How should I use these Operation of Running Systems practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Operation of Running Systems questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Operation of Running Systems domain.

LFCS · topic practice

Operation of Running Systems practice questions

Practise Linux Foundation Certified System Administrator LFCS Operation of Running Systems practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Operation of Running Systems

Practice 10 questions Browse domain →

What the exam tests

What to know about Operation of Running Systems

Operation of Running Systems questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Operation of Running Systems exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Operation of Running Systems questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full Operation of Running Systems explanation →

Which TWO commands can be used to display the current runlevel or target of a systemd-based system?

Trap 1: systemctl get-default

Incorrect because `systemctl get-default` shows the default target for the next boot, not the currently active runlevel or target.

Trap 2: telinit

Incorrect because `telinit` is used to change the runlevel, not display it.

Trap 3: init 3

Incorrect because `init 3` changes the runlevel to 3, not display the current runlevel.

Study all Operation of Running Systems common traps →

A
systemctl get-default
Why wrong: Incorrect because `systemctl get-default` shows the default target for the next boot, not the currently active runlevel or target.
B
telinit
Why wrong: Incorrect because `telinit` is used to change the runlevel, not display it.
C
init 3
Why wrong: Incorrect because `init 3` changes the runlevel to 3, not display the current runlevel.
D
systemctl list-units --type=target
Why wrong: Incorrect because `systemctl list-units --type=target` lists all targets, including inactive ones; it does not directly display the current target without filtering.
E
runlevel
Correct because `runlevel` retrieves the previous and current runlevel from the system, which works on systemd-based systems as well.

Full breakdown with real-world context →

Question 2mediummulti select

Read the full Operation of Running Systems explanation →

Which TWO commands can be used to display the current block devices and their partitions?

Trap 1: df -h

df -h shows mounted filesystems, not block devices or partitions.

Trap 2: blkid

blkid shows block device attributes (UUID, LABEL) but not partitions.

Study all Operation of Running Systems common traps →

A
df -h
Why wrong: df -h shows mounted filesystems, not block devices or partitions.
B
lsblk
lsblk lists block devices and their partitions directly from sysfs.
C
parted -l
parted -l displays partition tables for all block devices.
D
fdisk -l
fdisk -l displays partition tables from the disk.
E
blkid
Why wrong: blkid shows block device attributes (UUID, LABEL) but not partitions.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Operation of Running Systems explanation →

A system administrator needs to ensure that a specific service, 'myapp', starts automatically after a system crash and also restarts if it fails. Which systemd unit directive should be used to achieve this behavior?

Trap 1: RemainAfterExit=yes

RemainAfterExit=yes only keeps the service unit active after the main process exits, but does not restart it.

Trap 2: Restart=always

Restart=always restarts the service regardless of exit status, but it also restarts if the admin stops it manually, which is not desired.

Trap 3: ExecStopPost=/bin/systemctl restart myapp.service

ExecStopPost runs a command after the service stops, but it is not the standard way to handle automatic restart on failure.

Study all Operation of Running Systems common traps →

A
RemainAfterExit=yes
Why wrong: RemainAfterExit=yes only keeps the service unit active after the main process exits, but does not restart it.
B
Restart=always
Why wrong: Restart=always restarts the service regardless of exit status, but it also restarts if the admin stops it manually, which is not desired.
C
Restart=on-failure and WantedBy=multi-user.target
Restart=on-failure restarts the service only if it fails (non-zero exit), and WantedBy=multi-user.target ensures it starts at boot.
D
ExecStopPost=/bin/systemctl restart myapp.service
Why wrong: ExecStopPost runs a command after the service stops, but it is not the standard way to handle automatic restart on failure.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Operation of Running Systems explanation →

A Linux system reports 'Out of memory' errors frequently. The administrator checks memory usage with 'free -m' and notices that most memory is used by file cache. Which command can the administrator run to immediately free up the cache without affecting running processes?

Trap 1: swapoff -a

Incorrect. swapoff -a disables swap space but does not free file cache.

Trap 2: kill -9 $(pidof some_process)

Incorrect. Killing a process is not required and may disrupt services; it does not directly free cache.

Study all Operation of Running Systems common traps →

A
sysctl vm.drop_caches=1
Correct. sysctl vm.drop_caches=1 is a valid command to drop pagecache, functionally equivalent to writing to the proc file.
B
swapoff -a
Why wrong: Incorrect. swapoff -a disables swap space but does not free file cache.
C
echo 1 > /proc/sys/vm/drop_caches
Correct. echo 1 > /proc/sys/vm/drop_caches explicitly frees pagecache, which is the typical method referred to in documentation.
D
kill -9 $(pidof some_process)
Why wrong: Incorrect. Killing a process is not required and may disrupt services; it does not directly free cache.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Operation of Running Systems explanation →

An administrator needs to schedule a cron job that runs a script every day at 3:00 AM, but the system is in a different time zone (UTC) than the administrator's local time (EST). The administrator wants the job to run at 3:00 AM local time regardless of system time zone changes. What is the best approach?

Trap 1: Change the system time zone to EST and set the cron job to run at…

Changing the system time zone affects all applications and may not be desirable.

Trap 2: Set the TZ environment variable in the crontab file before the job…

cron daemon does not evaluate TZ in the crontab file; it uses system time zone.

Trap 3: Calculate the UTC equivalent (8:00 AM UTC) and schedule the job at…

If the system time zone changes, the job will run at the wrong local time.

Study all Operation of Running Systems common traps →

A
Change the system time zone to EST and set the cron job to run at 3:00 AM
Why wrong: Changing the system time zone affects all applications and may not be desirable.
B
Use the CRON_TZ variable in the crontab file to specify EST and schedule at 3:00 AM
CRON_TZ sets the time zone for subsequent cron jobs in the file.
C
Set the TZ environment variable in the crontab file before the job definition
Why wrong: cron daemon does not evaluate TZ in the crontab file; it uses system time zone.
D
Calculate the UTC equivalent (8:00 AM UTC) and schedule the job at that time
Why wrong: If the system time zone changes, the job will run at the wrong local time.

Full breakdown with real-world context →

Question 6hardmulti select

Read the full Operation of Running Systems explanation →

Which THREE steps are necessary to permanently disable a systemd service from starting at boot?

Trap 1: systemctl stop myapp.service

Incorrect. `systemctl stop` stops the service if it's currently running, but it does not affect whether the service starts at boot. It is not a necessary step for permanently disabling the service from booting.

Trap 2: systemctl reset-failed myapp.service

Incorrect. `systemctl reset-failed` resets the 'failed' state of a service, but it does not affect boot enablement.

Trap 3: systemctl daemon-reload

Incorrect. `systemctl daemon-reload` reloads unit files but does not affect the enablement state of a service.

Study all Operation of Running Systems common traps →

A
systemctl stop myapp.service
Why wrong: Incorrect. `systemctl stop` stops the service if it's currently running, but it does not affect whether the service starts at boot. It is not a necessary step for permanently disabling the service from booting.
B
systemctl mask myapp.service
Correct. `systemctl mask` creates a symlink to /dev/null, which makes the service impossible to start, even manually or via dependencies. This prevents the service from starting at boot.
C
systemctl reset-failed myapp.service
Why wrong: Incorrect. `systemctl reset-failed` resets the 'failed' state of a service, but it does not affect boot enablement.
D
systemctl disable myapp.service
Correct. `systemctl disable` removes the enable symlinks that cause the service to start on boot. However, without masking, the service could still be started manually or by dependencies. Therefore, disable alone is not enough; mask is also needed.
E
systemctl daemon-reload
Why wrong: Incorrect. `systemctl daemon-reload` reloads unit files but does not affect the enablement state of a service.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full network assurance explanation →

A system administrator wants to view the last 10 lines of the system log file '/var/log/syslog' and continue to watch for new lines as they are appended. Which command should be used?

Trap 1: tail -n 10 /var/log/syslog

Displays only the last 10 lines once, does not follow.

Trap 2: less /var/log/syslog

Opens file in pager, but does not automatically follow; pressing 'F' would follow.

Trap 3: head -n 10 /var/log/syslog

Displays the first 10 lines, not what is needed.

Study all Operation of Running Systems common traps →

A
tail -n 10 /var/log/syslog
Why wrong: Displays only the last 10 lines once, does not follow.
B
less /var/log/syslog
Why wrong: Opens file in pager, but does not automatically follow; pressing 'F' would follow.
C
tail -n 10 -f /var/log/syslog
Shows last 10 lines and follows new entries.
D
head -n 10 /var/log/syslog
Why wrong: Displays the first 10 lines, not what is needed.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Operation of Running Systems explanation →

A systems administrator receives reports that a web server running Nginx is intermittently unresponsive. The server has 8 GB of RAM and 4 CPU cores. The administrator runs 'free -m' and sees that available memory is low, and 'top' shows that several nginx worker processes are using a high percentage of CPU. Which of the following is the most likely cause of the issue?

Trap 1: The vm.swappiness value is set to 100.

A high swappiness value makes the kernel more aggressive in swapping, but the symptoms of low memory and high CPU are not directly caused by swappiness alone.

Trap 2: The net.core.somaxconn setting is too low.

somaxconn limits the listen backlog, which can cause connection refused under high load, but does not directly cause high memory and CPU usage by workers.

Trap 3: The kernel parameter kernel.pid_max is set too low.

The pid_max parameter limits the number of processes, not memory or CPU usage. A low pid_max could prevent new processes from starting, but the symptoms here are about existing workers consuming resources.

Study all Operation of Running Systems common traps →

A
The nginx worker_connections setting is too high.
High worker_connections can cause each worker to allocate large amounts of memory for connection pools, leading to memory exhaustion and high CPU usage as workers compete for resources.
B
The vm.swappiness value is set to 100.
Why wrong: A high swappiness value makes the kernel more aggressive in swapping, but the symptoms of low memory and high CPU are not directly caused by swappiness alone.
C
The net.core.somaxconn setting is too low.
Why wrong: somaxconn limits the listen backlog, which can cause connection refused under high load, but does not directly cause high memory and CPU usage by workers.
D
The kernel parameter kernel.pid_max is set too low.
Why wrong: The pid_max parameter limits the number of processes, not memory or CPU usage. A low pid_max could prevent new processes from starting, but the symptoms here are about existing workers consuming resources.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Operation of Running Systems explanation →

An administrator is troubleshooting a server that runs a critical application. The server has 16 GB of RAM and 8 CPU cores. The administrator notices that the server becomes very slow during peak hours. Analysis of 'iostat -x 1' shows that the average wait time (await) for the main disk (sda) is consistently above 1000 ms, while the average service time (svctm) is around 5 ms. What is the most likely cause?

Trap 1: The CPU is overloaded, causing processes to wait for CPU time.

CPU overload would show high CPU utilization and possibly high run queue, but the iostat output shows high I/O wait, not CPU wait.

Trap 2: The system is using swap space heavily, causing disk I/O.

Heavy swap usage would cause high disk utilization, but the svctm would likely be higher because swapping involves random I/O, and the await would be high as well. However, the low svctm suggests the disk is serving requests quickly once they start, which is not typical of swap.

Trap 3: The disk is experiencing hardware errors.

Hardware errors typically cause high svctm (due to retries) and may show errors in dmesg, not low svctm with high await.

Study all Operation of Running Systems common traps →

A
The CPU is overloaded, causing processes to wait for CPU time.
Why wrong: CPU overload would show high CPU utilization and possibly high run queue, but the iostat output shows high I/O wait, not CPU wait.
B
The system is using swap space heavily, causing disk I/O.
Why wrong: Heavy swap usage would cause high disk utilization, but the svctm would likely be higher because swapping involves random I/O, and the await would be high as well. However, the low svctm suggests the disk is serving requests quickly once they start, which is not typical of swap.
C
The disk is experiencing hardware errors.
Why wrong: Hardware errors typically cause high svctm (due to retries) and may show errors in dmesg, not low svctm with high await.
D
There is a large queue of I/O requests waiting to be serviced.
A high await with low svctm indicates that the disk is fast but there are many requests queued, so each request spends a long time waiting before being serviced.

Full breakdown with real-world context →

Question 10easymultiple choice

Read the full Operation of Running Systems explanation →

A Linux server experiences a kernel panic during boot. The administrator needs to capture the kernel panic message for debugging. Which of the following methods would allow capturing the panic message?

Trap 1: Add 'quiet' to the kernel boot parameters.

The 'quiet' parameter reduces kernel output, which would hide the panic message, not help capture it.

Trap 2: Configure netconsole to send kernel messages to a remote syslog…

Netconsole can send kernel messages over the network, but it requires network stack to be operational, which may not be available during a panic. Also, it does not prevent the system from rebooting.

Trap 3: Set the kernel parameter 'console=ttyS0' to redirect output to a…

This sets the console device but does not prevent the system from rebooting after a panic. The panic message would still be displayed, but if the system reboots quickly, the message may be lost.

Study all Operation of Running Systems common traps →

A
Add 'quiet' to the kernel boot parameters.
Why wrong: The 'quiet' parameter reduces kernel output, which would hide the panic message, not help capture it.
B
Add 'panic=0' to the kernel boot parameters.
Setting panic=0 tells the kernel to wait indefinitely on a panic, allowing the administrator to read the message on the console.
C
Configure netconsole to send kernel messages to a remote syslog server.
Why wrong: Netconsole can send kernel messages over the network, but it requires network stack to be operational, which may not be available during a panic. Also, it does not prevent the system from rebooting.
D
Set the kernel parameter 'console=ttyS0' to redirect output to a serial console.
Why wrong: This sets the console device but does not prevent the system from rebooting after a panic. The panic message would still be displayed, but if the system reboots quickly, the message may be lost.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full Operation of Running Systems explanation →

A systems administrator is troubleshooting a server that runs a database application. The server has 64 GB of RAM and 16 CPU cores. The administrator notices that the system is using a significant amount of swap space even though there is plenty of free memory. The 'free -m' command shows: total memory = 65536, used = 50000, free = 15536, buffers/cache = 10000, swap total = 8192, swap used = 6000. Which of the following is the most likely cause?

Trap 1: The vm.dirty_ratio and vm.dirty_background_ratio are set too high.

These parameters control how much dirty page cache can accumulate. High values could cause more I/O, but not necessarily swap usage.

Trap 2: The database is configured to use huge pages, which are not…

Huge pages are not swappable, so they would reduce swap usage, not increase it.

Trap 3: The vm.vfs_cache_pressure is set too low.

A low vfs_cache_pressure causes the kernel to retain filesystem cache, which would use memory, not swap. This would decrease swap usage.

Study all Operation of Running Systems common traps →

A
The vm.dirty_ratio and vm.dirty_background_ratio are set too high.
Why wrong: These parameters control how much dirty page cache can accumulate. High values could cause more I/O, but not necessarily swap usage.
B
The vm.swappiness value is set too high.
A high swappiness value (e.g., 100) makes the kernel more likely to swap pages out to disk even when there is free memory available.
C
The database is configured to use huge pages, which are not swappable.
Why wrong: Huge pages are not swappable, so they would reduce swap usage, not increase it.
D
The vm.vfs_cache_pressure is set too low.
Why wrong: A low vfs_cache_pressure causes the kernel to retain filesystem cache, which would use memory, not swap. This would decrease swap usage.

Full breakdown with real-world context →

Question 12hardmulti select

Read the full Operation of Running Systems explanation →

Which TWO of the following are correct statements about systemd journald configuration?

Trap 1: The 'RuntimeMaxUse' directive applies to the journal stored in…

RuntimeMaxUse applies to the runtime journal stored in /run/log/journal, which is volatile. The persistent journal in /var/log/journal is controlled by SystemMaxUse.

Trap 2: The 'Compress' directive is set to 'no' by default.

The default value for Compress is 'yes', meaning journal entries are compressed by default.

Trap 3: The 'ForwardToSyslog' directive is set to 'yes' by default.

The default is 'no' for ForwardToSyslog; journald does not forward messages to syslog by default.

Study all Operation of Running Systems common traps →

A
The 'MaxRetentionSec' directive sets the maximum time to retain journal entries.
MaxRetentionSec specifies the maximum time (in seconds) that journal entries are kept. Older entries are deleted.
B
The 'RuntimeMaxUse' directive applies to the journal stored in /var/log/journal.
Why wrong: RuntimeMaxUse applies to the runtime journal stored in /run/log/journal, which is volatile. The persistent journal in /var/log/journal is controlled by SystemMaxUse.
C
The 'SystemMaxUse' directive in journald.conf limits the maximum disk space used by the journal.
This is correct; SystemMaxUse specifies the maximum amount of disk space the journal may use on persistent storage.
D
The 'Compress' directive is set to 'no' by default.
Why wrong: The default value for Compress is 'yes', meaning journal entries are compressed by default.
E
The 'ForwardToSyslog' directive is set to 'yes' by default.
Why wrong: The default is 'no' for ForwardToSyslog; journald does not forward messages to syslog by default.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full Operation of Running Systems explanation →

You are a systems administrator for a company that runs a high-traffic web application on a Linux server with 32 GB of RAM and 8 CPU cores. The application uses Apache with mod_php and MySQL. Recently, the server has been experiencing intermittent slowdowns, especially during peak hours. Monitoring tools show that the CPU usage spikes to 100% for several minutes and then returns to normal. The 'top' command shows that the 'mysqld' process is often the top CPU consumer during these spikes. You notice that the MySQL slow query log contains many entries with long execution times. The database is heavily used by the web application for read-heavy workloads. After analyzing the situation, you suspect that the issue is related to MySQL configuration. Which of the following actions is most likely to resolve the performance issue?

Trap 1: Increase the maximum number of connections (max_connections) to 500.

Increasing max_connections allows more simultaneous connections, which could increase CPU load, not decrease it.

Trap 2: Enable the MySQL slow query log and analyze the queries.

This is a diagnostic step, not a solution. It can help identify problematic queries, but the question asks for a resolution.

Trap 3: Increase the InnoDB buffer pool size to 20 GB.

While increasing buffer pool can reduce disk reads, the issue is CPU-bound due to repeated execution of the same queries. The buffer pool mainly affects I/O, not CPU.

Study all Operation of Running Systems common traps →

A
Increase the maximum number of connections (max_connections) to 500.
Why wrong: Increasing max_connections allows more simultaneous connections, which could increase CPU load, not decrease it.
B
Enable the MySQL slow query log and analyze the queries.
Why wrong: This is a diagnostic step, not a solution. It can help identify problematic queries, but the question asks for a resolution.
C
Increase the MySQL query cache size (query_cache_size) to 256 MB.
The query cache stores results of SELECT queries, so repeated queries can be served from cache, reducing CPU usage and avoiding execution of the same queries.
D
Increase the InnoDB buffer pool size to 20 GB.
Why wrong: While increasing buffer pool can reduce disk reads, the issue is CPU-bound due to repeated execution of the same queries. The buffer pool mainly affects I/O, not CPU.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full Operation of Running Systems explanation →

You are a systems administrator for a company that runs a web application on a Linux server with 16 GB of RAM and 4 CPU cores. The application uses Apache with mod_php and PostgreSQL. Recently, the server has been experiencing high load average (above 10) and the website is responding slowly. The 'top' command shows that many 'httpd' processes are in 'D' (uninterruptible sleep) state. The 'iostat -x 1' output shows high disk utilization (over 90%) and high average wait times (await > 200 ms) on the disk where PostgreSQL data is stored. The database is write-heavy, and you suspect that disk I/O is the bottleneck. Which of the following actions is most likely to improve the performance?

Trap 1: Enable the PostgreSQL query cache by setting 'query_cache_type' to…

PostgreSQL does not have a built-in query cache like MySQL. The 'query_cache_type' parameter is not valid in PostgreSQL. The correct approach is to use connection pooling or application-level caching.

Trap 2: Increase the PostgreSQL max_connections setting to 200.

Increasing max_connections would allow more concurrent database connections, which could increase the disk I/O load, making the problem worse.

Trap 3: Decrease the Apache MaxClients setting to 50.

This would reduce the number of web server workers, but the bottleneck is at the database disk I/O. While it may reduce the number of concurrent database queries, it does not address the root cause or improve performance significantly.

Study all Operation of Running Systems common traps →

A
Enable the PostgreSQL query cache by setting 'query_cache_type' to 'on'.
Why wrong: PostgreSQL does not have a built-in query cache like MySQL. The 'query_cache_type' parameter is not valid in PostgreSQL. The correct approach is to use connection pooling or application-level caching.
B
Increase the PostgreSQL shared_buffers setting to 4 GB.
Increasing shared_buffers allows PostgreSQL to cache more data in memory, reducing the amount of disk I/O needed. This directly addresses the high disk utilization.
C
Increase the PostgreSQL max_connections setting to 200.
Why wrong: Increasing max_connections would allow more concurrent database connections, which could increase the disk I/O load, making the problem worse.
D
Decrease the Apache MaxClients setting to 50.
Why wrong: This would reduce the number of web server workers, but the bottleneck is at the database disk I/O. While it may reduce the number of concurrent database queries, it does not address the root cause or improve performance significantly.

Full breakdown with real-world context →

Question 15easymultiple choice

Read the full Operation of Running Systems explanation →

A system administrator needs to check the current CPU load and memory usage on a Linux server. Which command should be used to display a dynamic, real-time view of running processes and system resource utilization?

Trap 1: uptime

'uptime' shows system load averages and uptime, but not a detailed process view.

Trap 2: ps aux

'ps aux' provides a snapshot of processes, not a dynamic real-time view.

Trap 3: free -h

'free -h' shows memory usage only, not CPU or process details.

Study all Operation of Running Systems common traps →

A
uptime
Why wrong: 'uptime' shows system load averages and uptime, but not a detailed process view.
B
top
'top' displays a dynamic, real-time view of processes and resource usage.
C
ps aux
Why wrong: 'ps aux' provides a snapshot of processes, not a dynamic real-time view.
D
free -h
Why wrong: 'free -h' shows memory usage only, not CPU or process details.

Full breakdown with real-world context →

Question 16mediummulti select

Read the full Operation of Running Systems explanation →

A Linux administrator is troubleshooting a service that is running as the 'nobody' user but keeps failing because it cannot write to its log file. The log file is located at /var/log/app.log. Which TWO of the following methods will allow the service to write to the log file while maintaining security best practices?

Trap 1: Delete /var/log/app.log and restart the service.

Deleting the log file may cause the service to fail if it expects the file to exist, and does not solve the permission issue.

Trap 2: Change the group of /var/log/app.log to nogroup and set group write…

This would give write access to all members of nogroup, which may be too broad and not precisely target the nobody user.

Trap 3: Change the permissions of /var/log/app.log to 777.

World-writable permissions are a security risk and not a best practice.

Study all Operation of Running Systems common traps →

A
Delete /var/log/app.log and restart the service.
Why wrong: Deleting the log file may cause the service to fail if it expects the file to exist, and does not solve the permission issue.
B
Add an ACL entry for user nobody with write permission using setfacl.
ACLs allow fine-grained permission assignment to a specific user without changing ownership.
C
Change the group of /var/log/app.log to nogroup and set group write permission.
Why wrong: This would give write access to all members of nogroup, which may be too broad and not precisely target the nobody user.
D
Change the permissions of /var/log/app.log to 777.
Why wrong: World-writable permissions are a security risk and not a best practice.
E
Change the owner of /var/log/app.log to nobody using chown.
Changing the owner to the user that runs the service grants write access.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full Operation of Running Systems explanation →

Based on the journalctl output, what is the most likely cause of the service failure?

Exhibit

Refer to the exhibit.

$ sudo journalctl -u myapp.service --since "1 hour ago"
-- Logs begin at Mon 2025-03-10 08:30:15 UTC, end at Mon 2025-03-10 12:45:22 UTC. --
Mar 10 11:30:17 server1 myapp[1234]: Starting application...
Mar 10 11:30:18 server1 myapp[1234]: [ERROR] Failed to bind to port 8080: Address already in use
Mar 10 11:30:18 server1 myapp[1234]: [INFO] Retrying in 5 seconds...
Mar 10 11:30:23 server1 myapp[1234]: [ERROR] Failed to bind to port 8080: Address already in use
Mar 10 11:30:23 server1 myapp[1234]: [INFO] Retrying in 10 seconds...
Mar 10 11:30:33 server1 myapp[1234]: [ERROR] Failed to bind to port 8080: Address already in use
Mar 10 11:30:33 server1 myapp[1234]: [FATAL] Exiting after repeated failures
Mar 10 11:30:33 server1 systemd[1]: myapp.service: main process exited, code=exited, status=1/FAILURE
Mar 10 11:30:33 server1 systemd[1]: myapp.service: Unit entered failed state.

Trap 1: The service configuration file has a syntax error.

The log shows the service starting and then failing on bind, not a config parse error.

Trap 2: The system is out of memory.

There are no out-of-memory messages; the service fails due to port conflict.

Trap 3: The service is trying to write to a read-only filesystem.

No logs indicate filesystem issues; the error is specifically about port binding.

Study all Operation of Running Systems common traps →

A
Another process is already using port 8080.
The repeated 'Address already in use' errors clearly indicate a port conflict.
B
The service configuration file has a syntax error.
Why wrong: The log shows the service starting and then failing on bind, not a config parse error.
C
The system is out of memory.
Why wrong: There are no out-of-memory messages; the service fails due to port conflict.
D
The service is trying to write to a read-only filesystem.
Why wrong: No logs indicate filesystem issues; the error is specifically about port binding.

Full breakdown with real-world context →

Question 18mediumdrag order

Read the full Operation of Running Systems explanation →

Order the steps to set up a LVM logical volume from a new disk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Create volume group (vgcreate), then physical volume (pvcreate),…

This is incorrect because you cannot create a volume group before the physical volume exists. The volume group is a collection of physical volumes, so pvcreate must precede vgcreate.

Trap 2: Create physical volume (pvcreate), then format (mkfs), then volume…

This is incorrect because filesystem formatting should be done on the logical volume, not on the physical volume. Also, the volume group must be created before the logical volume.

Trap 3: Create logical volume (lvcreate), then physical volume (pvcreate),…

This is incorrect because the logical volume depends on the volume group, which depends on the physical volume. You cannot create a logical volume without first having a physical volume and a volume group.

Study all Operation of Running Systems common traps →

A
Create physical volume (pvcreate), then volume group (vgcreate), then logical volume (lvcreate), then format with filesystem (mkfs), then mount.
This is the correct order because LVM requires initializing the disk as a physical volume first, then adding it to a volume group, then creating a logical volume from that group, then formatting it with a filesystem, and finally mounting it for use.
B
Create volume group (vgcreate), then physical volume (pvcreate), then logical volume (lvcreate), then format, then mount.
Why wrong: This is incorrect because you cannot create a volume group before the physical volume exists. The volume group is a collection of physical volumes, so pvcreate must precede vgcreate.
C
Create physical volume (pvcreate), then format (mkfs), then volume group (vgcreate), then logical volume (lvcreate), then mount.
Why wrong: This is incorrect because filesystem formatting should be done on the logical volume, not on the physical volume. Also, the volume group must be created before the logical volume.
D
Create logical volume (lvcreate), then physical volume (pvcreate), then volume group (vgcreate), then format, then mount.
Why wrong: This is incorrect because the logical volume depends on the volume group, which depends on the physical volume. You cannot create a logical volume without first having a physical volume and a volume group.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full Operation of Running Systems explanation →

Order the steps to recover a forgotten root password on a Linux system using single-user mode.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: 1

This is incorrect because the filesystem is read-only initially; attempting to change the password before remounting read-write will fail due to permission errors.

Trap 2: 1

This is incorrect because rebooting before changing the password leaves you with the forgotten password; you must change the password before rebooting.

Trap 3: 1

This is incorrect because you cannot change the root password without first booting into single-user mode to gain root access.

Study all Operation of Running Systems common traps →

A
1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Change root password, 4. Reboot.
This is correct because in single-user mode the filesystem is mounted read-only by default; you must remount it read-write before you can change the password, then reboot to apply changes.
B
1. Boot into single-user mode, 2. Change root password, 3. Remount filesystem as read-write, 4. Reboot.
Why wrong: This is incorrect because the filesystem is read-only initially; attempting to change the password before remounting read-write will fail due to permission errors.
C
1. Boot into single-user mode, 2. Remount filesystem as read-write, 3. Reboot, 4. Change root password.
Why wrong: This is incorrect because rebooting before changing the password leaves you with the forgotten password; you must change the password before rebooting.
D
1. Change root password, 2. Boot into single-user mode, 3. Remount filesystem as read-write, 4. Reboot.
Why wrong: This is incorrect because you cannot change the root password without first booting into single-user mode to gain root access.

Full breakdown with real-world context →

Question 20mediummatching

Read the full Operation of Running Systems explanation →

Match each file system type to its typical use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

General-purpose Linux file system

High-performance for large files

Copy-on-write with snapshots

Virtual memory paging

Temporary file system in RAM

Trap 1: ext4: High-performance file system suitable for large files and…

Incorrect — this definition describes XFS, not ext4.

Trap 2: XFS: Modern file system with snapshot and compression capabilities,…

Incorrect — this definition describes Btrfs, not XFS.

Study all Operation of Running Systems common traps →

A
ext4: General-purpose file system for Linux distributions, widely used on desktops and servers.
ext4 is the default file system for many Linux distributions, suitable for general use.
B
XFS: High-performance file system suitable for large files and parallel I/O, often used in enterprise storage.
XFS excels in handling large files and concurrent operations, making it ideal for servers.
C
Btrfs: Modern file system with snapshot and compression capabilities, designed for scalability and fault tolerance.
Btrfs supports advanced features like snapshots, compression, and self-healing.
D
ext4: High-performance file system suitable for large files and parallel I/O, often used in enterprise storage.
Why wrong: Incorrect — this definition describes XFS, not ext4.
E
XFS: Modern file system with snapshot and compression capabilities, designed for scalability and fault tolerance.
Why wrong: Incorrect — this definition describes Btrfs, not XFS.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Operation of Running Systems sessions

Start a Operation of Running Systems only practice session

Every question in these sessions is drawn from the Operation of Running Systems domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Operation of Running Systems questions →Mixed LFCS session

Frequently asked questions

What does the LFCS exam test about Operation of Running Systems?: Operation of Running Systems questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Operation of Running Systems questions in a focused session?: Yes — the session launcher on this page draws every question from the Operation of Running Systems domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other LFCS topics?: Use the topic links above to move to related areas, or go back to the LFCS question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the LFCS exam covers. They are not copied from any real exam or dump site.

Operation of Running Systems only

10 questions 20 questions 30 questions 50 questions

Mixed LFCS session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All LFCS questions Operation of Running Systems domain overview LFCS exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Operation of Running Systems practice questions

What to know about Operation of Running Systems

Common Operation of Running Systems exam traps

Operation of Running Systems questions

Which TWO commands can be used to display the current runlevel or target of a systemd-based system?

Which TWO commands can be used to display the current block devices and their partitions?

A system administrator needs to ensure that a specific service, 'myapp', starts automatically after a system crash and also restarts if it fails. Which systemd unit directive should be used to achieve this behavior?

A Linux system reports 'Out of memory' errors frequently. The administrator checks memory usage with 'free -m' and notices that most memory is used by file cache. Which command can the administrator run to immediately free up the cache without affecting running processes?

Which THREE steps are necessary to permanently disable a systemd service from starting at boot?

A system administrator wants to view the last 10 lines of the system log file '/var/log/syslog' and continue to watch for new lines as they are appended. Which command should be used?

A Linux server experiences a kernel panic during boot. The administrator needs to capture the kernel panic message for debugging. Which of the following methods would allow capturing the panic message?

Which TWO of the following are correct statements about systemd journald configuration?

A system administrator needs to check the current CPU load and memory usage on a Linux server. Which command should be used to display a dynamic, real-time view of running processes and system resource utilization?

Based on the journalctl output, what is the most likely cause of the service failure?

Exhibit

Order the steps to set up a LVM logical volume from a new disk.

Order the steps to recover a forgotten root password on a Linux system using single-user mode.

Match each file system type to its typical use case.

Track your progress over time

Start a Operation of Running Systems only practice session

Related LFCS topic practice pages

User and Group Management practice questions