Select Two (Multi-Select) Questions

traceroute

Why it fails: This traces the network path, not primarily for DNS resolution.

ping

Why it fails: Ping does DNS resolution but is not primarily for that purpose.

ifconfig

Why it fails: This shows network interfaces, not DNS resolution.

nmap -sT localhost

Why it fails: nmap is a scanner, not a tool to display current listening ports.

iptables -L

Why it fails: iptables -L lists firewall rules, not listening ports.

lsof -i TCP

Why it fails: lsof -i TCP shows all TCP connections, not only listening ports.

The umask 0027 ensures files created are NOT readable by the group.

Why it fails: umask 0027 means the default permissions subtract 0027 from the base permissions. For files (base 666), this results in 640 (owner read/write, group read, others none). So group read permission is granted, not denied. To deny group read, umask would need to be 0037 or higher.

The primary group of a user is a system group with GID less than 1000.

Why it fails: In UPG scheme, the primary group is the user's private group, which has a GID usually matching the UID (often >= 1000 for regular users). System groups have GID < 1000 and are not used as primary groups for regular users under UPG.

Run the command 'systemctl set-static-ip eth0 192.168.1.100/24'

Why it fails: No systemctl verb sets a static IP address; systemctl manages units, not network configuration. It is tempting because systemctl is the standard CentOS 7 service-control tool, and it would be correct for enabling or restarting the NetworkManager service rather than assigning addressing.

Use 'ip addr add 192.168.1.100/24 dev eth0'

Why it fails: 'ip addr add' applies addressing at runtime only and is lost on reboot, so it does not persistently set a static address. It is tempting because it works immediately for testing, and it would be correct for temporary troubleshooting rather than configuring a permanent static IPv4 address.

Edit the /etc/network/interfaces file

Why it fails: CentOS 7 uses NetworkManager and ifcfg files under /etc/sysconfig/network-scripts; /etc/network/interfaces is Debian/Ubuntu syntax and is ignored. It is tempting because it is the standard static-IP method on Debian-family systems, so it would be correct on Ubuntu rather than CentOS 7.

xfs_repair /dev/sdb1

Why it fails: xfs_repair targets XFS filesystems and will not process ext4 superblocks or inode tables. It is tempting because it is the standard repair utility for a common Linux filesystem, and it would be correct when the damaged volume is formatted as XFS instead of ext4.

mkfs.ext4 /dev/sdb1

Why it fails: mkfs.ext4 creates a new ext4 filesystem, destroying existing data rather than checking or repairing it. It is tempting because it is the ext4-specific tool an administrator reaches for, and it would be correct when preparing a fresh volume that has no filesystem yet.

btrfs check /dev/sdb1

Why it fails: btrfs check validates and repairs Btrfs filesystems, not ext4; it cannot interpret ext4 metadata structures. It is tempting because it is the check-and-repair command for a Linux filesystem, and it would be correct when the volume in question is formatted with Btrfs rather than ext4.

swapoff /dev/sdc1

Why it fails: swapoff disables swap on a device or file. It is the opposite of what is needed here; the administrator wants to activate new swap, not deactivate it. Running swapoff on a device that is not currently active would have no effect, and it does not prepare or enable swap.

mount -t swap /dev/sdc1 /mnt

Why it fails: Swap space is not mounted like a regular filesystem. The mount command does not support a swap filesystem type in this manner. Swap is activated with swapon, not mount. Attempting to mount a swap partition would fail because it lacks a mountable filesystem structure.

echo '/dev/sdc1 none swap sw 0 0' >> /etc/fstab

Why it fails: Adding an entry to /etc/fstab ensures the swap is activated at boot, but it does not activate the swap immediately. The scenario requires the swap to be available without rebooting. While this step is useful for persistence, it is not part of the immediate activation process.

last

Why it fails: last reads the wtmp login history, showing past and current logins with timestamps, not a live list of users currently logged in. It is tempting because it reports login activity, and it would be correct when auditing historical login records rather than active sessions.

id

Why it fails: The id command reports the invoking user's own UID, GID and group memberships, not a list of logged-in users. It is tempting because it queries user identity data, and it would be relevant when verifying a single account's credentials rather than enumerating active sessions.

Add 'exec' to the fourth field of /etc/fstab for the entry.

Why it fails: The exec flag explicitly permits binary execution, directly contradicting the noexec requirement. It is tempting because exec is the default and is the correct entry when a filesystem must allow scripts and programs to run, such as a shared application directory where administrators have deliberately removed a prior noexec restriction.

Add 'defaults' to the fourth field of /etc/fstab for the entry.

Why it fails: The defaults keyword expands to rw, suid, dev, exec, auto, nouser and async, so it enables exec rather than disabling it. It is tempting because defaults is the conventional fstab value for ordinary data volumes, and would be correct when no execution restriction is required on that mount point.

mount --bind /mnt/data1 /mnt/data2

Why it fails: The --bind flag creates a second mount of an existing tree at a new location; it copies the source mount's flags and offers no mechanism to add noexec, so binaries remain executable. It is tempting because bind mounts are the standard way to expose a directory elsewhere, which would be correct when the goal is path redirection rather than restricting execution.

Run 'systemctl mask myapp.service' to prevent manual stops.

Why it fails: Masking symlinks the unit to /dev/null, preventing any start, including at boot, and does nothing about automatic restarts. It is tempting as a way to stop manual interference, and would be correct if the goal were to make the service permanently unstartable.

Set 'Restart=on-failure' in the [Service] section of the service file.

Why it fails: Restart=on-failure only restarts on non-zero exit, signals or timeouts, so a clean exit leaves the service stopped. It is tempting because it is the standard restart directive, and would be correct if the requirement excluded normal exits.

Add 'After=network.target' to the [Unit] section of the service file.

Why it fails: Ordering after network.target only sequences startup relative to networking; it does not enable the unit at boot nor restart it on exit. It is tempting because dependencies genuinely control activation ordering, and would be correct if myapp needed network availability before launching.

vmstat 1

Why it fails: vmstat 1 samples system-wide CPU, memory, and I/O counters every second, but it aggregates across all processes rather than showing per-process resource usage. It is tempting because the interval argument gives real-time refresh, making it correct for system-level performance trending, not per-process monitoring.

ps -aux

Why it fails: ps -aux produces a static snapshot of current processes; it exits immediately and does not refresh, so it cannot show real-time usage. It is tempting because it lists per-process CPU and memory figures, making it the correct choice when a one-off process listing is needed rather than continuous monitoring.

free -h

Why it fails: free -h reports aggregate memory and swap statistics in human-readable units, not per-process resource consumption, and it does not refresh continuously. It would be the right tool for checking overall RAM usage at a single moment, but the question asks for real-time per-process monitoring.

Using sysctl to set net.ipv4.conf.eth0.forwarding

Why it fails: sysctl tunes kernel runtime parameters such as IP forwarding; it cannot assign an IP address, netmask or gateway to eth0. It is tempting because net.ipv4.conf.eth0.* keys are genuinely per-interface, so sysctl would be the correct choice for enabling forwarding or disabling ICMP redirects on that interface.

Using systemctl enable network.service

Why it fails: systemctl enable only sets a unit to start at boot; it does not assign an IP address, netmask or gateway to an interface. It is tempting because systemctl manages the network service daemon itself, which would be the correct tool for enabling persistent network management at boot, not for configuring interface parameters.

Editing /etc/sysconfig/network

Why it fails: /etc/sysconfig/network holds global hostname and routing settings, not per-interface addressing; interface configuration lives in /etc/sysconfig/network-scripts/ifcfg-*. It is tempting because it is a legitimate network configuration file on RHEL-family systems, and would be the correct place to set a global gateway or hostname.

The 'RuntimeMaxUse' directive applies to the journal stored in /var/log/journal.

Why it fails: RuntimeMaxUse applies to the runtime journal stored in /run/log/journal, which is volatile. The persistent journal in /var/log/journal is controlled by SystemMaxUse.

The 'Compress' directive is set to 'no' by default.

Why it fails: The default value for Compress is 'yes', meaning journal entries are compressed by default.

The 'ForwardToSyslog' directive is set to 'yes' by default.

Why it fails: The default is 'no' for ForwardToSyslog; journald does not forward messages to syslog by default.

useradd -G

Why it fails: useradd creates a new account and its -G flag sets supplementary groups only at creation, so it cannot modify an existing user. It tempts because the -G syntax looks like group assignment, and would be correct when provisioning a brand-new user with supplementary groups.

addgroup

Why it fails: addgroup creates a new group or, in its interactive form, changes a user's primary group; it does not append an existing user to a supplementary group. It tempts because it manages group membership, and would be correct when creating a fresh group on Debian-based systems.

groupmod

Why it fails: groupmod edits a group's own attributes, such as its name or GID; it cannot add a user to a group's membership. It tempts because it manipulates groups directly, and would be correct when renaming an existing group or changing its numeric identifier.

grep

Why it fails: Searches for patterns, not for viewing entire file.

find

Why it fails: Searches for files, does not display contents.

systemctl status firewalld

Why it fails: This command shows the status of the firewalld service (running or not), not the firewall rules themselves. It does not list any rules.

iptables -S

Why it fails: This command lists rules in the legacy iptables table. However, firewalld uses nftables as its backend, and iptables rules may not reflect the current firewalld configuration. It bypasses firewalld's zone abstraction.

iptables -L

Why it fails: Similar to iptables -S, this command lists iptables rules but does not query firewalld's native configuration. It may show rules that are not managed by firewalld.

gzip file.gz

Why it fails: gzip compresses files; given an already-compressed file.gz it either reports the suffix or recompresses, and it never writes decompressed content to stdout. It would be the right tool to create file.gz from an uncompressed source, which is the opposite of viewing contents without permanent decompression.

gunzip file.gz

Why it fails: gunzip decompresses file.gz, replacing it with the uncompressed file on disk, so contents are not viewed without permanent decompression. It is tempting as the standard decompression tool, and would be correct if the task were to permanently restore the original file.

fdisk

Why it fails: fdisk partitions block devices; it neither captures packets nor queries interfaces, routes or sockets. It is tempting because storage inspection is common Linux administration, and it would be correct where the requirement is managing disk partitions rather than troubleshooting network connectivity.

useradd

Why it fails: useradd creates and modifies local user accounts; it inspects no interfaces, routes or packets. It is tempting because account management is a routine administrative task, and it would be correct where the requirement is provisioning Linux users rather than diagnosing connectivity.

/etc/rc.d/rc.local

Why it fails: This is for executing commands at boot, not primary network config.

/etc/nsswitch.conf

Why it fails: This configures name service switching (hosts, services), not interfaces.

systemctl reload httpd

Why it fails: This command reloads the configuration of a running httpd service without interrupting it. It does not start the service if it is stopped, nor does it enable it for boot. If the service is not running, reload will fail. Thus, it does not meet the requirement of ensuring the service is running and enabled.

systemctl status httpd

Why it fails: This command displays the current status of the httpd service, including whether it is active and enabled. It is purely informational and does not change the state of the service. It does not start or enable the service, so it cannot be used to achieve the required outcome. It is useful for troubleshooting but not for configuration.

systemctl is-enabled httpd

Why it fails: This command checks whether the httpd service is enabled for automatic start at boot, but it does not enable it. It only reports the current enablement status. It is useful for verification but does not achieve the goal of enabling or starting the service. Therefore, it is not one of the required commands.

Add the _netdev mount option to the /etc/fstab entry and rely on the device name /dev/sdc.

Why it fails: _netdev tells the mount system that the filesystem requires network access, which is relevant for NFS and CIFS mounts. It does not make a block device name persistent, nor does it prevent boot failure when a device is missing. iSCSI block devices are handled by the iSCSI initiator and systemd ordering, not by _netdev semantics, so this option leaves the enumeration problem unsolved.

Change the mount point to use the device-mapper path /dev/mapper/sdc1 instead of /dev/sdc.

Why it fails: /dev/mapper entries are created by device-mapper for LVM logical volumes, multipath devices, or dm-crypt mappings, not for plain SCSI disk partitions. A raw iSCSI LUN partition would not appear there unless it was wrapped in LVM or multipath. Even if a mapper name existed, it would not protect against SCSI enumeration reordering, so this does not address the underlying problem.

Create a udev rule that renames the LUN to /dev/sdc every time it is detected.

Why it fails: Forcing a specific kernel name with a udev rule is fragile and generally discouraged. It can conflict with the kernel's own enumeration, race with other devices, and break when hardware or targets change. The supported approach for stable naming is to use the by-uuid or by-path symlinks that udev already maintains, rather than overriding the kernel-assigned name. This option does not provide a robust solution.