The Linux Operating System practice questions

/var/log/dmesg

Why it fails: This log tracks kernel-level boot messages.

/etc/passwd

Why it fails: This file contains user account information.

/proc/partitions

Why it fails: /proc/partitions lists block devices and their sizes, not mount points; /proc/mounts shows which partition is mounted at /. It is tempting because it enumerates partitions, but it carries no mount information, so it cannot reveal the root filesystem.

The RAM is corrupted.

Why it fails: Corrupted RAM causes crashes, kernel panics or data corruption, not a clean inability to write files to a home directory. It tempts because memory faults are hardware-based and can corrupt filesystem operations, but a full or read-only filesystem, quota, or permissions is the actual cause.

The CPU temperature is too high.

Why it fails: High CPU temperature triggers thermal throttling or shutdown, not write failures to a home directory. It tempts because overheating is a hardware fault that degrades system behaviour, yet it cannot selectively block file writes while leaving the disk non-full.

The BIOS settings are incorrect.

Why it fails: BIOS settings govern firmware-level hardware initialisation, not filesystem write permissions, so they cannot block saves to a home directory while the disk has free space. It is tempting because BIOS misconfiguration can disable a disk controller entirely, which would be the cause if the drive were undetected rather than merely unwritable.

/etc/network/interfaces

Why it fails: This configures the network interface, not DNS lookups.

/etc/sysconfig/network

Why it fails: This file is for global networking parameters on some distributions.

/etc/hosts

Why it fails: /etc/hosts is for static local mappings, not dynamic DNS resolution.

/etc/hosts

Why it fails: This maps hostnames to IP addresses.

/etc/sysconfig/network-scripts/ifcfg-eth0

Why it fails: This is the location used on RHEL/CentOS systems.

/etc/resolve.conf

Why it fails: This is for DNS configuration.

fdisk -l

Why it fails: fdisk displays partition tables.

vmstat

Why it fails: vmstat shows virtual memory statistics, but swapon is more direct for swap status.

mount

Why it fails: mount shows mounted filesystems.

reboot

Why it fails: reboot restarts the computer.

exit

Why it fails: exit closes the current shell session.

cat /var/log/auth.log

Why it fails: This log is for authentication messages.

lsmod

Why it fails: lsmod lists currently loaded kernel modules.

modprobe

Why it fails: modprobe is used to load or unload kernel modules.

systemctl reload

Why it fails: This reloads the service, which will fail if the config is invalid.

systemctl status

Why it fails: This only shows the current service state.

service name test

Why it fails: This is not a standard service command.

uname -a

Why it fails: The uname command displays kernel and system information such as the kernel name, version, and architecture. It has no relation to the user's shell. Running uname -a would show details about the Linux kernel, not the shell environment, so it cannot answer the question about the active login shell.

cat /etc/passwd

Why it fails: The /etc/passwd file contains a list of all user accounts and their configured login shells, but it does not show which shell is currently active. The user would have to locate their own entry and interpret the seventh field. This is an indirect method and does not confirm the shell actually running in the current session.

ps -ef | grep bash

Why it fails: This lists running processes and filters for bash, but it does not reliably identify the current user's login shell. Other users or scripts may be running bash, and the login shell could be zsh or sh. The output is noisy and does not directly answer which shell is active for this specific session, making it an unreliable approach.

chmod u=rw,g=r,o= report.txt

Why it fails: The symbolic mode u=rw,g=r,o= sets the owner to read and write, the group to read, and others to no permissions. This actually produces the desired permissions rw-r-----. However, the question asks for the command that will set the permissions to rw-r-----, and both chmod 640 and this symbolic command achieve that. Since only one answer is correct, and the numeric mode is more commonly used and unambiguous, the symbolic mode is considered incorrect in this context due to the presence of a better answer. Additionally, the symbolic mode lacks the explicit removal of execute bits for owner and group, but since they were not set, it still results in rw-r-----. The exam expects the numeric representation.

chmod 644 report.txt

Why it fails: The mode 644 grants read and write to the owner, read to the group, and read to others. This would leave others with read access, which violates the requirement that others have no access. The desired permissions rw-r----- deny all access to others, so 644 is too permissive. It is a common default for files but does not meet the specific security requirement in this scenario.

chmod 604 report.txt

Why it fails: The mode 604 gives the owner read and write, no permissions to the group, and read to others. This is incorrect because the group should have read access, and others should have none. The middle digit 0 removes group permissions, while the last digit 4 grants others read access. This does not match the required rw-r----- pattern, so it fails to set the intended permissions.

df -T

Why it fails: df reports filesystem disk space usage by type; it displays no CPU load or process information, so it cannot satisfy a real-time monitoring requirement. It tempts as a common system-inspection command, but top or htop is the correct tool for live load and process viewing.

ps aux

Why it fails: ps aux prints a one-off snapshot of processes and exits, so it cannot refresh a real-time view of system load. It is tempting because it does list active processes and CPU/memory usage, making it the right tool for capturing a static process listing or piping into a script.

cat /proc/cpuinfo

Why it fails: cat /proc/cpuinfo only dumps static CPU model, core and cache details; it reports no load averages or running processes. It is tempting because /proc is the kernel's live interface, and reading files there is the correct approach when you need hardware inventory rather than activity monitoring.

ifconfig

Why it fails: ifconfig belongs to the deprecated net-tools suite and is absent from many modern distributions; ip addr show is the current tool. It tempts because ifconfig remains familiar and still works where net-tools is installed, but it is not the modern default.

route -n

Why it fails: route -n prints the kernel routing table, showing gateways and destination networks, not interface addresses. It is tempting because it displays network configuration, but it would be the right tool for inspecting or troubleshooting routing paths, not for confirming eth0's assigned IP.

netstat -rn

Why it fails: netstat -rn lists the routing table numerically, so it reveals default gateways and routes rather than eth0's address. It is tempting as a general network-diagnostic command, but it would be correct when you need to inspect routing entries, not when confirming an interface's assigned IP.

uptime

Why it fails: uptime reports how long the system has run and its load averages, not installed memory. It is tempting because it summarises system state at a glance, but it reads /proc/uptime rather than /proc/meminfo. The correct command, free or lshw, queries the memory subsystem directly.

lsblk

Why it fails: lsblk lists block devices and their mount points, not RAM. It is tempting because it reports hardware inventory from the command line, but it reads /sys/block rather than /proc/meminfo. The correct command, free or lshw, queries the memory subsystem directly.

df -h

Why it fails: df -h reports filesystem disk usage and free space, not installed RAM. It is tempting because it displays capacity figures in human-readable units, but it reads mounted filesystems rather than /proc/meminfo. The correct command, free or lshw, queries the memory subsystem directly.

Reinstall the operating system.

Why it fails: Reinstalling the OS destroys data and does not verify kernel detection; the immediate step is inspecting kernel messages, typically via dmesg or /var/log, to confirm whether the device was seen. Reinstalling is tempting as a blanket fix, but it is disproportionate and skips diagnosis entirely.

Run the top command.

Why it fails: The top command reports live CPU, memory and process statistics, not hardware enumeration, so it cannot confirm whether the kernel registered the new disk. It is tempting because top is a familiar diagnostic tool, and it would be the right choice when investigating a runaway process or high load rather than missing storage.

Edit the /etc/fstab file.

Why it fails: Editing /etc/fstab declares mount points and options for filesystems already known to the kernel; it does not trigger device detection, and a missing entry there is not why the disk is unseen. It would be correct when you need a filesystem mounted automatically at boot.

Using a desktop-focused distribution for ease of installation.

Why it fails: Desktop-focused distributions ship short-lived consumer packages, so they cannot deliver the multi-year security maintenance the financial workload requires. They are tempting because installation is straightforward, and they suit workstations where frequent upgrades are acceptable, but server stability demands a long-term support release cycle instead.

Compiling the kernel from source to match the specific hardware.

Why it fails: Compiling the kernel from source yields a bespoke build with no vendor security backports or tested update path, undermining long-term stability. It is tempting because it optimises for specific hardware, and it would be correct for an embedded appliance where hardware support outweighs maintenance guarantees.

Selecting a rolling release distribution for frequent kernel updates.

Why it fails: Rolling releases continuously replace packages, so kernel and library versions shift without a fixed support window, which risks untested changes in a financial production server. They are tempting because updates arrive quickly, and they suit development machines needing current drivers, but long-term stability requires frozen, supported package versions.

ls

Why it fails: ls lists directory contents, not the working directory path itself. It is tempting because it is the standard command for inspecting the filesystem, and it would be the right choice when you need to see the files and subdirectories inside the current location.

dir

Why it fails: dir lists directory contents on Windows and some Unix shells, but does not print the working directory path. It is tempting as the familiar Windows equivalent of ls, and would be correct when enumerating files within a folder rather than identifying your current location.

cd

Why it fails: cd changes the working directory rather than reporting it, so it cannot display the current path. It is tempting because it is the command most associated with directory navigation, and would be correct when you need to move into a different folder before running further commands.

ver

Why it fails: 'ver' is a Windows/DOS command reporting the operating system version, not a Linux utility; on Linux, uname -r prints the running kernel release. It is tempting because the word suggests version reporting, but no such command exists in Linux shells, so it fails the scenario entirely.

hostnamectl

Why it fails: hostnamectl reports the hostname and OS details, including the kernel version, but the question asks for the command whose primary purpose is kernel information; uname -r does this directly. hostnamectl is tempting because its output does list the kernel, yet it is a systemd hostname tool, not the canonical kernel query.

cat /etc/issue

Why it fails: /etc/issue holds a static banner text shown before login prompts; it is not generated from the running kernel and may be stale or empty. It is tempting because it often displays a distribution name, but it reports no kernel version, whereas uname -r queries the live kernel directly.

nmap

Why it fails: nmap scans hosts and ports to discover services and open ports, but it does not reveal the sequence of routers a packet traverses to a destination. It is tempting because it is a standard network reconnaissance tool, and would be correct for port scanning or host discovery on the local network.

ping

Why it fails: Ping only confirms ICMP reachability and round-trip time to the host; it does not reveal the intermediate routers on the path. It is tempting because it is the standard first test of connectivity, and would be correct when you simply need to confirm a remote host is responding, not map the route.

dig

Why it fails: dig queries DNS records, resolving names to addresses or mail and name-server data, and reports nothing about the hop-by-hop route packets traverse. It is tempting because it is a common network diagnostic tool, and would be correct for troubleshooting DNS resolution failures rather than tracing a path.

cron

Why it fails: cron schedules recurring jobs at specified times; it does not query external time servers or discipline the system clock. It is tempting because it runs periodic tasks, but it would be the right choice for automating scripted commands, not for synchronising time to prevent authentication errors.

sshd

Why it fails: sshd accepts incoming SSH connections and provides remote shell access; it neither contacts external time sources nor adjusts the clock. It is tempting because it is a core network daemon, but it would be correct when you need remote login, not time synchronisation.

rsyslogd

Why it fails: rsyslogd collects and forwards system log messages; it has no mechanism to poll external time servers or correct clock drift. It is tempting because it is a long-running system daemon, but it would be the right choice for centralised logging, not for synchronising time.

/etc/log/

Why it fails: /etc holds static configuration files, and /etc/log/ is not a standard directory on Linux systems; general system messages are written to /var/log. /etc would be correct when editing service configuration, not when reviewing hardware error history.

/proc/logs

Why it fails: /proc is a virtual filesystem exposing kernel and process state, not a log store; no general system messages are written there. It would be the right place to read runtime kernel parameters or process information, not to search for hardware error entries.

/tmp/logs

Why it fails: General system messages are written to /var/log, not /tmp/logs, which is a volatile scratch directory cleared on reboot and holds no syslog output. The path is tempting because /tmp exists on every Linux host and looks log-like, but it is intended for temporary application files, never persistent system logging.