Scenario practice questions

While troubleshooting a script, you run `grep -n 'error' /var/log/app.log` and see output lines prefixed with numbers. A colleague asks what those numbers represent. What do they indicate?

Trap 1: The total count of matching lines found in the file.

A total count would be a single number, not a prefix on every matching line. The option that produces a count is -c, which prints only the number of matching lines. Here, each matching line has its own distinct number, so these are positions, not a total count.

Trap 2: The process ID of the application that wrote each log entry.

grep does not inspect or report process IDs from file content. Those would only appear if the application itself wrote them into the log. The -n flag is a grep output formatting option that adds line numbers to matches, independent of who produced the file.

Trap 3: The byte offset from the start of the file to each match.

Byte offsets are not shown by -n; that is the behavior of the -b option, which prefixes each match with its byte offset. The numbers here increment by one per line, consistent with line numbers, not byte positions which would jump by varying amounts based on line length.

A
The total count of matching lines found in the file.
Why it fails: A total count would be a single number, not a prefix on every matching line. The option that produces a count is -c, which prints only the number of matching lines. Here, each matching line has its own distinct number, so these are positions, not a total count.
B
The line number in the file where each matching line occurs.
The -n option to grep prefixes each matching line with its 1-based line number within the input file. This is useful for locating matches in large files or when you need to reference a specific line later. In this scenario, the numbers identify where in /var/log/app.log each 'error' match appears.
C
The process ID of the application that wrote each log entry.
Why it fails: grep does not inspect or report process IDs from file content. Those would only appear if the application itself wrote them into the log. The -n flag is a grep output formatting option that adds line numbers to matches, independent of who produced the file.
D
The byte offset from the start of the file to each match.
Why it fails: Byte offsets are not shown by -n; that is the behavior of the -b option, which prefixes each match with its byte offset. The numbers here increment by one per line, consistent with line numbers, not byte positions which would jump by varying amounts based on line length.

Question 2mediummultiple choice

A startup company is deciding between a Community-driven distribution and an Enterprise distribution. Which scenario best justifies choosing an Enterprise distribution?

Trap 1: The development team wants zero cost for the distribution and…

Zero cost is the defining advantage of a Community distribution, so it argues against Enterprise, which carries subscription fees. It is tempting because free licensing appeals to cash-strapped startups, and would be correct when budget is the deciding factor and paid support is unnecessary.

Trap 2: The company wants to actively contribute to the kernel source code…

Contributing kernel source code directly is an open-source community activity, not an Enterprise distribution benefit; Enterprise offerings focus on certified packages and vendor support. It tempts because Enterprise vendors do employ kernel developers, but that is not the customer's scenario.

Trap 3: The project requires the absolute latest software features released…

Enterprise distributions prioritise stability and backported fixes over bleeding-edge packages, so daily-released features contradict their release model. It is tempting because new software sounds advantageous, and would be correct for a rolling Community distribution such as Arch or Fedora Rawhide.

A
The development team wants zero cost for the distribution and documentation.
Why it fails: Zero cost is the defining advantage of a Community distribution, so it argues against Enterprise, which carries subscription fees. It is tempting because free licensing appeals to cash-strapped startups, and would be correct when budget is the deciding factor and paid support is unnecessary.
B
The company needs long-term stability and guaranteed vendor support for critical infrastructure.
Enterprise distributions supply extended maintenance, certified packages, and vendor-backed support contracts, which critical infrastructure demands. Community distributions lack guaranteed support lifecycles, so the need for long-term stability and accountable vendor assistance justifies the Enterprise choice.
C
The company wants to actively contribute to the kernel source code directly.
Why it fails: Contributing kernel source code directly is an open-source community activity, not an Enterprise distribution benefit; Enterprise offerings focus on certified packages and vendor support. It tempts because Enterprise vendors do employ kernel developers, but that is not the customer's scenario.
D
The project requires the absolute latest software features released daily.
Why it fails: Enterprise distributions prioritise stability and backported fixes over bleeding-edge packages, so daily-released features contradict their release model. It is tempting because new software sounds advantageous, and would be correct for a rolling Community distribution such as Arch or Fedora Rawhide.

Question 3hardmultiple choice

A user complains they cannot read a file. The file has permissions 640 and is owned by root, but the user is in the group that owns the file. Why can't they read it?

Trap 1: The umask is set to 077.

umask governs permissions assigned to newly created files; it does not alter the mode of an existing file, so it cannot explain why 640 fails. It tempts because umask is commonly blamed for permission problems, and would be correct if the file had just been created with unexpectedly restrictive permissions.

Trap 2: The user is not the owner.

Ownership is irrelevant here: group members access the file through the group read bit, which 640 already grants. It tempts because root ownership looks suspicious, and would be correct only if the user belonged to no group matching the file's group owner.

Trap 3: The file is locked by root.

Group ownership grants read access via the group-read bit, so 640 permits reading; no locking mechanism exists on Linux files that would block this. File locks (flock, fcntl) are advisory or process-scoped, not ownership-based, so root locking is not the cause. The real issue lies elsewhere, such as the user not actually being in the owning group.

A
The umask is set to 077.
Why it fails: umask governs permissions assigned to newly created files; it does not alter the mode of an existing file, so it cannot explain why 640 fails. It tempts because umask is commonly blamed for permission problems, and would be correct if the file had just been created with unexpectedly restrictive permissions.
B
The user lacks execute permission on a parent directory.
Reading a file requires execute (search) permission on every parent directory in its path. Without execute permission on a parent directory, the user cannot traverse into it to reach the file, so read access on the file itself is irrelevant.
C
The user is not the owner.
Why it fails: Ownership is irrelevant here: group members access the file through the group read bit, which 640 already grants. It tempts because root ownership looks suspicious, and would be correct only if the user belonged to no group matching the file's group owner.
D
The file is locked by root.
Why it fails: Group ownership grants read access via the group-read bit, so 640 permits reading; no locking mechanism exists on Linux files that would block this. File locks (flock, fcntl) are advisory or process-scoped, not ownership-based, so root locking is not the cause. The real issue lies elsewhere, such as the user not actually being in the owning group.

Question 4mediummultiple choice

A user wants to find all files under /home that are larger than 100 MB and were modified in the last 7 days. Which command accomplishes this?

Trap 1: find /home -type f -size 100M -mtime 7

Without a + or - prefix, -size 100M matches files exactly 100 MB, not larger. Similarly, -mtime 7 matches files modified exactly 7 days ago (between 7 and 8 days), not within the last 7 days. This misses both the 'larger than' and 'last 7 days' requirements.

Trap 2: find /home -type f -size +100M -mtime +7

Here -mtime +7 selects files older than 7 days, not files modified within the last 7 days. The size condition is correct, but the time condition is inverted. To get recent files, use -mtime -7, which means less than 7 days ago.

Trap 3: find /home -name '*' -size +100M -mtime +7

The -mtime +7 matches files modified more than 7 days ago, which is the opposite of the requirement. The -name '*' matches everything and adds no filtering. Although -size +100M is correct, the time condition excludes recent files, so the result is wrong.

A
find /home -type f -size 100M -mtime 7
Why it fails: Without a + or - prefix, -size 100M matches files exactly 100 MB, not larger. Similarly, -mtime 7 matches files modified exactly 7 days ago (between 7 and 8 days), not within the last 7 days. This misses both the 'larger than' and 'last 7 days' requirements.
B
find /home -type f -size +100M -mtime -7
This find command searches /home, restricts to regular files with -type f, matches files larger than 100 MB with -size +100M, and files modified within the last 7 days with -mtime -7. All conditions are ANDed by default, so it returns exactly the desired files.
C
find /home -type f -size +100M -mtime +7
Why it fails: Here -mtime +7 selects files older than 7 days, not files modified within the last 7 days. The size condition is correct, but the time condition is inverted. To get recent files, use -mtime -7, which means less than 7 days ago.
D
find /home -name '*' -size +100M -mtime +7
Why it fails: The -mtime +7 matches files modified more than 7 days ago, which is the opposite of the requirement. The -name '*' matches everything and adds no filtering. Although -size +100M is correct, the time condition excludes recent files, so the result is wrong.

Question 5mediummultiple choice

A teammate wants to search a large text file for lines containing the word 'error', ignoring case, and display the matching line numbers. Which command accomplishes this?

Trap 1: grep -l error filename.txt

The -l flag lists only the names of files containing a match, not the matching lines themselves. Since a single file is supplied, it would simply print filename.txt if any match exists. No line numbers or matching content appear, so it fails both parts of the requirement about seeing matches with line numbers.

Trap 2: grep -v error filename.txt

The -v flag inverts the match, printing lines that do not contain 'error'. That is the opposite of what was requested, and it also performs a case-sensitive comparison lacking line numbers. A user expecting error lines would instead receive all the unrelated content from the file, which is clearly not the goal here.

Trap 3: grep -c error filename.txt

The -c flag counts matching lines and prints only that total, suppressing the actual matching text and any line numbers. The teammate asked to see the matching lines with their numbers, not just a count. This option answers a different question, making it unsuitable for the stated scenario despite being a valid grep invocation.

A
grep -l error filename.txt
Why it fails: The -l flag lists only the names of files containing a match, not the matching lines themselves. Since a single file is supplied, it would simply print filename.txt if any match exists. No line numbers or matching content appear, so it fails both parts of the requirement about seeing matches with line numbers.
B
grep -v error filename.txt
Why it fails: The -v flag inverts the match, printing lines that do not contain 'error'. That is the opposite of what was requested, and it also performs a case-sensitive comparison lacking line numbers. A user expecting error lines would instead receive all the unrelated content from the file, which is clearly not the goal here.
C
grep -in error filename.txt
The -i flag makes matching case-insensitive, and -n prefixes each matching line with its line number. Combined, they satisfy both requirements in one pass over the file. Without -i, only lowercase occurrences would match; without -n, no line numbers would appear, so both flags are needed together.
D
grep -c error filename.txt
Why it fails: The -c flag counts matching lines and prints only that total, suppressing the actual matching text and any line numbers. The teammate asked to see the matching lines with their numbers, not just a count. This option answers a different question, making it unsuitable for the stated scenario despite being a valid grep invocation.

Question 6easymultiple choice

A technician must create a new local account named 'intern' on a Linux workstation and wants the command to also create the home directory and skeleton files automatically. Which command accomplishes this with a single invocation on a typical distribution?

Trap 1: passwd -m intern

passwd manages passwords for existing accounts and does not create users or home directories. The -m option is not a standard way to make a home directory; it typically relates to password aging or similar functions depending on implementation. No account named intern would be created by this command alone.

Trap 2: usermod -m intern

usermod modifies an existing account; it cannot create a new one. Using it for a username that does not yet exist fails with an error such as 'user intern does not exist'. The -m flag here means move the home directory contents, which is unrelated to provisioning a brand-new account with skeleton files.

Trap 3: groupadd -m intern

groupadd creates groups, not user accounts, and it has no -m option in the standard implementation. Running it would either create a group named intern or reject the flag, leaving no user, no home directory, and no skeleton copy. It is the wrong tool for provisioning a login account.

A
useradd -m intern
The useradd command creates the account, and the -m flag instructs it to create the home directory and populate it from /etc/skel. On most distributions this is the direct, single-command way to add a user with a usable home directory, satisfying the requirement without a separate mkdir or copy step.
B
passwd -m intern
Why it fails: passwd manages passwords for existing accounts and does not create users or home directories. The -m option is not a standard way to make a home directory; it typically relates to password aging or similar functions depending on implementation. No account named intern would be created by this command alone.
C
usermod -m intern
Why it fails: usermod modifies an existing account; it cannot create a new one. Using it for a username that does not yet exist fails with an error such as 'user intern does not exist'. The -m flag here means move the home directory contents, which is unrelated to provisioning a brand-new account with skeleton files.
D
groupadd -m intern
Why it fails: groupadd creates groups, not user accounts, and it has no -m option in the standard implementation. Running it would either create a group named intern or reject the flag, leaving no user, no home directory, and no skeleton copy. It is the wrong tool for provisioning a login account.

Question 7mediummultiple choice

A small design studio wants to install a Linux distribution on its workstations. The staff have no Linux experience, and the studio wants a distribution that includes a graphical installer, a curated set of desktop applications, and a community forum where beginners can ask questions. Which type of distribution best fits this scenario?

Trap 1: A source-based distribution such as Gentoo, because compiling…

Source-based distributions like Gentoo require users to compile packages from source, which demands significant Linux knowledge and time. A studio with no Linux experience would struggle with the installation and ongoing maintenance, and there is no curated beginner-friendly desktop experience or large beginner forum comparable to mainstream user-focused distributions.

Trap 2: An enterprise distribution such as Red Hat Enterprise Linux,…

Red Hat Enterprise Linux is optimized for servers and enterprise workloads, and its commercial support model targets organizations with administrators, not design workstations. It does not include the same out-of-the-box desktop application set, and the subscription cost and server focus make it a poor fit for a small studio with no Linux skills.

Trap 3: A minimal server distribution such as Debian netinst, because a…

A minimal netinst installation provides only a base system and requires the user to select and install every desktop component manually. This assumes Linux experience the studio does not have, and it does not deliver a ready-to-use graphical desktop or curated application set that a beginner-friendly distribution would provide.

A
A source-based distribution such as Gentoo, because compiling software from source gives the studio full control over optimization flags.
Why it fails: Source-based distributions like Gentoo require users to compile packages from source, which demands significant Linux knowledge and time. A studio with no Linux experience would struggle with the installation and ongoing maintenance, and there is no curated beginner-friendly desktop experience or large beginner forum comparable to mainstream user-focused distributions.
B
An enterprise distribution such as Red Hat Enterprise Linux, because it is certified for business use and includes commercial support contracts.
Why it fails: Red Hat Enterprise Linux is optimized for servers and enterprise workloads, and its commercial support model targets organizations with administrators, not design workstations. It does not include the same out-of-the-box desktop application set, and the subscription cost and server focus make it a poor fit for a small studio with no Linux skills.
C
A minimal server distribution such as Debian netinst, because a minimal install reduces the attack surface and lets the studio add only what it needs.
Why it fails: A minimal netinst installation provides only a base system and requires the user to select and install every desktop component manually. This assumes Linux experience the studio does not have, and it does not deliver a ready-to-use graphical desktop or curated application set that a beginner-friendly distribution would provide.
D
A beginner-friendly distribution such as Linux Mint, because it offers a graphical installer, preinstalled desktop applications, and active community support.
Linux Mint is designed for users migrating from other operating systems. It ships with a graphical installer, a curated set of desktop applications such as a browser, office suite, and media tools, and has an active community forum where newcomers can get help. This directly satisfies every requirement in the scenario.

Question 8mediummultiple choice

A developer runs `ls -l report.txt` and sees `-rw-r----- 1 alice devs 2048 May 10 09:15 report.txt`. The file must be readable by all members of the `devs` group, but currently only alice can read it. The file's group ownership is already correct. Which command will grant read access to the `devs` group without changing any other permission bits?

Trap 1: chmod +r report.txt

When no category letter is supplied, chmod applies the change to all three categories at once, effectively equivalent to a+r. That would give read access to the owner, the group, and others, exposing the file to every local user. It over-grants permissions far beyond the requirement and is therefore an unsafe choice.

Trap 2: chmod o+r report.txt

The o symbol targets the others category, which covers every user who is neither the owner nor a member of the owning group. This would make the report readable by all accounts on the system, not just the devs team. It also leaves the group permissions unchanged, so the stated requirement would still not be met.

Trap 3: chmod u+r report.txt

The u symbol refers to the file owner, alice, who already possesses read and write access as shown by rw- in the owner triad. Adding another read bit changes nothing functionally and does nothing for the devs group. This command therefore fails to achieve the goal of letting teammates read the file.

A
chmod g+r report.txt
This adds the read bit to the group permission set using symbolic mode. The g selects the group category, +r adds read, and all other bits (owner rw, others none) remain untouched. The file already belongs to the devs group, so group members gain read access exactly as required, and no execute or write permissions are introduced.
B
chmod +r report.txt
Why it fails: When no category letter is supplied, chmod applies the change to all three categories at once, effectively equivalent to a+r. That would give read access to the owner, the group, and others, exposing the file to every local user. It over-grants permissions far beyond the requirement and is therefore an unsafe choice.
C
chmod o+r report.txt
Why it fails: The o symbol targets the others category, which covers every user who is neither the owner nor a member of the owning group. This would make the report readable by all accounts on the system, not just the devs team. It also leaves the group permissions unchanged, so the stated requirement would still not be met.
D
chmod u+r report.txt
Why it fails: The u symbol refers to the file owner, alice, who already possesses read and write access as shown by rw- in the owner triad. Adding another read bit changes nothing functionally and does nothing for the devs group. This command therefore fails to achieve the goal of letting teammates read the file.

Question 9hardmultiple choice

A security auditor wants to give a contractor temporary read-only access to a single log file /var/log/app/audit.log without adding the contractor to any group and without granting access to the rest of the directory. Which approach best matches least-privilege practice?

Trap 1: Change the file's group to a new group containing only the…

This grants the contractor read access, but it requires creating a group and changing the file's group ownership, which affects every member of that group and alters the file's existing ownership model. It is broader than necessary and does not restrict access to the one named user, so it is not the minimal change.

Trap 2: Set the file mode to 644 so any user on the system can read it.

Mode 644 makes the log world-readable, granting read access to all users rather than the single contractor. That violates least privilege because it exposes potentially sensitive audit data to every account on the host. The requirement is one specific user, which the others category cannot express.

Trap 3: Run chmod o+r /var/log/app and rely on directory execute permission…

Adding read permission to a directory lets users list its entries, which is a broader change than intended, and it does not target the contractor. Directory permissions control traversal and listing, not who may read a file's contents. This approach both over-grants and fails to scope access to the named user.

A
Use setfacl to add a read ACL entry for the contractor on the file only.
POSIX ACLs let you grant permissions to a named user on one file, independent of the traditional owner/group/others triads. A read ACL entry for the contractor gives exactly the required access to the single log while leaving the directory and other files untouched, which is the least-privilege outcome. It also avoids changing group membership.
B
Change the file's group to a new group containing only the contractor and set the mode to 640.
Why it fails: This grants the contractor read access, but it requires creating a group and changing the file's group ownership, which affects every member of that group and alters the file's existing ownership model. It is broader than necessary and does not restrict access to the one named user, so it is not the minimal change.
C
Set the file mode to 644 so any user on the system can read it.
Why it fails: Mode 644 makes the log world-readable, granting read access to all users rather than the single contractor. That violates least privilege because it exposes potentially sensitive audit data to every account on the host. The requirement is one specific user, which the others category cannot express.
D
Run chmod o+r /var/log/app and rely on directory execute permission to limit access.
Why it fails: Adding read permission to a directory lets users list its entries, which is a broader change than intended, and it does not target the contractor. Directory permissions control traversal and listing, not who may read a file's contents. This approach both over-grants and fails to scope access to the named user.