svctm suggests the disk is serving requests quickly once they start, which is not typical of swap.

The disk is experiencing hardware errors.

Why it fails: Hardware errors would raise svctm, not leave it at 5 ms while await exceeds 1000 ms; the gap indicates queueing. It is tempting because disk faults cause slowness, and would be correct if iostat showed elevated service times or errors.