Essential Commands practice questions

An administrator wants to ensure that a background process continues running after logout. Which command should be used to start the process?

Trap 1: runproc sleep 100 &

runproc is not a standard Linux command, so this fails immediately. The scenario requires detaching the process from the controlling terminal, which nohup or setsid achieves; runproc resembles nohup superficially but provides no such mechanism on any standard distribution.

Trap 2: sleep 100 &

Runs in background but will be terminated on logout.

Trap 3: sleep 100 & disown

Does remove job from shell's job control, but SIGHUP may still be sent if not handled; nohup is preferred.

A
nohup sleep 100 &
nohup detaches the process from the controlling terminal and ignores SIGHUP, so the sleep command survives logout, while the trailing '&' backgrounds it. This satisfies the requirement that the process continue running after the session ends.
B
runproc sleep 100 &
Why it fails: runproc is not a standard Linux command, so this fails immediately. The scenario requires detaching the process from the controlling terminal, which nohup or setsid achieves; runproc resembles nohup superficially but provides no such mechanism on any standard distribution.
C
sleep 100 &
Why it fails: Runs in background but will be terminated on logout.
D
sleep 100 & disown
Why it fails: Does remove job from shell's job control, but SIGHUP may still be sent if not handled; nohup is preferred.

Question 2mediummultiple choice

A technician needs to display the contents of a compressed file named archive.tar.gz without extracting it. Which command should be used?

Trap 1: tar -tf archive.tar

Used for uncompressed tar files.

Trap 2: tar -xzf archive.tar.gz

Extracts files, does not just list.

Trap 3: zcat archive.tar.gz

Only decompresses, does not list tar contents.

A
tar -tf archive.tar
Why it fails: Used for uncompressed tar files.
B
tar -xzf archive.tar.gz
Why it fails: Extracts files, does not just list.
C
zcat archive.tar.gz | tar -t
Decompresses and pipes to tar -t to list contents.
D
zcat archive.tar.gz
Why it fails: Only decompresses, does not list tar contents.

Question 3hardmulti select

Which TWO commands can be used to create a new empty file?

Trap 1: mkdir file

Creates a directory, not a file.

Trap 2: cat file

Concatenates file content, does not create.

Trap 3: echo 'text' > file

Creates a file with content, not empty.

A
touch file
Creates an empty file if it does not exist.
B
mkdir file
Why it fails: Creates a directory, not a file.
C
cat file
Why it fails: Concatenates file content, does not create.
D
> file
Shell redirection creates an empty file.
E
echo 'text' > file
Why it fails: Creates a file with content, not empty.

Question 4mediummultiple choice

A developer accidentally deleted a critical file /var/log/app.log. The system administrator knows that the file was recently backed up using a cron job that runs 'tar -czf /backup/logs.tar.gz /var/log/'. Which command should the administrator use to restore the file from the backup without extracting the entire archive?

Trap 1: tar -xf /backup/logs.tar.gz var/log/app.log

Extracts only the specified file, but fails to decompress the gzip archive because the -z flag is omitted, so it will likely produce an error or extract corrupted data.

Trap 2: tar -tf /backup/logs.tar.gz | grep app.log

Lists the contents of the archive and filters for app.log, but does not extract any file.

Trap 3: cp /backup/logs.tar.gz:/var/log/app.log /var/log/app.log

Uses an invalid syntax for cp; it cannot directly reference files inside a tar archive.

A
tar -xf /backup/logs.tar.gz var/log/app.log
Why it fails: Extracts only the specified file, but fails to decompress the gzip archive because the -z flag is omitted, so it will likely produce an error or extract corrupted data.
B
tar -tf /backup/logs.tar.gz | grep app.log
Why it fails: Lists the contents of the archive and filters for app.log, but does not extract any file.
C
tar -xzf /backup/logs.tar.gz --to-stdout var/log/app.log > /var/log/app.log
Ly uses tar -xzf with --to-stdout to decompress and extract only the specified file, then redirects the content to restore the file without extracting the entire archive.
D
cp /backup/logs.tar.gz:/var/log/app.log /var/log/app.log
Why it fails: Uses an invalid syntax for cp; it cannot directly reference files inside a tar archive.

Question 5hardmultiple choice

A system administrator needs to find all files in /home that are owned by user 'alice' and have been modified in the last 7 days. The administrator then wants to compress those files into a single archive named alice_recent.tar.gz. Which of the following commands accomplishes this?

Trap 1: find /home -user alice -mtime -7 -exec tar -rf alice_recent.tar.gz…

Uses `tar -rf` which appends files to a tar archive but does not compress them. The resulting file is a plain tar archive, not a .tar.gz compressed file, so it does not meet the requirement for compression.

Trap 2: find /home -user alice -mtime -7 -print | cpio -o >…

Pipes `find` output to `cpio -o`, which creates a cpio archive, not a tar archive. The output is then redirected to a file named .tar.gz, but the content is not gzip compressed, resulting in an incorrect format.

Trap 3: find /home -user alice -mtime -7 | tar -cvf alice_recent.tar.gz

Pipes `find` output directly to `tar -cvf`, but `tar` expects a list of files on the command line, not via stdin. This command will fail to create the archive because `tar -cvf` does not read file names from stdin.

A
find /home -user alice -mtime -7 -exec tar -rf alice_recent.tar.gz {} +
Why it fails: Uses `tar -rf` which appends files to a tar archive but does not compress them. The resulting file is a plain tar archive, not a .tar.gz compressed file, so it does not meet the requirement for compression.
B
find /home -user alice -mtime -7 -print | cpio -o > alice_recent.tar.gz
Why it fails: Pipes `find` output to `cpio -o`, which creates a cpio archive, not a tar archive. The output is then redirected to a file named .tar.gz, but the content is not gzip compressed, resulting in an incorrect format.
C
tar -czf alice_recent.tar.gz -T <(find /home -user alice -mtime -7)
Process substitution feeds find's output as a file list to tar via -T, so only matching files are archived. The -czf flags create a gzip-compressed tar, satisfying both the ownership, mtime and archive-name constraints in one command.
D
find /home -user alice -mtime -7 | tar -cvf alice_recent.tar.gz
Why it fails: Pipes `find` output directly to `tar -cvf`, but `tar` expects a list of files on the command line, not via stdin. This command will fail to create the archive because `tar -cvf` does not read file names from stdin.

Question 6mediummultiple choice

A system administrator is troubleshooting a user's report that a command 'myapp' is not found. The administrator checks the PATH variable and sees it includes /usr/local/bin. The administrator verifies that the binary 'myapp' exists in /usr/local/bin with permissions 755. However, running 'myapp' still fails with 'command not found'. What is the most likely cause?

Trap 1: The user's PATH does not include /usr/local/bin

The administrator checked the PATH and it includes the directory, but this is the administrator's PATH, not the user's. However, the question implies the administrator is testing as the user or the user's environment is similar.

Trap 2: The binary is a shell script missing a shebang

If it's a binary, no shebang needed. If it's a script, missing shebang would cause different error.

Trap 3: The binary does not have execute permission for the user

Permissions are 755, so execute is allowed.

A
The user's PATH does not include /usr/local/bin
Why it fails: The administrator checked the PATH and it includes the directory, but this is the administrator's PATH, not the user's. However, the question implies the administrator is testing as the user or the user's environment is similar.
B
The binary is a shell script missing a shebang
Why it fails: If it's a binary, no shebang needed. If it's a script, missing shebang would cause different error.
C
The shell's hash table is stale; run 'hash -r'
Correct: the shell caches command locations, and may not have updated after the binary was added.
D
The binary does not have execute permission for the user
Why it fails: Permissions are 755, so execute is allowed.

Question 7mediummultiple choice

A user with uid 1000 tries to read /etc/shadow and gets 'Permission denied'. The user is not in the shadow group. Which of the following actions would allow the user to read the file without changing the file's group or permissions?

Exhibit

Refer to the exhibit.

$ ls -l /etc/shadow
-rw-r----- 1 root shadow 1234 Jan 15 10:00 /etc/shadow
$ id
uid=1000(user1) gid=1000(user1) groups=1000(user1)
$ cat /etc/shadow
cat: /etc/shadow: Permission denied

Trap 1: Set an ACL using setfacl to grant user1 read access

This would work but is not listed as an option; also it changes the file's ACL, which is not 'without changing file's group or permissions'.

Trap 2: Use chmod o+r /etc/shadow as root

This changes permissions, which is not allowed per the question.

Trap 3: Change the file owner to user1 using chown

Only root can change ownership.

A
Set an ACL using setfacl to grant user1 read access
Why it fails: This would work but is not listed as an option; also it changes the file's ACL, which is not 'without changing file's group or permissions'.
B
Use chmod o+r /etc/shadow as root
Why it fails: This changes permissions, which is not allowed per the question.
C
Add user1 to the shadow group using usermod -aG shadow user1
Correct: adding to shadow group gives read access via group permission.
D
Change the file owner to user1 using chown
Why it fails: Only root can change ownership.

Question 8hardmultiple choice

A system administrator runs 'grep -r 'error' /var/log' and gets many false positives. They want to search only for the exact word 'error' as a whole word, case-insensitively, and display line numbers. Which command should they use?

Trap 1: grep -rwi 'error' /var/log

Missing -n for line numbers.

Trap 2: grep -rin 'error' /var/log

The -n flag adds line numbers but omits -w, so 'error' still matches inside words such as 'errors' or 'terrorist'. It is tempting because -i handles case-insensitivity and -n handles numbering, but that scenario also demands whole-word matching, which only -w provides.

Trap 3: grep -rwn 'error' /var/log

The -w and -n flags give whole-word matching with line numbers, but -i is absent, so 'Error' and 'ERROR' are missed. It is tempting because -w and -n handle the false positives and numbering, but that scenario also requires case-insensitive matching, which only -i provides.

A
grep -rwi 'error' /var/log
Why it fails: Missing -n for line numbers.
B
grep -rin 'error' /var/log
Why it fails: The -n flag adds line numbers but omits -w, so 'error' still matches inside words such as 'errors' or 'terrorist'. It is tempting because -i handles case-insensitivity and -n handles numbering, but that scenario also demands whole-word matching, which only -w provides.
C
grep -rwn 'error' /var/log
Why it fails: The -w and -n flags give whole-word matching with line numbers, but -i is absent, so 'Error' and 'ERROR' are missed. It is tempting because -w and -n handle the false positives and numbering, but that scenario also requires case-insensitive matching, which only -i provides.
D
grep -rwin 'error' /var/log
The -w flag restricts matching to whole words, eliminating substrings such as 'errors'; -i adds case-insensitivity and -n prefixes each match with its line number. Combined with -r for recursive search, this satisfies all three stated requirements in one command.

Question 9mediumdrag order

Order the steps to mount an ext4 filesystem from an external USB drive automatically at boot.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Plug in the USB drive, create the mount point, add an entry to…

This is incorrect because using a device name like /dev/sdb1 is not persistent; the drive may get a different name on reboot, causing mount failure. Also, rebooting without testing risks a boot hang if the fstab entry is invalid.

Trap 2: Run mount -a first, then edit /etc/fstab to add the entry using…

This is incorrect because mount -a will fail if no mount point exists or the fstab entry is missing. The correct order requires creating the mount point and editing fstab before testing.

Trap 3: Add an entry to /etc/fstab using the device name, manually mount…

This is incorrect because the mount point must exist before mounting. Also, using a device name makes the mount non-persistent, and creating the mount point after mounting is logically impossible.

A
Identify the UUID using blkid, create the mount point directory, add an entry to /etc/fstab using the UUID with options defaults and dump/pass values, then run mount -a to test.
This is correct because using a UUID ensures the drive is mounted persistently regardless of device name changes, and testing with mount -a verifies the configuration before a reboot.
B
Plug in the USB drive, create the mount point, add an entry to /etc/fstab using the device name (e.g., /dev/sdb1), then reboot without testing.
Why it fails: This is incorrect because using a device name like /dev/sdb1 is not persistent; the drive may get a different name on reboot, causing mount failure. Also, rebooting without testing risks a boot hang if the fstab entry is invalid.
C
Run mount -a first, then edit /etc/fstab to add the entry using UUID, and finally create the mount point.
Why it fails: This is incorrect because mount -a will fail if no mount point exists or the fstab entry is missing. The correct order requires creating the mount point and editing fstab before testing.
D
Add an entry to /etc/fstab using the device name, manually mount with mount command, then create the mount point after mounting.
Why it fails: This is incorrect because the mount point must exist before mounting. Also, using a device name makes the mount non-persistent, and creating the mount point after mounting is logically impossible.

Question 10mediummultiple choice

A system administrator needs to find all files under /var/log that have been modified within the last 7 days. Which command accomplishes this task?

Trap 1: find /var/log -atime -7

-atime tests access time, which updates on reads, so merely viewing a file would match it despite no modification. It is tempting because time-based find predicates look similar; it would be correct when locating files read recently, such as auditing access to sensitive logs.

Trap 2: find /var/log -ctime -7

-ctime matches inode status-change time, not content modification, so files whose metadata changed but data did not would be wrongly included. It is tempting because ctime is often confused with mtime; it would be correct when auditing permission or ownership changes rather than content edits.

A
find /var/log -atime -7
Why it fails: -atime tests access time, which updates on reads, so merely viewing a file would match it despite no modification. It is tempting because time-based find predicates look similar; it would be correct when locating files read recently, such as auditing access to sensitive logs.
B
find /var/log -mmin -10080
Using -mmin with a negative value selects files modified less than 10080 minutes ago, and 10080 minutes equals exactly 7 days. This satisfies the last-7-days constraint, though -mtime -7 is the more conventional expression of the same window.
C
find /var/log -mtime -7
The `-mtime -7` predicate matches files whose data was modified less than seven days ago, directly satisfying the "within the last 7 days" constraint. `find` recurses through `/var/log` by default, so every file beneath it is evaluated against that modification-time test.
D
find /var/log -ctime -7
Why it fails: -ctime matches inode status-change time, not content modification, so files whose metadata changed but data did not would be wrongly included. It is tempting because ctime is often confused with mtime; it would be correct when auditing permission or ownership changes rather than content edits.

Question 11hardmultiple choice

A system administrator needs to replace all occurrences of 'oldhost' with 'newhost' in /etc/hosts, but only on lines that contain the string 'domain'. Which sed command accomplishes this?

Trap 1: sed 's/oldhost/newhost/g' /etc/hosts | grep domain

Incorrect. Only outputs matching lines without editing the file.

Trap 2: sed -i '/domain/s/oldhost/newhost/' /etc/hosts

Incorrect. Lacks the `g` flag, so only replaces first occurrence per line.

Trap 3: sed -ne '/domain/s/oldhost/newhost/gp' /etc/hosts

The -n flag suppresses automatic printing, and only lines where a substitution occurred are printed via p, so the file is never modified and unmatched lines vanish from output. It suits previewing changes, not in-place editing of /etc/hosts.

A
sed -i '/domain/s/oldhost/newhost/g' /etc/hosts
The address `/domain/` restricts substitution to matching lines, while `s/oldhost/newhost/g` replaces every occurrence on those lines. The `-i` flag edits /etc/hosts in place, satisfying the requirement to change all instances only where 'domain' appears, leaving other lines untouched.
B
sed 's/oldhost/newhost/g' /etc/hosts | grep domain
Why it fails: Incorrect. Only outputs matching lines without editing the file.
C
sed -i '/domain/s/oldhost/newhost/' /etc/hosts
Why it fails: Incorrect. Lacks the `g` flag, so only replaces first occurrence per line.
D
sed -i '/domain/s/oldhost/newhost/g' /etc/hosts
The address `/domain/` restricts substitution to matching lines, satisfying the constraint that only lines containing 'domain' are altered. The `s/oldhost/newhost/g` then replaces every occurrence on those lines, and `-i` edits the file in place. Other options either omit the address or apply the change globally.
E
sed -ne '/domain/s/oldhost/newhost/gp' /etc/hosts
Why it fails: The -n flag suppresses automatic printing, and only lines where a substitution occurred are printed via p, so the file is never modified and unmatched lines vanish from output. It suits previewing changes, not in-place editing of /etc/hosts.

Question 12mediummulti select

Which TWO commands can be used to list the contents of a tar archive without extracting it?

Trap 1: tar --list archive.tar

The --list flag alone lists archive contents, but the stem asks for two commands and this is one valid form; as a single answer it does not satisfy the requirement of two. It is tempting because --list is the canonical, explicit way to inspect a tar archive without extracting.

Trap 2: tar -xjf archive.tar.bz2

The -x flag extracts files rather than listing them, so this command unpacks the archive instead of showing its contents. It is tempting because -j correctly selects bzip2 decompression and -f names the file, which are needed for listing a .tar.bz2 archive.

Trap 3: tar -xvf archive.tar

The -x flag extracts the archive's contents rather than listing them, so this command performs extraction instead of inspection. It is tempting because -v prints filenames as they are processed and -f specifies the archive, both of which appear in genuine listing commands.

A
tar -tvf archive.tar
The `-t` flag lists archive contents, `-v` adds verbose detail (permissions, owner, size), and `-f` specifies the archive file, so nothing is extracted to disk. This satisfies the stem's requirement to inspect a tar archive in place, making it one of the two valid commands.
B
tar -ztvf archive.tar.gz
The `-t` flag lists archive contents without extracting, satisfying the "without extracting" constraint. Combined flags `-z` (gzip decompression), `-v` (verbose listing) and `-f` (specify archive file) let `tar` read the compressed archive and print member names and details to stdout, leaving files untouched on disk.
C
tar --list archive.tar
Why it fails: The --list flag alone lists archive contents, but the stem asks for two commands and this is one valid form; as a single answer it does not satisfy the requirement of two. It is tempting because --list is the canonical, explicit way to inspect a tar archive without extracting.
D
tar -xjf archive.tar.bz2
Why it fails: The -x flag extracts files rather than listing them, so this command unpacks the archive instead of showing its contents. It is tempting because -j correctly selects bzip2 decompression and -f names the file, which are needed for listing a .tar.bz2 archive.
E
tar -xvf archive.tar
Why it fails: The -x flag extracts the archive's contents rather than listing them, so this command performs extraction instead of inspection. It is tempting because -v prints filenames as they are processed and -f specifies the archive, both of which appear in genuine listing commands.

Question 13mediummultiple choice

Refer to the exhibit. The file script.sh has permissions -rwxr-x--- and is owned by root with group 'developers'. A user named 'alice' is a member of the 'developers' group. Which command allows alice to execute the script without changing the file's group ownership?

Exhibit

-rwxr-x---  1 root developers 1234 Feb 20 10:00 script.sh

Trap 1: chmod o+x script.sh

Granting other-execute lets any user run the script, not just developers, so it widens access beyond the group requirement. It is tempting because o+x does enable alice, but the group already carries execute permission, making this an unnecessary exposure of the file to everyone else.

Trap 2: chmod u+x script.sh

The owner (root) already holds execute permission, so u+x changes nothing for alice, who is neither owner nor covered by it. It is tempting as the standard way to make a script runnable, but that applies when the owner lacks execute, not when a group member needs access.

Trap 3: chown alice script.sh

chown transfers ownership to alice, altering the file's owner rather than its group, and requires root privileges. It is tempting because ownership changes do grant access, but the stem forbids changing group ownership and the group already provides execute permission to alice.

A
usermod -aG developers alice
Adding alice to the developers group gives her the group execute permission.
B
chmod o+x script.sh
Why it fails: Granting other-execute lets any user run the script, not just developers, so it widens access beyond the group requirement. It is tempting because o+x does enable alice, but the group already carries execute permission, making this an unnecessary exposure of the file to everyone else.
C
chmod u+x script.sh
Why it fails: The owner (root) already holds execute permission, so u+x changes nothing for alice, who is neither owner nor covered by it. It is tempting as the standard way to make a script runnable, but that applies when the owner lacks execute, not when a group member needs access.
D
chown alice script.sh
Why it fails: chown transfers ownership to alice, altering the file's owner rather than its group, and requires root privileges. It is tempting because ownership changes do grant access, but the stem forbids changing group ownership and the group already provides execute permission to alice.

Question 14easymultiple choice

A system administrator needs to find all files in /var/log that have been modified in the last 24 hours. Which command accomplishes this?

Trap 1: find /var/log -mtime 0

Finds files modified exactly 0 days ago (current day), not within the last 24 hours.

Trap 2: find /var/log -newer /var/log/syslog

-newer compares each file's modification time against syslog's timestamp, not against a fixed 24-hour window, so results depend on when syslog last changed. It is tempting because it does find recently modified files, and it would be correct when comparing against a known reference file.

Trap 3: find /var/log -mtime 1

-mtime 1 matches files modified between 24 and 48 hours ago, excluding anything changed within the last day; the stem needs the last 24 hours. It is tempting because 1 suggests one day, and it would be correct for finding files modified yesterday.

A
find /var/log -mtime 0
Why it fails: Finds files modified exactly 0 days ago (current day), not within the last 24 hours.
B
find /var/log -newer /var/log/syslog
Why it fails: -newer compares each file's modification time against syslog's timestamp, not against a fixed 24-hour window, so results depend on when syslog last changed. It is tempting because it does find recently modified files, and it would be correct when comparing against a known reference file.
C
find /var/log -mtime -1
`-mtime -1` matches files whose data was modified less than 24 hours ago, satisfying the recency constraint. `find` recurses through /var/log by default, so nested log files are included without extra flags. The numeric argument counts 24-hour periods, and the leading minus means "fewer than", giving exactly the required window.
D
find /var/log -mtime 1
Why it fails: -mtime 1 matches files modified between 24 and 48 hours ago, excluding anything changed within the last day; the stem needs the last 24 hours. It is tempting because 1 suggests one day, and it would be correct for finding files modified yesterday.

Question 15hardmultiple choice

An administrator runs 'df -h' and notices that /dev/sda1 is 95% full. The administrator needs to identify the largest files in the filesystem. Which command sequence is most efficient?

Trap 1: find / -type f -size +100M

Finds files larger than 100MB but does not sort or group.

Trap 2: ls -lR / | sort -k5 -rn

Recursive ls prints every directory's contents and metadata, then sorts the whole stream by the fifth field, which is group for directories and size only for regular files, so ordering is unreliable. It would suit a quick listing of one small directory, not ranking files across a full filesystem.

Trap 3: find / -type f -exec du -sh {} \;

Executes du for each file, very slow.

A
find / -type f -size +100M
Why it fails: Finds files larger than 100MB but does not sort or group.
B
ls -lR / | sort -k5 -rn
Why it fails: Recursive ls prints every directory's contents and metadata, then sorts the whole stream by the fifth field, which is group for directories and size only for regular files, so ordering is unreliable. It would suit a quick listing of one small directory, not ranking files across a full filesystem.
C
find / -type f -exec du -sh {} \;
Why it fails: Executes du for each file, very slow.
D
du -sh /* | sort -rh
du -sh /* reports each top-level directory's total size, and sort -rh orders them largest first, quickly revealing where space is consumed. This satisfies the stem's need to identify the largest files efficiently rather than scanning every inode.

Question 16hardmultiple choice

An administrator needs to find the process ID of the cron daemon. Which combination of commands is most effective?

Trap 1: top -p $(pgrep cron)

top is an interactive monitor that refreshes continuously and expects a terminal, so wrapping it around pgrep does not yield a clean PID lookup. It is tempting because top displays PIDs; it would be correct for live CPU and memory monitoring of a known process, not for scripted PID retrieval.

Trap 2: pgrep cron

pgrep cron alone prints matching PIDs, but the question asks for the most effective combination, and pgrep can match unrelated processes whose names contain cron. It is tempting because it is the direct PID-search tool; it would be correct when a simple, unambiguous name match suffices.

Trap 3: ps -C cron -o pid=

The `ps -C cron -o pid=` command is incorrect because `ps -C` filters processes by their *command name*. The `cron` daemon's executable is typically named `crond` (or similar, like `systemd-cron`), not simply `cron`. Consequently, this command would likely fail to identify the daemon's PID. It is tempting as `cron` is the service name, and this syntax would be effective if the daemon's actual command name were precisely `cron`, or for finding processes matching an exact executable name.

A
top -p $(pgrep cron)
Why it fails: top is an interactive monitor that refreshes continuously and expects a terminal, so wrapping it around pgrep does not yield a clean PID lookup. It is tempting because top displays PIDs; it would be correct for live CPU and memory monitoring of a known process, not for scripted PID retrieval.
B
pgrep cron
Why it fails: pgrep cron alone prints matching PIDs, but the question asks for the most effective combination, and pgrep can match unrelated processes whose names contain cron. It is tempting because it is the direct PID-search tool; it would be correct when a simple, unambiguous name match suffices.
C
pidof cron
`pidof cron` queries the kernel directly for the PID of the running process named cron, returning it immediately without parsing text. This satisfies the requirement to find the daemon's process ID efficiently, unlike approaches that filter `ps` output or search `/proc` manually.
D
ps -C cron -o pid=
Why it fails: The `ps -C cron -o pid=` command is incorrect because `ps -C` filters processes by their *command name*. The `cron` daemon's executable is typically named `crond` (or similar, like `systemd-cron`), not simply `cron`. Consequently, this command would likely fail to identify the daemon's PID. It is tempting as `cron` is the service name, and this syntax would be effective if the daemon's actual command name were precisely `cron`, or for finding processes matching an exact executable name.

Question 17hardmulti select

An administrator wants to find all files larger than 100MB in the /home directory. Which two commands or command sequences achieve this? (Choose two.)

Trap 1: find /home -type f -size +100000000c

The `c` suffix counts bytes, so `+100000000c` matches files exceeding 100,000,000 bytes — roughly 95 MiB, not 100 MB. It is tempting because byte-precise sizing is genuinely useful when exact byte thresholds matter, such as matching a quota or API limit expressed in bytes rather than binary mebibytes.

Trap 2: find /home -type f -size +100MB

Incorrect: `MB` is not a valid size suffix; find expects `M` for mebibytes or `k` for kibibytes.

Trap 3: find /home -type f -size 100M

Incorrect: `-size 100M` matches files exactly 100 MB in size, not larger than 100 MB.

A
find /home -type f -size +100M
`find /home -type f -size +100M` satisfies the size constraint directly: `-size +100M` matches files strictly greater than 100 mebibytes, while `-type f` restricts results to regular files, excluding directories and symlinks. Recursing from `/home` by default, it returns exactly the oversized files the administrator seeks.
B
find /home -type f -size +100000000c
Why it fails: The `c` suffix counts bytes, so `+100000000c` matches files exceeding 100,000,000 bytes — roughly 95 MiB, not 100 MB. It is tempting because byte-precise sizing is genuinely useful when exact byte thresholds matter, such as matching a quota or API limit expressed in bytes rather than binary mebibytes.
C
find /home -type f -size +100MB
Why it fails: Incorrect: `MB` is not a valid size suffix; find expects `M` for mebibytes or `k` for kibibytes.
D
find /home -type f -size +102400k
The `-size +102400k` test matches files exceeding 102400 kibibytes, which equals 100 MiB, satisfying the "larger than 100MB" constraint. Combined with `-type f`, it restricts results to regular files under /home, excluding directories and other file types. The `+` prefix correctly means strictly greater than the threshold.
E
find /home -type f -size 100M
Why it fails: Incorrect: `-size 100M` matches files exactly 100 MB in size, not larger than 100 MB.

Question 18mediummultiple choice

Refer to the exhibit.

A user attempts to read /etc/passwd and receives "Permission denied". What is the most likely reason?

Network Topology

Trap 1: The user is not in the root group.

Group membership does not govern reading /etc/passwd, which is world-readable (644) and owned by root:root; the root group grants no special read access here. It is tempting because group ownership appears in ls -l output, but that column is irrelevant when other-read is already set.

Trap 2: The file has the immutable attribute set.

The immutable attribute blocks writing, renaming and deletion, not reading, so it cannot produce "Permission denied" on a read attempt. It is tempting because chattr +i does cause permission-style errors; it would be correct if the user were trying to modify or delete the file.

Trap 3: The user does not have read permission on the file.

The exhibit shows /etc/passwd as world-readable, so the user does hold read permission and this cannot explain the denial. It is tempting because missing read permission is the usual cause of such errors; it would be correct for a file whose mode excluded the user's class.

A
The user is not in the root group.
Why it fails: Group membership does not govern reading /etc/passwd, which is world-readable (644) and owned by root:root; the root group grants no special read access here. It is tempting because group ownership appears in ls -l output, but that column is irrelevant when other-read is already set.
B
The file has the immutable attribute set.
Why it fails: The immutable attribute blocks writing, renaming and deletion, not reading, so it cannot produce "Permission denied" on a read attempt. It is tempting because chattr +i does cause permission-style errors; it would be correct if the user were trying to modify or delete the file.
C
The user does not have read permission on the file.
Why it fails: The exhibit shows /etc/passwd as world-readable, so the user does hold read permission and this cannot explain the denial. It is tempting because missing read permission is the usual cause of such errors; it would be correct for a file whose mode excluded the user's class.
D
The user does not have execute permission on the /etc directory.
Reading /etc/passwd requires execute (search) permission on /etc to traverse into it. Without that x bit on the directory, path resolution fails and the kernel returns Permission denied regardless of the file's own read bits.

Question 19hardmultiple choice

Refer to the exhibit.

A user attempts to create a file in /backup/snapshots/ but receives an error. What is the most likely cause?

Exhibit

/dev/sda1 on / type ext4 (rw,relatime,errors=remount-ro)
/dev/sda2 on /var type ext4 (rw,relatime)
tmpfs on /run type tmpfs (rw,nosuid,nodev)
/dev/sdb1 on /backup type ext4 (ro)

Trap 1: The /backup directory does not exist.

The exhibit shows /backup exists, since the error concerns its snapshots subdirectory, so a missing parent cannot explain it. It is tempting because a nonexistent path does produce 'No such file or directory', and that would be the cause if the whole path were absent.

Trap 2: The user does not have write permission on /backup.

The exhibit shows /backup is world-writable, so write permission there is not the blocker; the failure lies at the snapshots level. It is tempting because lacking write permission on a parent directory does prevent file creation, and that would be the cause with restrictive modes.

Trap 3: The /backup filesystem is full.

The exhibit shows /backup has ample free space, so exhaustion cannot cause the error. It is tempting because a full filesystem does produce write failures, and that would be the cause if df showed the mount at 100% with no free blocks or inodes.

A
The /backup filesystem is mounted read-only.
A read-only mount permits reads but blocks writes with EROFS, so creating a file in /backup/snapshots/ fails regardless of permissions. This satisfies the stem's scenario: the mount option on /backup, not directory ownership, prevents file creation.
B
The /backup directory does not exist.
Why it fails: The exhibit shows /backup exists, since the error concerns its snapshots subdirectory, so a missing parent cannot explain it. It is tempting because a nonexistent path does produce 'No such file or directory', and that would be the cause if the whole path were absent.
C
The user does not have write permission on /backup.
Why it fails: The exhibit shows /backup is world-writable, so write permission there is not the blocker; the failure lies at the snapshots level. It is tempting because lacking write permission on a parent directory does prevent file creation, and that would be the cause with restrictive modes.
D
The /backup filesystem is full.
Why it fails: The exhibit shows /backup has ample free space, so exhaustion cannot cause the error. It is tempting because a full filesystem does produce write failures, and that would be the cause if df showed the mount at 100% with no free blocks or inodes.

Question 20easymultiple choice

Refer to the exhibit.

The /data directory needs to be resized to 15GB. What is the first step?

Exhibit

NAME   MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda      8:0    0    20G  0 disk 
├─sda1   8:1    0   512M  0 part /boot
└─sda2   8:2    0   19.5G 0 part /
sdb      8:16   0    10G  0 disk 
└─sdb1   8:17   0    10G  0 part /data

Trap 1: Resize the partition using fdisk.

fdisk edits the partition table, but the exhibit shows the partition already occupying the disk, so enlarging it requires free space or a larger disk first; fdisk cannot grow a filesystem. It is tempting because fdisk is the classic partitioning tool, and would be correct when creating or deleting partitions on a disk with unallocated space.

Trap 2: Create a new partition and copy data.

Creating a new partition and copying data is a migration approach, not the first step for resizing /data in place; it destroys the existing filesystem layout and requires spare space. It is tempting because copying to a new partition is a valid workaround when a filesystem cannot be grown, but not the initial resize step.

Trap 3: Resize the filesystem using resize2fs.

resize2fs enlarges or shrinks an ext2/3/4 filesystem, but it must run after the underlying block device or logical volume has been expanded; running it first finds no additional space. It is tempting because resize2fs is the actual command that grows the filesystem, and would be correct once the container has been enlarged.

A
Unmount the filesystem.
Unmounting is necessary before any resize operation.
B
Resize the partition using fdisk.
Why it fails: fdisk edits the partition table, but the exhibit shows the partition already occupying the disk, so enlarging it requires free space or a larger disk first; fdisk cannot grow a filesystem. It is tempting because fdisk is the classic partitioning tool, and would be correct when creating or deleting partitions on a disk with unallocated space.
C
Create a new partition and copy data.
Why it fails: Creating a new partition and copying data is a migration approach, not the first step for resizing /data in place; it destroys the existing filesystem layout and requires spare space. It is tempting because copying to a new partition is a valid workaround when a filesystem cannot be grown, but not the initial resize step.
D
Resize the filesystem using resize2fs.
Why it fails: resize2fs enlarges or shrinks an ext2/3/4 filesystem, but it must run after the underlying block device or logical volume has been expanded; running it first finds no additional space. It is tempting because resize2fs is the actual command that grows the filesystem, and would be correct once the container has been enlarged.