Hard Difficulty Questions

The /dev/mapper/vg_data-lv_data device does not exist.

Why wrong: Would cause different error.

The NFS share is unreachable.

Why wrong: Would cause a different error.

The /home filesystem type is incorrect.

Why wrong: Would cause different error.

The service is not enabled.

Why wrong: The output shows 'enabled'.

The main PID is incorrect.

Why wrong: There is no indication of PID issues.

The service is not running.

Why wrong: The status shows 'active (running)'.

Set setgid bit on /opt/project and set umask to 007

Why wrong: This option sets the setgid bit correctly but uses umask 007. With umask 007, new files get permissions 660 and directories 770, which do include group write. However, it also removes all permissions for others (---). While this meets the requirement for group write, it is more restrictive than necessary. The key misconception is that umask 007 denies group write—it does not. The standard solution is umask 002 to allow others read/execute permissions.

Set the sticky bit on /opt/project and umask to 022

Why wrong: Sticky bit affects deletion, not group inheritance; umask 022 gives group read only.

Set umask for developers to 002 only

Why wrong: Without setgid, new files may be owned by the user's primary group, not 'devteam'.

It sets an environment variable.

Why wrong: Environment directives are used for that.

It runs a post-start script.

Why wrong: ExecStartPost runs after ExecStart.

It runs a pre-start script; if it fails, the service still starts.

Why wrong: Only if IgnoreFailure=yes is set.

OnUnitActiveSec=24h

Why wrong: OnUnitActiveSec triggers after the service last started, not at a fixed time.

OnBootSec=1d

Why wrong: OnBootSec triggers a fixed time after boot, not at a specific clock time.

OnActiveSec=24h

Why wrong: OnActiveSec triggers after activation of the timer, not at a specific time.

newgrp groupname

Why wrong: Changes the current group ID, not user.

login username

Why wrong: login requires logging out first and starts a new session.

find /home -user alice -mtime -7 -exec tar -rf alice_recent.tar.gz {} +

Why wrong: Uses `tar -rf` which appends files to a tar archive but does not compress them. The resulting file is a plain tar archive, not a .tar.gz compressed file, so it does not meet the requirement for compression.

find /home -user alice -mtime -7 -print | cpio -o > alice_recent.tar.gz

Why wrong: Pipes `find` output to `cpio -o`, which creates a cpio archive, not a tar archive. The output is then redirected to a file named .tar.gz, but the content is not gzip compressed, resulting in an incorrect format.

find /home -user alice -mtime -7 | tar -cvf alice_recent.tar.gz

Why wrong: Pipes `find` output directly to `tar -cvf`, but `tar` expects a list of files on the command line, not via stdin. This command will fail to create the archive because `tar -cvf` does not read file names from stdin.

echo 'server:/export /mnt nfs defaults 0 0' >> /etc/fstab && mount -a

Why wrong: While mount -a is a valid method to mount filesystems from /etc/fstab, the given command involves two steps: adding an entry to fstab and then running mount -a. The question asks for direct mount commands that mount an NFS filesystem immediately without prior configuration. Additionally, the fstab entry uses 'defaults' which may not include necessary NFS options like 'hard' or 'intr' for proper operation. Therefore, option A is not considered a valid single-step mount method.

mount -t cifs server:/share /mnt

Why wrong: Incorrect: -t cifs is for CIFS, not NFS.

The remote server does not have SSH installed.

Why wrong: Similar to A, would not get publickey error.

The SSH service is not running on the remote server.

Why wrong: Would give 'Connection refused', not 'Permission denied'.

The remote server's firewall is blocking port 22.

Why wrong: Would timeout or show 'no route to host'.

ip route add 10.0.1.0/24 via 10.0.0.1 dev eth1

Why wrong: This command is a valid syntax for adding the route; however, because another option also uses valid syntax, the correct answer is 'Both B and C are correct' (option A).

ip route add 10.0.1.0/24 dev eth1 via 10.0.0.1

Why wrong: This command is also a valid syntax for adding the route; similarly, it is correct but the best answer is option A.

route add -net 10.0.1.0 netmask 255.255.255.0 gw 10.0.0.1 eth1

Why wrong: This command uses the legacy `route` command with incorrect syntax. The interface name must be preceded by the `dev` keyword (e.g., `route add -net 10.0.1.0 netmask 255.255.255.0 gw 10.0.0.1 dev eth1`). Therefore, it is incorrect.

Restart the nginx service.

Why wrong: Restarting will not free the port; the same error will occur.

Increase the worker_connections in nginx.conf.

Why wrong: worker_connections controls concurrent connections, not binding to a port.

Reduce the MaxClients parameter in nginx.conf.

Why wrong: MaxClients is not a valid nginx directive; it is Apache.

It restarts immediately

Why wrong: RestartSec introduces a delay.

It retries infinitely regardless of exit code

Why wrong: on-failure only triggers on failure, not success.

It does not restart

Why wrong: on-failure restarts on exit code != 0.

Mode 2 (balance-xor) distributes traffic based on packet type.

Why wrong: It uses XOR of MAC addresses, not packet type.

Modes 5 and 6 (balance-tlb and balance-alb) require IEEE 802.3ad switch support.

Why wrong: These do not require switch support.

Bob's account will be locked.

Why wrong: Account lock occurs only after the account expiry date, not on password expiration.

Bob's password will be disabled.

Why wrong: Password is not disabled; the user must change it.

Bob will receive a warning message only.

Why wrong: Warnings are sent before expiration, but on the due date the user is forced to change password.

ntpdate -u pool.ntp.org

Why wrong: Deprecated; chrony is now standard.

ntpd -g

Why wrong: Starts ntpd, not immediate single sync.

timedatectl set-ntp true

Why wrong: Enables NTP service, not immediate sync.

kill -19 1234

Why wrong: SIGSTOP suspends the process; it does not terminate it.

kill -2 1234

Why wrong: SIGINT is intended for interactive processes and may be ignored by background processes.

kill -9 1234

Why wrong: SIGKILL forcefully kills the process without cleanup, which can lead to data loss or corruption.

userdel temp_audit

Why wrong: Deletes the user entirely, which is more drastic than locking.

chage -E 0 temp_audit

Why wrong: Sets account expiration to past date, which disables the account, but does not lock it; user still could use SSH keys if configured.

passwd -u temp_audit

Why wrong: -u unlocks, not locks.

The umask 0027 ensures files created are NOT readable by the group.

Why wrong: umask 0027 means the default permissions subtract 0027 from the base permissions. For files (base 666), this results in 640 (owner read/write, group read, others none). So group read permission is granted, not denied. To deny group read, umask would need to be 0037 or higher.

The primary group of a user is a system group with GID less than 1000.

Why wrong: In UPG scheme, the primary group is the user's private group, which has a GID usually matching the UID (often >= 1000 for regular users). System groups have GID < 1000 and are not used as primary groups for regular users under UPG.

The original volume becomes read-only.

Why wrong: The original volume remains read-write.

The backup completes successfully but data may be inconsistent.

Why wrong: The backup will likely fail because writes to the snapshot cannot be stored.

The original volume is automatically extended.

Why wrong: No auto-extension occurs; the snapshot is dropped.

The web server is not listening on the public IP address.

Why wrong: Listening on 0.0.0.0 means it listens on all interfaces, including the public one.

A firewall rule is blocking incoming HTTPS traffic.

Why wrong: The iptables output shows no rules, so no traffic is being blocked.

The private interface eth1 has a misconfigured IP address.

Why wrong: The routing table shows a valid route on eth1, and the database connectivity is not mentioned as an issue.