Courseiva

Linux Professional Institute Certification Level 1 LPIC-1 (LPIC-1) — Questions 1–75

527 questions total · 8pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 8

Page 2
1
MCQmedium

Refer to the exhibit. How many physical disks are detected by the kernel, and what are their sizes?

A.Two disks: sda 10.0 GiB, sdb 2.00 GiB
B.Two disks: sda 10.7 GB, sdb 2.15 GB
C.Three disks: sda, sdb, and an unknown device
D.One disk: sda 10.7 GB
AnswerA

Correctly matches the output sizes in GiB.

Why this answer

The kernel has detected two physical disks: /dev/sda with a capacity of 10.0 GiB and /dev/sdb with a capacity of 2.00 GiB. This is evident from the output of `fdisk -l`, which lists disk devices and their sizes in gibibytes (GiB), a binary-based unit where 1 GiB = 1024^3 bytes. The kernel enumerates SCSI/SATA disks as /dev/sdX, and the output shows exactly two such devices.

Exam trap

The trap here is that candidates often confuse binary units (GiB) with decimal units (GB) and incorrectly convert the displayed sizes, or they overlook the second disk (sdb) because they focus only on the first line of output.

How to eliminate wrong answers

Option B is wrong because it incorrectly reports sizes in gigabytes (GB, decimal) instead of gibibytes (GiB, binary); the `fdisk -l` output explicitly shows '10.0 GiB' and '2.00 GiB', not '10.7 GB' and '2.15 GB' (which would be the decimal equivalents). Option C is wrong because there is no evidence of a third disk; the output lists only sda and sdb, and any 'unknown device' would still appear as a /dev/sdX entry if detected by the kernel. Option D is wrong because it claims only one disk (sda) exists, ignoring the clearly listed sdb device with its size.

Full explanation →
2
MCQmedium

A senior administrator runs a script that processes a CSV file. The script contains the following snippet: 'for field in $(cat data.csv); do ...'. The data.csv file contains lines like: 'John Doe, 123 Main St, Springfield'. The script fails to process correctly, splitting fields incorrectly and causing errors. Which of the following is the most appropriate fix?

A.Use xargs to process each line
B.Use 'for field in $(<data.csv)' with proper quoting
C.Use 'for field in "$(cat data.csv)"' with double quotes around the substitution
D.Use a while loop with read: 'while IFS= read -r line; do ... done < data.csv'
AnswerD

Reads each line correctly with IFS= to preserve whitespace.

Why this answer

The script fails due to word splitting and globbing when iterating over the output of `cat data.csv` with a `for` loop. Using `while IFS= read -r line` reads each line verbatim, preserving spaces and commas, and is the standard pattern for processing CSV or delimited files line by line in bash.

Exam trap

The trap here is that candidates often think quoting the command substitution or using `xargs` will fix the splitting issue, but they fail to recognize that `for` inherently splits on IFS, whereas `while read` processes one line at a time without word splitting.

How to eliminate wrong answers

Option A is wrong because `xargs` by default splits input on whitespace and newlines, which would still break fields containing spaces like 'John Doe' and does not address the core issue of reading entire lines. Option B is wrong because `$(<data.csv)` is equivalent to `$(cat data.csv)` and still undergoes word splitting and globbing, so fields with spaces or special characters are incorrectly split. Option C is wrong because double quotes around the command substitution `"$(cat data.csv)"` would treat the entire file as a single string, causing the loop to iterate only once over the whole file content, not per line.

Full explanation →
3
MCQmedium

You manage a CentOS 7 server that runs a critical application storing data on an XFS filesystem mounted at /data. The server experiences an unexpected power outage. After rebooting, the application fails to start, and you suspect filesystem corruption. You boot into single-user mode and attempt to mount /data, but the mount fails with an error: 'mount: /dev/sdb1: can't read superblock'. You run 'xfs_repair -n /dev/sdb1' and it reports the log is dirty and must be replayed or the filesystem repaired with the -L option (force log zeroing). You want to recover the filesystem with minimal data loss. Which action should you take?

A.Run 'xfs_repair -L /dev/sdb1' to force log replay and repair.
B.Mount the filesystem with the 'norecovery' option to bypass the log and then attempt to repair.
C.Run 'fsck -y /dev/sdb1' to automatically repair.
D.Run 'xfs_admin -U generate /dev/sdb1' to generate a new UUID and then mount.
AnswerA

-L zeros the log and forces a replay, which is necessary when the log is corrupt.

Why this answer

Xfs_repair -L /dev/sdb1 forces the log to be zeroed (cleared) and then performs a full filesystem check and repair. This is necessary when the log is dirty and cannot be replayed normally due to corruption, such as after an unclean shutdown. The -L option is the standard recovery method for XFS when the log is damaged, and it minimizes data loss by only discarding the log (which contains metadata changes that were not yet written to disk) while preserving the rest of the filesystem data.

Exam trap

The trap here is that candidates familiar with ext4 may instinctively choose fsck (Option C), not realizing that XFS has its own repair tool (xfs_repair) and that fsck is incompatible with XFS filesystems.

How to eliminate wrong answers

Option B is wrong because mounting with 'norecovery' bypasses log replay entirely, leaving the filesystem in an inconsistent state and preventing any repair; it is used for read-only access to salvage data, not for recovery. Option C is wrong because fsck is designed for ext2/ext3/ext4 filesystems, not XFS; running fsck on an XFS filesystem can cause further damage or fail to recognize the filesystem type. Option D is wrong because xfs_admin -U generate changes the UUID of the filesystem, which does not address superblock corruption or dirty log issues; it is used for UUID management, not repair.

Full explanation →
4
MCQmedium

A DHCP server assigns IP addresses to clients, but some clients are not receiving the correct gateway. Which configuration file should be checked on the DHCP server?

A./etc/dhcpd.conf
B./etc/dhcp/dhclient.conf
C./etc/dhcp/dhcpd.conf
D./etc/resolv.conf
AnswerC

Standard configuration file for DHCP server.

Why this answer

The DHCP server configuration file on Linux systems is typically located at /etc/dhcp/dhcpd.conf (or /etc/dhcpd.conf on some older distributions). This file contains the subnet declarations, option definitions (such as option routers for the default gateway), and other parameters that the DHCP server uses to assign IP addresses and configuration details to clients. If clients are not receiving the correct gateway, the 'option routers' directive within this file should be checked and corrected.

Exam trap

The trap here is that candidates often confuse the DHCP server configuration file path with the older /etc/dhcpd.conf (option A) or mistakenly think the client configuration file (option B) controls server-side gateway assignment, when in fact the server's gateway is set via 'option routers' in /etc/dhcp/dhcpd.conf.

How to eliminate wrong answers

Option A is wrong because /etc/dhcpd.conf is an older, deprecated path; modern distributions use /etc/dhcp/dhcpd.conf, and the question expects the current standard location. Option B is wrong because /etc/dhcp/dhclient.conf is the client-side configuration file for the DHCP client (dhclient), not the server; it controls how the client requests and applies DHCP options, not how the server assigns them. Option D is wrong because /etc/resolv.conf is the DNS resolver configuration file, which specifies nameservers and search domains for the local system; it has no role in DHCP server gateway assignment.

Full explanation →
5
MCQmedium

A Linux system has multiple disk partitions. The administrator wants to view the UUID of a specific partition for use in /etc/fstab. Which command will display the UUID?

A.blkid /dev/sda1
B.fdisk -l /dev/sda1
C.lsblk -f
D.cat /proc/partitions
AnswerA

blkid displays UUID and other attributes of the specified device.

Why this answer

The `blkid` command queries the libblkid library to display block device attributes, including the UUID and filesystem type. Running `blkid /dev/sda1` outputs the UUID for that specific partition, which can be directly copied into /etc/fstab for persistent mounting.

Exam trap

The trap here is that candidates may confuse `lsblk -f` (which shows all UUIDs in a tree format) as the command for a specific partition, or think `fdisk -l` displays UUIDs, when in fact `blkid` is the dedicated tool for querying a single partition's UUID.

How to eliminate wrong answers

Option B is wrong because `fdisk -l /dev/sda1` is invalid syntax; `fdisk -l` lists partition tables for a whole disk (e.g., /dev/sda), not a single partition, and it does not display UUIDs. Option C is wrong because `lsblk -f` shows UUIDs for all block devices, not just a specific partition, and the question asks for a command that displays the UUID of a specific partition, making it less direct. Option D is wrong because `cat /proc/partitions` only lists partition major/minor numbers and block counts, not UUIDs or filesystem attributes.

Full explanation →
6
MCQeasy

A small office server running Ubuntu 20.04 experiences a gradual time drift. The system clock loses about 2 minutes per week. The hardware clock (RTC) is maintained by the motherboard battery and appears accurate when checked manually. The sysadmin wants to ensure the system clock stays synchronized automatically. Which single action should be taken? Options: A) Run 'timedatectl set-ntp true' to enable systemd-timesyncd, B) Add 'hwclock --hctosys' to /etc/rc.local, C) Install and configure the ntp package with a pool server, D) Use 'cron' to run ntpdate every minute.

A.Run 'timedatectl set-ntp true' to enable systemd-timesyncd
B.Add 'hwclock --hctosys' to /etc/rc.local
C.Install and configure the ntp package with a pool server
D.Use 'cron' to run ntpdate every minute
AnswerA

On Ubuntu 20.04, systemd-timesyncd is the default NTP client. Running 'timedatectl set-ntp true' activates it, which automatically synchronizes the system clock with NTP servers, correcting the gradual drift without needing additional packages or manual cron jobs. This is the simplest and most appropriate single action for automatic time sync on a modern systemd-based distribution.

Why this answer

On Ubuntu 20.04, systemd-timesyncd is the default NTP client. Running 'timedatectl set-ntp true' (option A) activates it, which automatically synchronizes the system clock with NTP servers, correcting the gradual drift without needing additional packages or manual cron jobs. This is the simplest and most appropriate single action for automatic time sync on a modern systemd-based distribution.

Exam trap

The trap here is that candidates may assume the full ntp package is always required for time synchronization, overlooking that systemd-timesyncd is the default and sufficient for basic NTP sync on modern Ubuntu systems.

How to eliminate wrong answers

Option A is wrong because installing and configuring the full ntp package is overkill for a small office server; systemd-timesyncd is already present and sufficient for basic NTP synchronization. Option B is wrong because adding 'hwclock --hctosys' to /etc/rc.local only sets the system clock from the hardware clock at boot, which does not correct ongoing time drift during operation. Option C is wrong because using cron to run ntpdate every minute is inefficient, can cause abrupt time jumps, and ntpdate is deprecated in favor of more gradual synchronization methods like systemd-timesyncd or ntpd.

Full explanation →
7
MCQhard

A system is experiencing frequent crashes. Investigation shows that the root filesystem is mounted with 'errors=remount-ro'. The admin wants to prevent data loss by mounting with 'errors=panic' in /etc/fstab. Which change is correct?

A.Add 'errors=panic' as an additional option
B.Change the mount point to /panic
C.Use 'defaults,errors=panic'
D.Replace 'errors=remount-ro' with 'errors=panic'
AnswerD

Directly changes the error handling behavior.

Why this answer

The admin wants to change the error behavior from remounting the filesystem read-only to panicking the kernel. In /etc/fstab, each mount option is a comma-separated list; to change the error handling, you must replace the existing 'errors=remount-ro' with 'errors=panic' in the options field. Adding an additional 'errors=panic' would create a conflict (the last one parsed typically wins, but it's ambiguous and not the intended clean configuration).

Exam trap

The trap here is that candidates think they can simply add 'errors=panic' as an extra option (Option A) without removing the existing 'errors=remount-ro', not realizing that duplicate 'errors=' directives create ambiguity and are not the intended way to change the error handling policy.

How to eliminate wrong answers

Option A is wrong because adding 'errors=panic' as an additional option alongside 'errors=remount-ro' would create duplicate 'errors=' directives; the kernel's mount parser may use the last one, but this is ambiguous and not a reliable or clean configuration. Option B is wrong because changing the mount point to '/panic' is nonsensical—it does not affect error handling and would break the root filesystem mount location. Option C is wrong because 'defaults,errors=panic' would replace all existing options with defaults plus the panic behavior, which would remove other necessary options (like 'rw') and could cause the root filesystem to mount incorrectly or lose required settings.

Full explanation →
8
MCQhard

Refer to the exhibit. The process with PID 1234 is in state 'Z'. What is the most likely cause and appropriate action?

A.The process is stopped; use kill -CONT to continue.
B.The process is a daemon; it should be restarted.
C.The process is sleeping; wait for it to become ready.
D.The process is a zombie; the parent process must be killed or wait for it to be reaped.
AnswerD

Zombies require the parent to reap them; if parent is not waiting, it may need to be terminated.

Why this answer

In Linux process states, 'Z' indicates a zombie process, which is a child process that has terminated but whose exit status has not yet been read by its parent process via the wait() system call. The correct action is to either kill the parent process (so that the zombie is reaped by init) or ensure the parent calls wait() to reap the child. Option D correctly identifies this.

Exam trap

The trap here is that candidates confuse zombie ('Z') with stopped ('T') or sleeping ('S') states, leading them to choose a recovery action like sending SIGCONT or simply waiting, rather than recognizing that a zombie requires the parent to reap it or be terminated.

How to eliminate wrong answers

Option A is wrong because a stopped process is indicated by state 'T' (or 't'), not 'Z', and kill -CONT is used to resume a stopped process, not handle a zombie. Option B is wrong because a daemon process typically runs in the background with state 'S' (sleeping) or 'R' (running), and restarting a daemon does not address a zombie; zombies are already dead and waiting to be reaped. Option C is wrong because a sleeping process is indicated by state 'S' or 'D' (uninterruptible sleep), not 'Z', and waiting will not resolve a zombie—the zombie persists until the parent reaps it.

Full explanation →
9
Matchingmedium

Match each device file naming pattern to its device type.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

First SCSI/SATA disk

First NVMe SSD

First serial port (COM1)

First loopback device

First software RAID device

Why these pairings

Common Linux device naming conventions: /dev/sdX for SATA/SCSI, /dev/hdX for IDE, /dev/ttySX for serial ports, /dev/srX for optical drives, /dev/nvmeXnY for NVMe. Be cautious not to confuse with floppy (/dev/fdX) or other types.

Full explanation →
10
MCQmedium

A system administrator wants to configure log rotation to compress log files daily and keep 30 days of logs. Which of the following configurations achieves this goal?

A.Set the 'maxlogsize' parameter in /etc/rsyslog.conf
B.Add a configuration file in /etc/logrotate.d/ with the contents: '/var/log/mylog { daily rotate 30 compress }'
C.Create a cron job that runs 'gzip /var/log/mylog.*' daily
D.Edit /etc/logrotate.conf to set 'rotate 30 weekly'
AnswerB

This is the correct logrotate syntax for daily rotation, 30 rotations, and compression.

Why this answer

Logrotate is the standard Linux utility for log rotation, compression, and retention. The configuration directive 'daily rotate 30 compress' in a file under /etc/logrotate.d/ instructs logrotate to rotate logs daily, keep 30 rotated copies, and compress old logs with gzip. This directly meets the requirement of daily compression and 30-day retention.

Exam trap

The trap here is that candidates may confuse logrotate's 'rotate' count with a time-based retention period, or assume that rsyslog or a simple cron+gzip approach can handle rotation and retention, when in fact logrotate is the dedicated tool that manages both rotation and compression with precise control over file naming and retention limits.

How to eliminate wrong answers

Option A is wrong because /etc/rsyslog.conf is the configuration file for rsyslog, the system logging daemon, and it does not have a 'maxlogsize' parameter for log rotation; log rotation is handled by logrotate, not rsyslog. Option C is wrong because a cron job running 'gzip /var/log/mylog.*' would compress all matching files daily but would not perform rotation (renaming the active log) or enforce a retention limit of 30 days, leading to uncontrolled accumulation of compressed files. Option D is wrong because editing /etc/logrotate.conf to set 'rotate 30 weekly' would keep 30 weeks of logs, not 30 days, and the 'weekly' directive contradicts the requirement for daily rotation.

Full explanation →
11
MCQeasy

Which hardware component uses a unique address to identify itself on the network at the data link layer?

A.IP address
B.MAC address
C.Hostname
D.Port number
AnswerB

MAC addresses are used for communication within a local network segment.

Why this answer

The MAC address (Media Access Control) is a unique 48-bit identifier burned into the network interface controller (NIC) by the manufacturer. It operates at Layer 2 (data link layer) of the OSI model, enabling devices on the same local network segment to communicate directly using protocols like Ethernet or Wi-Fi.

Exam trap

The trap here is that candidates often confuse the MAC address with the IP address because both are used for network identification, but the question specifically asks for the data link layer, where only the MAC address (not the IP address) operates.

How to eliminate wrong answers

Option A is wrong because an IP address operates at Layer 3 (network layer) and is used for logical addressing and routing across networks, not for hardware identification at the data link layer. Option C is wrong because a hostname is a human-readable alias resolved to an IP address via DNS or local hosts files, and it has no role in data link layer addressing. Option D is wrong because a port number is a Layer 4 (transport layer) identifier used by TCP or UDP to distinguish application services on a host, not for hardware-level network identification.

Full explanation →
12
MCQmedium

An administrator wants systemd-journald logs to persist across reboots. What must be created?

A.The directory /run/log/journal
B.The file /etc/journald.conf
C.The directory /var/log/journal
D.The directory /var/spool/journal
AnswerC

If this directory exists and has correct ownership, journald stores logs persistently.

Why this answer

By default, systemd-journald stores logs in a volatile tmpfs at /run/log/journal, which is cleared on reboot. To make logs persistent, the directory /var/log/journal must be created. When systemd-journald detects this directory exists, it automatically switches to persistent storage, writing logs to /var/log/journal and preserving them across reboots.

Exam trap

The trap here is that candidates often assume editing the configuration file /etc/journald.conf is sufficient, but without the actual directory /var/log/journal existing, systemd-journald will not switch to persistent storage unless Storage=persistent is explicitly set and the directory is created.

How to eliminate wrong answers

Option A is wrong because /run/log/journal is the default volatile location for systemd-journald logs; it is automatically created on tmpfs and does not persist across reboots. Option B is wrong because /etc/journald.conf is the configuration file for systemd-journald, but creating it alone does not enable persistence; the key setting is Storage=persistent in that file, but the directory /var/log/journal must also exist (or be created) for persistence to take effect. Option D is wrong because /var/spool/journal is not a standard path used by systemd-journald; the correct persistent directory is /var/log/journal as defined by the journald documentation and the systemd source code.

Full explanation →
13
MCQmedium

A systems administrator needs to change the permissions of the file /home/user/script.sh so that the owner can read, write, and execute; the group can read and execute; and others have no access. Which command accomplishes this?

A.chmod 755 /home/user/script.sh
B.chmod 750 /home/user/script.sh
C.chmod 770 /home/user/script.sh
D.chmod 741 /home/user/script.sh
AnswerB

750 gives rwx for owner, r-x for group, and --- for others, matching the requirement.

Why this answer

Chmod 750 sets the permissions to rwxr-x---, which gives the owner read, write, and execute (7), the group read and execute (5), and others no access (0). This matches the requirement exactly.

Exam trap

The trap here is that candidates often confuse the octal values, especially mistaking 755 (which grants others read/execute) for the correct setting, or they forget that 750 denies others access while 755 does not.

How to eliminate wrong answers

Option A is wrong because chmod 755 sets permissions to rwxr-xr-x, which gives others read and execute access, violating the requirement that others have no access. Option C is wrong because chmod 770 sets permissions to rwxrwx---, which gives the group write access in addition to read and execute, exceeding the required group permissions. Option D is wrong because chmod 741 sets permissions to rwxr----x, which gives others only execute access (1) instead of no access, and the group has only read access (4) instead of read and execute.

Full explanation →
14
MCQmedium

On a systemd-based system, which file is NOT used for system initialization?

A./etc/fstab
B./etc/systemd/system/default.target
C./etc/inittab
D./lib/systemd/system/sysinit.target
AnswerC

Inittab is for SysV init, not systemd.

Why this answer

/etc/inittab is the configuration file used by the traditional SysV init system to define runlevels and control terminal getty processes. On a systemd-based system, systemd does not read /etc/inittab; instead, it uses unit files and targets to manage system initialization, making this file unused for that purpose.

Exam trap

The trap here is that candidates familiar with SysV init assume /etc/inittab is still relevant on modern Linux systems, but LPIC-1 tests the distinction between legacy and systemd initialization files.

How to eliminate wrong answers

Option A is wrong because /etc/fstab is still used by systemd (via systemd-fstab-generator) to mount filesystems during boot, so it is involved in system initialization. Option B is wrong because /etc/systemd/system/default.target is a symlink that defines the default boot target (e.g., multi-user.target or graphical.target) and is actively used by systemd to determine the initial system state. Option D is wrong because /lib/systemd/system/sysinit.target is a special target unit that systemd uses to synchronize early boot services and is a core part of the initialization process.

Full explanation →
15
MCQmedium

An Ubuntu 20.04 server needs a static IP address. The administrator has created a netplan YAML file at /etc/netplan/01-netcfg.yaml. What is the next step to apply the configuration?

A.netplan apply
B.ifconfig eth0 down; ifconfig eth0 up
C.service network-manager restart
D.systemctl restart networking
AnswerA

netplan apply parses YAML and configures network interfaces accordingly.

Why this answer

On Ubuntu 20.04, netplan is the default network configuration tool, and the correct command to apply changes from a YAML file in /etc/netplan/ is 'netplan apply'. This command parses the YAML, generates the appropriate backend configuration (systemd-networkd or NetworkManager), and applies it without requiring a reboot. It is the standard, supported method for activating static IP settings on modern Ubuntu systems.

Exam trap

The trap here is that candidates may confuse the legacy 'systemctl restart networking' or 'ifconfig' commands with the modern netplan workflow, assuming any service restart will apply the YAML configuration, but only 'netplan apply' correctly processes the netplan files and triggers the appropriate backend.

How to eliminate wrong answers

Option B is wrong because 'ifconfig eth0 down; ifconfig eth0 up' is a legacy method that does not read netplan YAML files; it only toggles the interface state and may not persist or apply the new static IP configuration. Option C is wrong because 'service network-manager restart' restarts the NetworkManager service, but on Ubuntu 20.04 with netplan, the default backend is systemd-networkd (unless explicitly configured otherwise), and this command may not correctly apply netplan settings or could interfere with the intended backend. Option D is wrong because 'systemctl restart networking' targets the old 'networking' service (used by ifupdown), which is not the active network stack on Ubuntu 20.04; netplan uses systemd-networkd or NetworkManager, so this command is irrelevant and will not apply the netplan configuration.

Full explanation →
16
Multi-Selecteasy

Which THREE of the following are correct features of the 'grep' command? (Choose three.)

Select 3 answers
A.-i makes the search case-insensitive
B.-v inverts the match
C.-c counts matching lines
D.-l prints line numbers of matches
E.-r enables regular expression matching
AnswersA, B, C

Correct: --ignore-case.

Why this answer

The `-i` flag in `grep` performs case-insensitive matching, so patterns like 'error' will match 'Error', 'ERROR', etc. This is a common requirement when searching log files where case may vary.

Exam trap

The trap here is that candidates confuse `-l` (list filenames) with `-n` (show line numbers) and assume `-r` enables regex, when in fact `-r` is for recursive directory traversal and regex is the default behavior.

Full explanation →
17
MCQhard

Refer to the exhibit. After modifying /etc/default/grub to enable serial console output, which command must be run to apply the changes to the GRUB configuration?

A.grub-editenv
B.grub-install
C.grub-set-default
D.update-grub
AnswerD

This runs grub-mkconfig to generate grub.cfg from /etc/default/grub and /etc/grub.d/.

Why this answer

The correct command is `update-grub` (or its equivalent `grub-mkconfig -o /boot/grub/grub.cfg`). After modifying `/etc/default/grub`, you must regenerate the GRUB configuration file (`grub.cfg`) to incorporate the new serial console settings. `update-grub` is a wrapper that runs `grub-mkconfig` and writes the output to the correct location, applying the changes.

Exam trap

The trap here is that candidates confuse commands that modify GRUB's runtime behavior (like `grub-set-default` or `grub-editenv`) with the command that regenerates the static configuration file from the template, leading them to pick a wrong option that does not actually apply changes from `/etc/default/grub`.

How to eliminate wrong answers

Option A is wrong because `grub-editenv` is used to edit the GRUB environment block (e.g., saved default entry or boot counter), not to regenerate the main configuration file from `/etc/default/grub`. Option B is wrong because `grub-install` installs GRUB to a disk or partition (e.g., MBR or EFI system partition) and does not read or apply changes from `/etc/default/grub`. Option C is wrong because `grub-set-default` sets the default boot entry in the GRUB environment block, but it does not regenerate `grub.cfg` from the configuration template.

Full explanation →
18
MCQhard

A company maintains a private Debian repository for internal packages. A new package 'internal-tool' version 2.0 has been added to the repository, but when users run 'apt-get update && apt-get install internal-tool', the old version 1.0 is still being offered. What is the most likely cause?

A.The package version number is not higher than the installed version
B.The local apt cache needs to be cleared with 'apt-get clean'
C.The 'apt-get update' command did not run successfully due to network issues
D.The repository's Release file has not been regenerated after adding the new package
AnswerD

apt uses the Release file to check validity; if outdated, it may ignore new Packages files.

Why this answer

The most likely cause is that the repository's Release file has not been regenerated after adding the new package. APT relies on the Release file (and its associated InRelease or Release.gpg) to obtain the current package metadata, including version information. If the Release file is not updated to reflect the new package version 2.0, APT will still see the old metadata and offer version 1.0, even though the package file exists in the repository.

Exam trap

The trap here is that candidates often assume the problem is with the local client cache (option B) or network issues (option C), when the real issue is a server-side metadata synchronization failure that prevents APT from discovering the new package version.

How to eliminate wrong answers

Option A is wrong because if the package version number (2.0) is higher than the installed version (1.0), APT would normally offer the upgrade; the issue is not about version comparison but about metadata not reflecting the new version. Option B is wrong because 'apt-get clean' only removes downloaded package files (.deb) from the local cache, not the metadata cache; the metadata is refreshed by 'apt-get update', and clearing the package cache would not fix a missing Release file update. Option C is wrong because the question states users run 'apt-get update && apt-get install internal-tool', implying the update command ran; if it had failed due to network issues, users would likely see an error message, not a silent offering of the old version.

Full explanation →
19
MCQhard

You are a Linux administrator for a company that uses a custom RPM-based distribution. The development team has built a new version of the internal tool 'monitor-app' (version 2.0) and placed the RPM package in a local YUM repository located at http://internal.repo/monitor-app-2.0.el7.x86_64.rpm. The repository metadata has been updated using 'createrepo'. On a test server running CentOS 7, you run 'yum update monitor-app' but the system reports 'No packages marked for update'. The currently installed version is 1.0. You verify that the repository is enabled and accessible via 'yum repolist'. What is the most likely cause and the correct course of action?

A.Download the RPM and install it locally with 'rpm -Uvh monitor-app-2.0.el7.x86_64.rpm'
B.Run 'yum list available | grep monitor' to see if the package is listed with a different name, then install it with the exact name
C.Check the version number in the repository using 'yum info monitor-app' and compare with installed version
D.Run 'yum clean all' and then 'yum update monitor-app' again
AnswerB

This identifies the exact package name in the repository.

Why this answer

The most likely cause is that the package name in the repository differs from the installed package name (e.g., 'monitor-app' vs. 'monitor-app-2.0'). Running 'yum list available | grep monitor' will reveal the exact package name in the repository, allowing you to install it with the correct name. This is a common scenario when package naming conventions change between versions or when the repository uses a different naming scheme than the installed package.

Exam trap

The trap here is that candidates assume the package name in the repository is identical to the installed package name, leading them to try cache-clearing or local RPM installation instead of verifying the actual package name in the repository.

How to eliminate wrong answers

Option A is wrong because downloading and installing the RPM locally with 'rpm -Uvh' bypasses YUM's dependency resolution and repository metadata, which can lead to broken dependencies or conflicts, and does not address why YUM did not detect the update. Option C is wrong because 'yum info monitor-app' will show the same installed version (1.0) if the package name in the repository does not match the installed package name, so it would not reveal the discrepancy. Option D is wrong because 'yum clean all' clears the local cache but does not fix the underlying issue of a mismatched package name; if the package name is different, YUM will still not see it as an update after cleaning the cache.

Full explanation →
20
MCQhard

After a system upgrade, the server fails to boot with the error: 'ERROR: Failed to mount the real root device.' The root filesystem is on an LVM logical volume. Which recovery step is most appropriate?

A.Boot from a live CD, chroot, and run 'update-initramfs -u -k all' to regenerate the initramfs with lvm2 support
B.Run 'lvchange -ay' to activate all LVs
C.Reinstall GRUB to the MBR
D.Use 'fsck' on the root LV
AnswerA

This rebuilds the initramfs including necessary LVM modules.

Why this answer

The error 'Failed to mount the real root device' after a system upgrade indicates the initramfs lacks the necessary LVM modules (e.g., lvm2) to activate and mount the root logical volume. Regenerating the initramfs with 'update-initramfs -u -k all' rebuilds it to include LVM support, ensuring the kernel can locate and mount the root filesystem during boot.

Exam trap

The trap here is that candidates confuse a missing initramfs module issue with a logical volume activation problem (Option B), but 'lvchange -ay' is only effective after the initramfs has loaded LVM support; without it, the kernel cannot even see the LVs to activate them.

How to eliminate wrong answers

Option B is wrong because 'lvchange -ay' activates all logical volumes, but this command must be run from a rescue environment (e.g., live CD) and does not address the missing LVM support in the initramfs; the kernel still cannot mount the root LV without proper modules. Option C is wrong because reinstalling GRUB to the MBR only fixes bootloader issues (e.g., missing or corrupted stage files), not the kernel's inability to mount the root filesystem due to missing LVM drivers. Option D is wrong because 'fsck' checks and repairs filesystem integrity, but the error occurs before the filesystem is even mounted; the root cause is the initramfs lacking LVM support, not filesystem corruption.

Full explanation →
21
MCQmedium

Refer to the exhibit. Which filesystem will be checked last during system boot by fsck?

A./dev/sda3
B./dev/sda2
C./dev/sda1
D./dev/sdb1
AnswerA

Pass 2, checked after pass 1 filesystems and before any higher pass numbers.

Why this answer

The /etc/fstab file defines the order in which filesystems are checked by fsck during boot, based on the sixth field (pass number). A pass number of 1 is checked first (typically the root filesystem), 2 is checked next (other filesystems), and 0 means no check. In the exhibit, /dev/sda3 has a pass number of 2, but since it is listed last among the entries with pass number 2, it will be checked after all other pass-2 filesystems, making it the last one checked overall.

Exam trap

The trap here is that candidates assume the pass number alone determines the order, ignoring that filesystems with the same pass number are checked sequentially based on their listing order in /etc/fstab.

How to eliminate wrong answers

Option B is wrong because /dev/sda2 has a pass number of 1, which is checked first during boot. Option C is wrong because /dev/sda1 has a pass number of 2 but appears earlier in /etc/fstab than /dev/sda3, so it is checked before /dev/sda3. Option D is wrong because /dev/sdb1 has a pass number of 0, meaning it is never checked by fsck during boot.

Full explanation →
22
MCQeasy

A technician needs to add the official Debian repository for the 'buster' release. Which line should be added to /etc/apt/sources.list?

A.`deb http://deb.debian.org/debian buster-updates main`
B.`deb-src http://deb.debian.org/debian buster main`
C.`rpm http://deb.debian.org/debian buster main`
D.`deb http://deb.debian.org/debian buster main`
AnswerD

Standard format for binary package repository.

Why this answer

It uses the standard 'deb' prefix for binary packages, points to the official Debian repository at http://deb.debian.org/debian, specifies the release codename 'buster', and includes the required component 'main'. This is the exact format required by APT to fetch packages for the Debian buster release.

Exam trap

The trap here is that candidates may confuse the 'deb' and 'deb-src' prefixes, or mistakenly add '-updates' thinking it is required for the base release, when the question specifically asks for the repository line for the 'buster' release itself, not its updates.

How to eliminate wrong answers

Option A is wrong because it appends '-updates' to the release name, which would configure the buster-updates repository (for package updates after the initial release) rather than the main buster repository. Option B is wrong because it uses 'deb-src' prefix, which is for source packages, not binary packages; the question asks for the repository line to add, and while deb-src is valid for source code, the standard binary repository uses 'deb'. Option C is wrong because it uses 'rpm' prefix, which is the package format for Red Hat-based distributions (like Fedora, CentOS), not for Debian-based systems; APT expects 'deb' or 'deb-src' lines.

Full explanation →
23
Multi-Selectmedium

Which TWO commands can be used to display the current runlevel of a system?

Select 2 answers
A.telinit q
B.systemctl get-default
C.init 3
D.runlevel
E.who -r
AnswersD, E

Displays previous and current runlevel.

Why this answer

The `runlevel` command displays the previous and current runlevel of a SysV init system. The `who -r` command also shows the current runlevel along with the process ID of the init daemon. Both are standard tools for querying runlevel information on systems using SysV init.

Exam trap

The trap here is that candidates may confuse commands that change the runlevel (like `init 3`) with commands that display it, or assume `systemctl get-default` shows the current runlevel when it actually shows the default target for the next boot.

Full explanation →
24
MCQhard

A sysadmin wants to ensure a specific kernel module is automatically loaded at boot. Which method is considered best practice?

A.Use systemd-modules-load.service
B.All of the above are valid methods
C.Add module name to /etc/modules
D.Add a line to /etc/modprobe.d/
AnswerC

Adding the module name to /etc/modules is the traditional and standard method, and works across distributions. This is best practice.

Why this answer

The best practice to automatically load a kernel module at boot is to add the module name to /etc/modules or a file in /etc/modules-load.d/. This method works on both sysvinit and systemd systems, as systemd-modules-load.service reads these configuration files. Directly using the service or adding lines to /etc/modprobe.d/ is not standard; /etc/modprobe.d/ is for module options, not auto-loading.

Exam trap

The trap is assuming that /etc/modprobe.d/ or the service itself is used for auto-loading. In reality, /etc/modprobe.d/ is for options and aliases, and the service reads configuration files like /etc/modules or /etc/modules-load.d/*.conf.

How to eliminate wrong answers

Option A is wrong because it is not incorrect—systemd-modules-load.service is a valid mechanism that reads configuration files to load modules at boot, so it is a correct method, not a wrong one. Option C is wrong because it is not incorrect—adding the module name to /etc/modules is a traditional method still supported by systemd-modules-load.service on many distributions. Option D is wrong because it is not incorrect—adding a line to /etc/modprobe.d/ (e.g., with the 'install' or 'alias' directive) can also cause the module to be loaded at boot, making it a valid method.

Full explanation →
25
MCQeasy

A system administrator is troubleshooting a Linux server that fails to boot. The server has a software RAID 1 configuration using mdadm, with the root filesystem located on /dev/md0. During boot, the system halts with the following error: 'VFS: Unable to mount root fs on unknown-block(0,0)'. The admin verifies that the BIOS recognizes all disks and that the RAID array was properly assembled prior to the last shutdown. The system was working after a recent kernel update, but now fails. Which of the following actions is the most likely solution?

A.Use a live CD to run fsck on /dev/md0.
B.Rebuild the initramfs to include the mdadm module and the RAID metadata.
C.Check the /etc/fstab file for incorrect root device.
D.Reinstall the bootloader on the MBR.
AnswerB

Rebuilding the initramfs adds the necessary RAID support, allowing the kernel to assemble and mount /dev/md0.

Why this answer

After a kernel update, the new kernel may lack the necessary mdadm module or RAID metadata support in the initramfs. The error 'unknown-block(0,0)' indicates the kernel cannot find the root device because the initramfs does not contain the required RAID drivers or assembly instructions. Rebuilding the initramfs with the correct mdadm configuration ensures the kernel can assemble and mount /dev/md0 during boot.

Exam trap

The trap here is that candidates often confuse a root filesystem mount failure with filesystem corruption (fsck) or bootloader issues, but the specific 'unknown-block(0,0)' error points to a missing kernel module or initramfs problem after a kernel update.

How to eliminate wrong answers

Option A is wrong because fsck repairs filesystem corruption, but the error 'unknown-block(0,0)' indicates the kernel cannot locate the block device at all, not that the filesystem is damaged. Option C is wrong because /etc/fstab is read after the root filesystem is mounted; if the root device cannot be found, the system never reaches the point of parsing fstab. Option D is wrong because reinstalling the bootloader on the MBR addresses bootloader issues (e.g., GRUB stage 1), but the error occurs after the kernel is loaded and fails to mount root, indicating a missing driver or module in the initramfs.

Full explanation →
26
MCQhard

A company manages a cluster of 50 web servers running Ubuntu 20.04. The servers are configured to synchronize time with an internal NTP server at 10.0.0.100 using the default ntpd. The NTP server itself syncs with external stratum 2 servers. Recently, the security team implemented a restrictive iptables firewall on all servers, allowing only essential services. Several servers in the 10.0.1.0/24 network now report time drift and ntpq -p shows all peers with '?' status. A network engineer runs tcpdump on one affected server and sees no NTP replies from 10.0.0.100. The NTP server's firewall is configured to allow inbound NTP from 10.0.0.0/24 only. The engineer also notes that the server's /etc/ntp.conf contains the line 'restrict 10.0.0.100' (which is incorrect) and that ntpq -crv shows 'sync target not reachable'. Which single action will most directly resolve the synchronization issue for the affected servers?

A.Add an iptables rule on the affected server to accept outbound UDP packets to 10.0.0.100 port 123.
B.Remove the line 'restrict 10.0.0.100' from /etc/ntp.conf.
C.Modify the NTP server's firewall to allow inbound NTP from 10.0.1.0/24.
D.Add a static route on the affected server for 10.0.0.100 via a different gateway.
AnswerC

Correct. The NTP server's firewall only permits inbound NTP from 10.0.0.0/24. Since the affected servers are in 10.0.1.0/24, adding a rule to allow their subnet directly resolves the issue.

Why this answer

The affected servers are in the 10.0.1.0/24 network, but the NTP server's firewall only allows inbound NTP from 10.0.0.0/24. Even if the client's firewall permits outbound UDP to port 123, the server will drop the requests because they originate from an unauthorized subnet. Therefore, modifying the NTP server's firewall to accept NTP traffic from 10.0.1.0/24 directly resolves the synchronization issue.

Option A (client firewall fix) is necessary but not sufficient because the server will still block the requests. Option B fixes the incorrect restrict line but does not address the firewall. Option D is irrelevant as routing is not the problem.

Exam trap

Candidates often focus on the client's firewall or the incorrect restrict line, but the most direct cause is the NTP server's firewall misconfiguration. Even if the client allows outbound traffic, the server drops requests from the wrong subnet.

How to eliminate wrong answers

Option A is wrong because the problem is not the client's outbound firewall; the client can send NTP requests, but the NTP server's firewall blocks replies to 10.0.1.0/24, so adding an outbound rule on the client does nothing. Option B is wrong because the 'restrict 10.0.0.100' line in /etc/ntp.conf is syntactically incorrect (it should be 'restrict 10.0.0.100 mask 255.255.255.255' or similar) but even if corrected, it controls access to the local NTP service, not the ability to receive replies from the server; the core issue is the server-side firewall. Option D is wrong because the affected server can already reach 10.0.0.100 (it sends requests), and adding a static route does not address the firewall blocking replies; the routing is fine.

Full explanation →
27
MCQmedium

A system administrator needs to find out which package installed the file /usr/bin/foo on a Red Hat system. Which command should be used?

A.`rpm -qa /usr/bin/foo`
B.`rpm -qi /usr/bin/foo`
C.`rpm -ql /usr/bin/foo`
D.`rpm -qf /usr/bin/foo`
AnswerD

Queries the package that owns the file.

Why this answer

The `rpm -qf /usr/bin/foo` command queries the RPM database to determine which installed package owns the specified file. The `-f` (or `--file`) option tells RPM to search for the package that provided that file path, making it the correct choice for this task on a Red Hat system.

Exam trap

The trap here is confusing the direction of the query: candidates often pick `rpm -ql` (list files in a package) instead of `rpm -qf` (find package owning a file), because they misremember which option performs the reverse lookup.

How to eliminate wrong answers

Option A is wrong because `rpm -qa` lists all installed packages, and appending a file path like `/usr/bin/foo` is invalid syntax; it does not query which package owns the file. Option B is wrong because `rpm -qi` displays detailed information about a specified package (e.g., `rpm -qi bash`), not about a file; passing a file path to `-qi` will result in an error or unintended behavior. Option C is wrong because `rpm -ql` lists all files installed by a specified package, not the reverse lookup of which package owns a given file.

Full explanation →
28
MCQhard

Refer to the exhibit. A user tries to execute a script on a mounted filesystem but gets a permission denied error. The script has execute permissions. What is the most likely cause?

A.The script is not executable for the user.
B.The user does not have read permission on the script.
C.The filesystem is mounted with the 'noexec' option.
D.The filesystem is full.
AnswerC

The 'noexec' mount option disables execution of binaries/scripts on that filesystem.

Why this answer

The 'noexec' mount option prevents execution of any binary or script on the filesystem, regardless of file permissions. Even if the script has execute permissions set, the kernel will refuse to execute it when the filesystem is mounted with 'noexec'. This is a common security measure on filesystems like /tmp or /home to prevent unauthorized code execution.

Exam trap

The trap here is that candidates often assume 'permission denied' always means incorrect file permissions, but the LPIC-1 exam tests the understanding that mount options like 'noexec' can override file-level permissions and cause execution failures.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that the script has execute permissions, so the script is executable for the user. Option B is wrong because read permission is not required to execute a script; execute permission alone is sufficient for execution (though the interpreter needs read access to the script file). Option D is wrong because a full filesystem would cause write failures, not a 'permission denied' error when trying to execute a script.

Full explanation →
29
MCQmedium

Refer to the exhibit. An administrator wants to add a new partition that uses the remaining space on /dev/sda (total 40GB). What is the next free sector for the start of the new partition?

A.83886080
B.83886079
C.83886078
D.0
AnswerA

The next free sector after the last used sector.

Why this answer

The disk has 40 GB, which is 83886080 sectors, numbered 0–83886079. The existing partition(s) end at sector 83886079, so the next free sector would be 83886080. Although this sector is beyond the disk, it is the correct arithmetic answer and indicates that no free space remains.

Therefore, option A is correct.

Exam trap

The trap here is that candidates often confuse the last sector number (83886079) with the next free sector, forgetting that sectors are zero-indexed and the next free sector is one greater than the last used sector, which in this case equals the total sector count and indicates no space remains.

How to eliminate wrong answers

Option B (83886079) is wrong because that is the last sector of the existing partition, not the next free sector; starting a partition there would overlap with the existing data. Option C (83886078) is wrong because it is two sectors before the end of the existing partition, causing an even larger overlap. Option D (0) is wrong because sector 0 is the Master Boot Record (MBR) and is already occupied by the partition table and boot code; it cannot be used as the start of a new partition.

Full explanation →
30
Matchingmedium

Match each networking tool to its primary use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Test network connectivity to a host

Display network connections, routing tables, etc.

Capture and analyze network packets

Query DNS for domain name or IP

Configure network interfaces and routing

Why these pairings

The correct matches are: ping for connectivity testing, ifconfig for interface configuration, and traceroute for path tracing. Common confusions include swapping netstat and nslookup definitions, or mistaking traceroute's purpose for ping's.

Full explanation →
31
Multi-Selectmedium

On a modern Linux system using systemd-networkd for interface management and systemd-resolved for DNS, which THREE files are typically involved in network configuration and DNS resolution?

Select 3 answers
A./etc/systemd/network/10-static.network
B./etc/network/interfaces
C./etc/resolv.conf
D./etc/hosts
E./etc/sysconfig/network-scripts/ifcfg-eth0
AnswersA, C, D

systemd-networkd uses .network files in this directory.

Why this answer

On a modern Linux system using systemd-networkd, network interface configuration is defined in .network files within /etc/systemd/network/, such as 10-static.network (Option A). systemd-resolved manages DNS resolution and typically writes to /etc/resolv.conf (Option C) as a symlink to its own stub resolver. /etc/hosts (Option D) is a static host-to-IP mapping file that is consulted by the system's resolver before DNS queries, making it a standard part of DNS resolution. Together, these three files are directly involved in network configuration and DNS resolution under systemd.

Exam trap

The trap here is that candidates often assume /etc/network/interfaces or ifcfg-eth0 are still relevant on modern systemd-based distributions, but systemd-networkd uses its own .network files, and the question explicitly specifies systemd-networkd and systemd-resolved.

Full explanation →
32
MCQmedium

A Linux administrator is troubleshooting a server that fails to boot with the error 'Give root password for maintenance (or press Control-D to continue)'. The root filesystem is on /dev/sda2, formatted as ext4. The administrator suspects a filesystem inconsistency. The server is in a remote data center and the administrator has console access via IPMI. Which of the following is the safest procedure to repair the filesystem?

A.At the maintenance prompt, run 'mount -o remount,ro /dev/sda2 /' then 'fsck -f /dev/sda2' and then 'reboot'.
B.At the maintenance prompt, run 'fsck /dev/sda2' and answer yes to all prompts.
C.At the maintenance prompt, run 'fsck -y /dev/sda2' to force repair.
D.At the maintenance prompt, run 'fsck -a /dev/sda2' to automatically repair.
AnswerA

Correct: remount read-only, then fsck, then reboot.

Why this answer

It first remounts the root filesystem as read-only to prevent any writes during the repair, which is essential for a consistent fsck run on an ext4 filesystem. Then it uses 'fsck -f' to force a check even if the filesystem appears clean, followed by a reboot to exit maintenance mode. This is the safest procedure as it avoids the risk of the filesystem being mounted read-write during repair, which could cause further corruption.

Exam trap

The trap here is that candidates often choose 'fsck -y' or '-a' thinking they are the safest automated options, but they fail to recognize that these options can automatically apply destructive repairs (like truncating corrupt files) without administrator review, whereas the correct procedure ensures the filesystem is read-only and forces a check with the '-f' flag.

How to eliminate wrong answers

Option B is wrong because running 'fsck' without the '-f' flag may skip the check if the filesystem is marked clean, and answering 'yes' to all prompts interactively is not suitable for remote console access where automation is preferred. Option C is wrong because 'fsck -y' automatically answers 'yes' to all prompts, including potentially dangerous actions like discarding data or truncating files, which could lead to data loss without administrator oversight. Option D is wrong because 'fsck -a' is a legacy option for ext2/ext3 that attempts automatic repair but may not be fully supported on ext4 and can be less safe than '-f' with manual confirmation.

Full explanation →
33
MCQeasy

Refer to the exhibit. The administrator wants to ensure that SSH service starts automatically after a system reboot. Based on the output, what is the current status of this setting?

A.The service is enabled and will start at boot.
B.The service is disabled and will not start at boot.
C.The service is static and cannot be enabled.
D.The service is not running.
AnswerA

'enabled' indicates it will start at boot.

Why this answer

The `systemctl is-enabled sshd` command returns 'enabled', which means the SSH service is configured to start automatically at boot. This is confirmed by the output in the exhibit, showing that the service is enabled and will start during system initialization.

Exam trap

The trap here is that candidates may confuse the 'enabled' status with the 'active' (running) status, or misinterpret 'static' as a valid state for this service, when the output clearly shows 'enabled'.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows 'enabled', not 'disabled', so the service will start at boot. Option C is wrong because 'static' is a possible systemd unit state that means the unit cannot be manually enabled or disabled but can be started by other units; however, the output shows 'enabled', not 'static'. Option D is wrong because the question asks about the status of automatic start at boot, not whether the service is currently running; the `is-enabled` command does not indicate the current runtime state.

Full explanation →
34
Multi-Selecteasy

Which TWO commands can be used to display the current routing table on a Linux system?

Select 2 answers
A.ss -r
B.route -n
C.iptables -L
D.ifconfig -r
E.ip route show
AnswersB, E

Correct: route -n displays the routing table in numeric format.

Why this answer

The `route -n` command displays the kernel IP routing table, showing destination networks, gateways, and interfaces. The `-n` flag ensures numeric output (no hostname resolution), which is useful for troubleshooting. The `ip route show` command is part of the modern `iproute2` suite and also displays the routing table, providing more detailed and flexible output than the legacy `route` command.

Exam trap

The trap here is that candidates may confuse `ss -r` with `ss -t` or `ss -u` (which show TCP/UDP sockets) or think `iptables -L` shows routing rules, but `iptables` only manages packet filtering and NAT rules, not the routing table.

Full explanation →
35
MCQmedium

Refer to the exhibit. A user gets this error when running a script. What is the most likely cause?

A.The script is missing a shebang line.
B.The script has Windows-style line endings (CRLF).
C.The script does not have execute permission.
D.The script contains a syntax error in line 3.
AnswerB

The carriage return character (CR) is interpreted as a command, indicating CRLF line endings.

Why this answer

The error message shown in the exhibit (typically '/bin/bash^M: bad interpreter' or similar) indicates that the script contains carriage return characters (CR, \r) at the end of lines, which is characteristic of Windows-style CRLF line endings. When Linux's Bash tries to interpret the shebang line, it sees '/bin/bash^M' as the interpreter path, which does not exist, causing the script to fail. This is a common issue when scripts are created or edited on Windows and then transferred to a Unix-like system without converting line endings.

Exam trap

The LPI exam often tests the distinction between permission errors (chmod) and interpreter errors (shebang/line endings), trapping candidates who assume any script execution failure is due to missing execute permissions.

How to eliminate wrong answers

Option A is wrong because a missing shebang line would cause the script to be executed by the default shell (usually /bin/sh) or produce a different error (e.g., 'command not found'), not the specific 'bad interpreter' error shown. Option C is wrong because missing execute permission would produce a 'Permission denied' error, not an interpreter-related error. Option D is wrong because a syntax error in line 3 would only be detected after the script starts executing, and the error message would reference a syntax issue (e.g., 'syntax error near unexpected token'), not a missing interpreter.

Full explanation →
36
MCQeasy

A system administrator needs to install a local Debian package file named 'myapp.deb'. Which command should be used?

A.rpm -ivh myapp.deb
B.aptitude install myapp.deb
C.dpkg -i myapp.deb
D.apt-get install myapp.deb
AnswerC

dpkg -i installs a package from a .deb file.

Why this answer

The correct command to install a local Debian package file is `dpkg -i myapp.deb`. The `dpkg` tool is the low-level package manager for Debian-based systems that directly handles `.deb` files, and the `-i` flag triggers installation. Unlike `apt-get` or `aptitude`, `dpkg` does not resolve dependencies automatically, but it is the proper tool for installing a standalone `.deb` file from disk.

Exam trap

The trap here is that candidates confuse `dpkg` with `apt-get` or `aptitude`, assuming that any package manager can install a local file, but only `dpkg` directly handles `.deb` files without requiring a repository lookup.

How to eliminate wrong answers

Option A is wrong because `rpm -ivh` is used for RPM-based distributions (e.g., Red Hat, Fedora) and cannot process `.deb` files; it would fail with an error about an invalid package format. Option B is wrong because `aptitude install` expects a package name from a repository, not a local file path; while `aptitude` can install a `.deb` file with `./myapp.deb` syntax, the standard and most direct command for a local `.deb` is `dpkg -i`. Option D is wrong because `apt-get install` also expects a package name from a repository, not a local file; it would attempt to fetch 'myapp.deb' from configured sources and fail, as it does not accept a file path directly.

Full explanation →
37
MCQeasy

A system administrator notices that after updating the kernel, the system fails to boot. The administrator wants to boot the previous kernel. Which GRUB menu option should be selected?

A.Memory test
B.Advanced options for Ubuntu
C.Recovery mode
D.Boot from first hard disk
AnswerB

This option often lists previous kernel versions.

Why this answer

The 'Advanced options for Ubuntu' GRUB menu entry provides access to a submenu listing all installed kernel versions, allowing the administrator to select and boot the previous kernel. This is the standard method to revert to a known-good kernel after a failed update, as GRUB dynamically generates entries for each kernel found in /boot.

Exam trap

The trap here is that candidates may confuse 'Recovery mode' with a kernel version selector, but Recovery mode is a single-kernel boot option for troubleshooting, not a menu for choosing among multiple kernels.

How to eliminate wrong answers

Option A is wrong because 'Memory test' runs a diagnostic memory check (e.g., Memtest86+) and does not allow selecting a different kernel version. Option C is wrong because 'Recovery mode' boots a specific kernel with minimal services and a root shell, but it does not offer a choice of kernel versions; it is used for system repair, not kernel selection. Option D is wrong because 'Boot from first hard disk' bypasses the GRUB menu entirely and boots the default boot loader on the first disk, which would likely load the same problematic kernel.

Full explanation →
38
MCQmedium

A system fails to mount an XFS filesystem with the entry in /etc/fstab. The entry looks correct. Which fstab field might be missing or incorrect?

A.The device field
B.The options field
C.The mountpoint field
D.The filesystem type field
AnswerD

Correct: If the type is omitted or incorrect (e.g., ext4 instead of xfs), mount may fail.

Why this answer

The XFS filesystem requires the filesystem type field in /etc/fstab to be explicitly set to 'xfs'. If this field is missing or incorrect (e.g., left blank, set to 'auto', or mistyped as 'ext4'), the mount command will fail because it cannot determine the correct filesystem driver to use. Even if the device, mountpoint, and options appear correct, an incorrect or missing type field prevents the kernel from loading the XFS module and mounting the filesystem.

Exam trap

LPI often tests the misconception that the filesystem type field is optional or can be left as 'auto' for all filesystems, but for XFS (and other non-default filesystems), the type must be explicitly specified because auto-detection may fail or the required kernel module may not be loaded automatically.

How to eliminate wrong answers

Option A is wrong because the device field (e.g., /dev/sda1 or UUID=...) must be correct for the system to identify the block device; if it were missing or incorrect, the error would be about a missing device, not a filesystem type mismatch. Option B is wrong because the options field (e.g., defaults, noatime) controls mount behavior but does not affect the kernel's ability to identify the filesystem type; incorrect options would cause mount to succeed with different parameters or fail with a specific option error. Option C is wrong because the mountpoint field (e.g., /mnt/data) must exist and be correct; if missing or incorrect, the error would be 'mount point does not exist' or 'not a directory', not a filesystem type failure.

Full explanation →
39
MCQhard

A kernel module fails to load with the error 'modprobe: FATAL: Module xyz not found in directory /lib/modules/$(uname -r)'. What is the most likely cause?

A.The module is blacklisted in /etc/modprobe.d/.
B.The kernel version has changed and modules need to be rebuilt.
C.The module has dependencies that are missing.
D.The module is not installed on the system.
AnswerB

After a kernel update, modules for the new kernel may not be present; they need to be rebuilt or reinstalled.

Why this answer

The error message references the specific kernel version from `uname -r`. If the kernel has been updated (e.g., via a package upgrade), the modules directory for the new kernel version will not contain the previously built modules. The module must be rebuilt against the new kernel's source or headers, which is why option B is correct.

Exam trap

The trap here is that candidates often confuse a 'not found' error with the module simply being missing from the filesystem, but the specific inclusion of the kernel version directory (e.g., /lib/modules/5.10.0-9-amd64) in the error message points directly to a kernel version mismatch. This is common after a kernel update in Linux distributions like Debian or Ubuntu, where modules must be rebuilt or re-installed for the new kernel version.

How to eliminate wrong answers

Option A is wrong because a blacklisted module would produce a different error (e.g., 'Module xyz is blacklisted') or simply be skipped, not a 'not found' error. Option C is wrong because missing dependencies typically produce an error like 'Required key not available' or 'Unknown symbol', not a 'not found' error for the module itself. Option D is wrong because if the module were simply not installed, the error would be 'modprobe: FATAL: Module xyz not found.' — the inclusion of the specific directory path in the error indicates the system is looking in the correct location for the running kernel, but the module is absent there, which is consistent with a kernel version mismatch.

Full explanation →
40
MCQmedium

Which command is used to compress a file with the highest compression ratio?

A.gzip -9
B.xz -9
C.bzip2 -9
D.compress
AnswerB

xz offers the highest compression ratio among these tools, especially with -9.

Why this answer

`xz -9` uses the LZMA2 compression algorithm, which typically achieves a higher compression ratio than gzip (DEFLATE) or bzip2 (Burrows-Wheeler transform) at the cost of slower speed and higher memory usage. The `-9` flag sets the highest compression level, maximizing the ratio.

Exam trap

The trap here is that candidates often assume gzip or bzip2 with `-9` offers the highest compression ratio because they are more common, but xz is the correct answer due to its superior LZMA2 algorithm.

How to eliminate wrong answers

Option A is wrong because gzip uses the DEFLATE algorithm, which generally provides lower compression ratios than xz, especially at level 9. Option C is wrong because bzip2 uses the Burrows-Wheeler transform and Huffman coding, which can achieve good ratios but is typically outperformed by xz's LZMA2 in terms of compression ratio. Option D is wrong because `compress` uses the LZW algorithm, which is outdated and offers significantly lower compression ratios than modern tools like xz.

Full explanation →
41
MCQeasy

Which FHS directory contains essential binaries needed for booting and repairing the system, even before /usr is mounted?

A./boot
B./usr/bin
C./sbin
D./bin
AnswerD

Contains essential binaries like ls, mount, etc.

Why this answer

The /bin directory contains essential user binaries (e.g., ls, cp, mount, bash) required for booting, repairing, and single-user mode, even when /usr is not mounted. The Filesystem Hierarchy Standard (FHS) mandates that /bin must be available before /usr is mounted, ensuring critical commands are accessible during early boot stages or recovery scenarios.

Exam trap

The trap here is that candidates often confuse /sbin with /bin, assuming that system repair binaries are exclusively in /sbin, but the FHS explicitly designates /bin for essential user binaries required before /usr is mounted, while /sbin is for system administration tools that may also be needed but are not the primary answer for 'essential binaries' in this context.

How to eliminate wrong answers

Option A is wrong because /boot contains the kernel and bootloader files (e.g., vmlinuz, initramfs), not the essential user binaries needed for system repair after booting. Option B is wrong because /usr/bin holds non-essential user binaries that are typically mounted later in the boot process (often on a separate partition) and may not be available when /usr is unmounted. Option C is wrong because /sbin contains system administration binaries (e.g., fdisk, mkfs) intended for system maintenance, but the FHS specifies /bin as the directory for essential user binaries required for booting and repair; /sbin is also critical but the question specifically asks for 'essential binaries' that include user commands, not just system administration tools.

Full explanation →
42
Drag & Dropmedium

Order the steps to recover a forgotten root password on a Linux system.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Recovery involves booting into a shell with root access, remounting read-write, and changing the password.

Full explanation →
43
MCQhard

Refer to the exhibit. A user reports that the 'myapp' command fails to run. Based on the output, what is the most likely cause?

A.The interpreter path is incorrect.
B.The file is not a valid ELF executable.
C.A required shared library (libfoo.so.1) is missing.
D.The file is not executable for the user.
AnswerC

ldd shows libfoo.so.1 => not found, which will cause the dynamic linker to fail.

Why this answer

The error message 'error while loading shared libraries: libfoo.so.1: cannot open shared object file: No such file or directory' indicates that the dynamic linker cannot locate the required shared library libfoo.so.1. This is the most likely cause because the 'myapp' binary is linked against this library, and without it, the program cannot start.

Exam trap

LPI often tests the distinction between file permissions (executable bit) and runtime library dependencies, leading candidates to mistakenly choose 'file not executable' when the real issue is a missing shared library.

How to eliminate wrong answers

Option A is wrong because the interpreter path (e.g., #!/bin/bash or #!/usr/bin/python) is only relevant for script files, not for ELF binaries; the error message specifically mentions a missing shared library, not an interpreter issue. Option B is wrong because the file is clearly a valid ELF executable (as shown by the 'file' command output 'ELF 64-bit LSB executable'), and the error is about a missing library, not an invalid format. Option D is wrong because the file has execute permissions (as shown by '-rwxr-xr-x'), and the error message does not mention 'Permission denied'; the user can execute the file, but it fails at runtime due to the missing library.

Full explanation →
44
MCQhard

A script reads a CSV file where fields may contain commas within quoted strings. Which approach correctly parses such fields?

A.Using 'cut -d',' -f1,2 file'
B.Using 'while IFS= read -r line; do ... done < file' and parsing manually
C.Using 'while IFS=',' read -r f1 f2; do ... done < file'
D.Using awk or a dedicated tool like csvkit
AnswerD

awk can handle quoted fields with FPAT; csvkit is purpose-built.

Why this answer

CSV fields containing commas within quoted strings require a parser that understands CSV quoting rules. Awk can be scripted to handle quoted fields, and dedicated tools like csvkit (e.g., csvcut, csvformat) are designed specifically to parse CSV according to RFC 4180, correctly ignoring commas inside double-quoted strings.

Exam trap

The trap here is that candidates assume simple field-splitting tools like 'cut' or 'read' with IFS=',' can handle CSV, but they fail to account for commas inside quoted strings, which is a classic LPIC-1 data management pitfall.

How to eliminate wrong answers

Option A is wrong because 'cut -d',' -f1,2 file' splits on every comma, including those inside quoted strings, corrupting the field boundaries. Option B is wrong because 'while IFS= read -r line; do ... done < file' reads entire lines but manual parsing of quoted commas is error-prone and requires complex state-machine logic, not a simple approach. Option C is wrong because 'while IFS=',' read -r f1 f2; do ... done < file' splits on every comma, treating commas inside quotes as field separators, which breaks the CSV structure.

Full explanation →
45
Multi-Selecteasy

Which THREE of the following are valid runlevels in a traditional SysV init system? (Choose three.)

Select 3 answers
A.9
B.6
C.7
D.1
E.0
AnswersB, D, E

Runlevel 6 is reboot.

Why this answer

In a traditional SysV init system, runlevels are predefined system states numbered from 0 to 6. Runlevel 6 is the standard runlevel for system reboot, where the init process terminates all processes, unmounts filesystems, and restarts the system.

Exam trap

A common misconception is that runlevels can be any number from 0 to 9, but the SysV init standard strictly limits valid runlevels to 0 through 6, with 7–9 being reserved or invalid. The LPI LPIC-1 exam expects you to know the standard runlevels and their purposes.

Full explanation →
46
MCQeasy

A cron job is configured to run a script every day at 2:30 AM. The sysadmin notices the job runs but produces no output. Which is the most likely reason?

A.The cron daemon is not running.
B.The script requires a terminal to run.
C.The MAILTO environment variable is not set, and the output is not redirected.
D.Cron automatically suppresses all output.
AnswerC

Cron emails output only if MAILTO is set; otherwise, output is lost.

Why this answer

Cron jobs run in a non-interactive, non-terminal environment. By default, cron captures any output (stdout/stderr) from the job and attempts to email it to the user. If the MAILTO variable is not set and the output is not redirected to a file or /dev/null, the output is simply discarded, resulting in no visible output.

The job still runs successfully, but the output is lost.

Exam trap

The trap here is that candidates often assume cron silently discards all output by default, when in fact cron attempts to mail it, and the 'no output' symptom is due to the output being sent to an unmonitored mailbox or not redirected.

How to eliminate wrong answers

Option A is wrong because if the cron daemon were not running, the job would not run at all, but the question states the job runs. Option B is wrong because cron jobs do not require a terminal; they run in a minimal environment without a controlling terminal, and scripts that need a terminal would typically fail or hang, not produce no output. Option D is wrong because cron does not automatically suppress all output; it captures output and either mails it or discards it based on configuration.

Full explanation →
47
MCQeasy

A developer asks the system administrator to configure a local web server for testing using Apache. The server should serve files from /var/www/test. Which directive must be set in the Apache configuration to set this document root?

A.Alias /test /var/www/test
B.ServerRoot /var/www/test
C.DocumentRoot /var/www/test
D.DirectoryIndex /var/www/test
AnswerC

DocumentRoot defines the root directory for HTTP requests.

Why this answer

The DocumentRoot directive in Apache defines the top-level directory from which it serves files for a given virtual host or the main server. Setting DocumentRoot /var/www/test tells Apache to map incoming HTTP requests to files under that directory, making it the correct choice for serving files from /var/www/test.

Exam trap

The trap here is that candidates confuse DocumentRoot with ServerRoot or Alias, often thinking ServerRoot defines where web files are served from, when in fact it points to Apache's own installation directory.

How to eliminate wrong answers

Option A is wrong because Alias maps a URL path to a filesystem directory but does not set the primary document root; it is used for additional URL-to-directory mappings. Option B is wrong because ServerRoot specifies the directory where Apache's configuration, logs, and modules reside, not the directory for serving web content. Option D is wrong because DirectoryIndex defines the default file (e.g., index.html) to serve when a directory is requested, not the document root path.

Full explanation →
48
MCQhard

A production server running CentOS 7 has multiple SCSI disks (sda, sdb, sdc) configured in a RAID5 array managed by mdadm (md0). The root filesystem is on md0. After a power failure, the server boots but drops into a rescue shell with the error: 'md: md0: cannot run array. Not enough devices online.' The admin checks with 'cat /proc/mdstat' and sees that only sda and sdb are spares (marked as (S)), sdc is missing. Which sequence of commands should the admin use to attempt recovery and bring the system to a functional state? Options: A) First run 'mdadm --manage /dev/md0 --add /dev/sdc', then 'mdadm --run /dev/md0'. B) Boot from a live CD, then run 'mdadm --assemble --scan' to reassemble. C) Run 'mdadm --stop /dev/md0', then 'mdadm --assemble /dev/md0 /dev/sda /dev/sdb /dev/sdc'. D) Run 'mdadm --run /dev/md0' to force start the array in degraded mode, then add sdc with 'mdadm --add' after system is up.

A.First run 'mdadm --manage /dev/md0 --add /dev/sdc', then 'mdadm --run /dev/md0'
B.Boot from a live CD, then run 'mdadm --assemble --scan' to reassemble
C.Run 'mdadm --stop /dev/md0', then 'mdadm --assemble /dev/md0 /dev/sda /dev/sdb /dev/sdc'
D.Run 'mdadm --run /dev/md0' to force start the array in degraded mode, then add sdc with 'mdadm --add' after system is up
AnswerD

Correct. Use --run to start the array in degraded mode despite the missing disk, then add the disk to begin recovery. This allows the system to boot.

Why this answer

Since the RAID5 array has only two of three disks available, it can still operate in degraded mode. The command 'mdadm --run /dev/md0' forces the array to start despite the missing device, allowing the system to boot from the root filesystem on md0. Once the system is operational, the admin can add the missing disk with 'mdadm --add /dev/md0 /dev/sdc' to initiate recovery and rebuild the array.

Option A is incorrect because you cannot add a disk to an inactive array; you must first force the array to run. Option B is unnecessary; the system can be recovered without a live CD. Option C fails because stopping the array is impossible while the root filesystem is mounted, and reassembling without the missing disk will not succeed.

Exam trap

The trap here is that candidates mistakenly think they must stop and reassemble the array or use a live CD, when in fact the correct recovery is to force the array to run degraded with '--run' and then add the missing disk.

How to eliminate wrong answers

Option B is wrong because booting from a live CD is unnecessary and overly disruptive; the system can be recovered without external media by forcing the array to run degraded. Option C is wrong because 'mdadm --manage --add' cannot add a device to a stopped or non-running array, and the command sequence is reversed; the array must be running first. Option D is wrong because stopping the array with 'mdadm --stop' and then reassembling with explicit device list is risky and may fail if the superblock on sdc is stale or inconsistent; the simpler approach is to force start degraded.

Full explanation →
49
MCQmedium

Refer to the exhibit. The root partition is at 80% usage. Which action would reduce usage the most?

A.Increase the size of /dev/sda1
B.Delete unused files in /tmp
C.Run 'du -sh /home' to find large files
D.Move some files from /home to /
AnswerB

If /tmp is on root, this directly frees space.

Why this answer

The /tmp directory typically contains temporary files that can be safely deleted without affecting system operation. Since the root partition is at 80% usage, clearing out /tmp can reclaim significant space, especially on systems where applications or users have left large temporary files. The 'rm -rf /tmp/*' command or using tmpwatch/systemd-tmpfiles can free up space immediately.

Exam trap

The trap here is that candidates often choose option C (running 'du -sh /home') because they think identifying large files is the same as freeing space, but the question asks for an action that reduces usage, not just reports it.

How to eliminate wrong answers

Option A is wrong because increasing the size of /dev/sda1 (the root partition) does not reduce usage; it only expands the available capacity, leaving the same amount of data on the partition. Option C is wrong because running 'du -sh /home' only identifies large files in /home, which is typically a separate partition or mount point and does not directly reduce usage on the root partition. Option D is wrong because moving files from /home to / would increase usage on the root partition, making the problem worse.

Full explanation →
50
MCQhard

A company runs a web server using Apache with multiple virtual hosts. The administrator needs to restrict access to a specific virtual host based on the client IP address. Which configuration directive should be placed inside the <VirtualHost> block to deny IP 192.168.1.100?

A.Require host 192.168.1.100
B.Require not ip 192.168.1.100
C.Deny from 192.168.1.100
D.Require valid-user
AnswerB

New syntax: Require not ip denies the specific IP.

Why this answer

In Apache 2.4 and later, access control is managed using the `Require` directive with the `not` modifier to deny specific IP addresses. Placing `Require not ip 192.168.1.100` inside the `<VirtualHost>` block will deny access to that IP while allowing all others, as the default behavior is to require all IPs unless a `Require` directive explicitly grants access.

Exam trap

The trap here is that candidates familiar with Apache 2.2 may choose `Deny from` (Option C), not realizing that LPIC-1 exams focus on Apache 2.4 syntax where `Require` directives are the standard, and legacy directives are deprecated.

How to eliminate wrong answers

Option A is wrong because `Require host` is used to allow or deny based on hostnames (e.g., domain names), not IP addresses; it would attempt a reverse DNS lookup on the client IP, which is not the correct method for IP-based restrictions. Option C is wrong because `Deny from` is a legacy Apache 2.2 directive that is deprecated in Apache 2.4 and may not work unless the `mod_access_compat` module is loaded; it is not the modern recommended approach. Option D is wrong because `Require valid-user` is used for authentication-based access control (requiring a valid user/password), not for IP-based restrictions.

Full explanation →
51
MCQeasy

An administrator adds the line 'DenyUsers john' to /etc/ssh/sshd_config and restarts the SSH service. What is the effect?

A.User john cannot log in via SSH.
B.User john can still log in but his commands are logged.
C.User john is denied all shell access, including local and console logins.
D.All users except john cannot log in via SSH.
AnswerA

This is the intended behavior of the DenyUsers directive.

Why this answer

The 'DenyUsers' directive in /etc/ssh/sshd_config explicitly blocks the specified user(s) from authenticating via SSH. When the SSH service is restarted, the configuration is reloaded, and user 'john' will be denied SSH login attempts at the authentication layer, before any shell or command execution occurs.

Exam trap

The trap here is that candidates often confuse 'DenyUsers' with broader access restrictions like PAM-based account denial or shell-level bans, but 'DenyUsers' is SSH-specific and only affects SSH logins, not console or other remote access methods.

How to eliminate wrong answers

Option B is wrong because 'DenyUsers' does not enable logging of commands; logging of SSH sessions is controlled by directives like 'LogLevel' or 'ForceCommand' with logging wrappers, not by 'DenyUsers'. Option C is wrong because 'DenyUsers' only affects SSH access, not local console logins or other non-SSH shell access; local authentication is handled by PAM or /etc/nologin, not by sshd_config. Option D is wrong because 'DenyUsers' denies only the specified user(s), not all users except that user; the inverse behavior would require 'AllowUsers' with all other users listed.

Full explanation →
52
Multi-Selectmedium

Which TWO commands can be used to display information about the CPU(s) in a Linux system? (Choose two.)

Select 2 answers
A.uname -m
B.lsusb
C.cpufreq-info
D.cat /proc/cpuinfo
E.lscpu
AnswersD, E

cat /proc/cpuinfo shows detailed per-CPU information.

Why this answer

Options D and E are both correct. `cat /proc/cpuinfo` reads the virtual file /proc/cpuinfo which the kernel populates with detailed CPU information for each core, such as model name, cache size, and flags. `lscpu` is a utility that collects CPU information from /proc/cpuinfo and sysfs, presenting it in a human-readable tabular format. Both commands are standard on Linux for displaying CPU details.

Exam trap

The trap here is that candidates may confuse uname -m (which shows architecture) with a command that provides full CPU details, or assume cpufreq-info is a standard CPU info command when it is actually a specialized frequency tool.

Full explanation →
53
MCQeasy

A system administrator needs to remove a package called 'apache2' from a Red Hat Enterprise Linux system while leaving its configuration files intact. Which command accomplishes this?

A.yum erase apache2
B.yum remove apache2
C.rpm -e apache2
D.rpm -F apache2
AnswerC

Removes package but preserves configuration files.

Why this answer

`rpm -e` (erase) removes the package but, by default, leaves configuration files (usually marked as %config in the RPM spec) intact on the filesystem. This behavior is specific to RPM: when erasing a package, RPM renames modified config files with a `.rpmsave` extension rather than deleting them, preserving administrator customizations.

Exam trap

The trap here is that candidates confuse `yum remove`/`yum erase` (which remove config files by default) with `rpm -e` (which preserves them), or they mistakenly think `rpm -F` is a removal command when it actually performs an upgrade operation.

How to eliminate wrong answers

Option A is wrong because `yum erase` is a valid command, but it is not the correct answer for Red Hat Enterprise Linux (RHEL) — the question asks for a command that removes the package while leaving configuration files intact, and `yum erase` actually removes both the package and its configuration files by default (unless the `--keepconf` option is used, which is not mentioned). Option B is wrong because `yum remove` is synonymous with `yum erase` and also removes configuration files by default, failing the requirement to leave config files intact. Option D is wrong because `rpm -F` (freshen) upgrades an existing package only if an older version is installed; it does not remove packages at all.

Full explanation →
54
MCQhard

You are responsible for maintaining a legacy Red Hat Enterprise Linux 6 server that hosts an internal web application. The application was compiled years ago and relies on an old version of OpenSSL (0.9.8). Due to a security audit, you must update OpenSSL to 1.0.1 but the application fails to run with the new version. The vendor no longer supports the application. You must keep the system secure while keeping the application operational. You have access to the application source code but cannot modify it. What is the best solution?

A.Modify the application source code to be compatible with OpenSSL 1.0.1 and recompile.
B.Update OpenSSL system-wide and use 'LD_PRELOAD' to load the old library for the application.
C.Keep OpenSSL 0.9.8 and accept the risk.
D.Install OpenSSL 1.0.1 in /usr/local/lib and keep 0.9.8 in /usr/lib. Rebuild the application with an RPATH pointing to /usr/local/lib/openssl0.9.8.
AnswerD

Keeps both versions, application uses old one via RPATH.

Why this answer

It allows you to install OpenSSL 1.0.1 in a separate path (/usr/local/lib) while keeping the legacy 0.9.8 in /usr/lib. By rebuilding the application with an RPATH pointing to /usr/local/lib/openssl0.9.8, you force the dynamic linker to load the old OpenSSL library only for that application, satisfying the security audit for the rest of the system while keeping the unmodifiable application operational.

Exam trap

The trap here is that candidates often think 'LD_PRELOAD' is a universal solution for library version conflicts, but it applies globally to the process and does not isolate the old library from the system, whereas RPATH provides per-binary library path control without modifying system-wide library search order.

How to eliminate wrong answers

Option A is wrong because you stated you cannot modify the application source code, and even if you could, recompiling may introduce new bugs or dependencies. Option B is wrong because using 'LD_PRELOAD' to load the old library would override the new system-wide OpenSSL for the application, but it does not address the security requirement to update OpenSSL system-wide; the old library would still be present and could be loaded by other processes, and the application would still use the insecure version. Option C is wrong because keeping OpenSSL 0.9.8 and accepting the risk violates the security audit requirement and is not a valid long-term solution for a production server.

Full explanation →
55
MCQhard

Refer to the exhibit. An admin attempts to execute a shell script located in /tmp but gets 'Permission denied'. Which mount option is most likely causing this?

A.relatime
B.noexec
C.nodev
D.nosuid
AnswerB

Prevents execution of any files on the filesystem.

Why this answer

The 'noexec' mount option prevents execution of any binary or script directly from the filesystem, regardless of file permissions. Since the script is in /tmp and the admin gets 'Permission denied' despite correct execute bits, the /tmp partition is likely mounted with noexec, which is a common security hardening practice.

Exam trap

The trap here is that candidates assume 'Permission denied' always means missing execute bits (chmod +x), when in fact the noexec mount option silently blocks execution even with correct permissions.

How to eliminate wrong answers

Option A (relatime) is wrong because it only controls how access timestamps are updated on the filesystem, not execution permissions. Option C (nodev) is wrong because it prevents block or character special devices from being interpreted, not script execution. Option D (nosuid) is wrong because it ignores setuid/setgid bits on executables, but does not block execution itself.

Full explanation →
56
MCQhard

An RPM-based system has a package 'example-1.0' installed, but a newer version 'example-2.0' is available in a repository. Which command will upgrade the package?

A.rpm -Uvh example-2.0.rpm
B.yum update example
C.yum check-update example
D.yum install example
AnswerB

yum update updates the specified package from the repository.

Why this answer

'yum update example' is the standard command to upgrade a specific package to the latest available version from configured repositories. YUM automatically resolves dependencies and retrieves the newer package from the repository, making it the appropriate tool for upgrading from a repository source.

Exam trap

The trap here is that candidates often confuse 'yum install' (which installs a new package or upgrades if already installed but is not the standard upgrade command) with 'yum update' (the explicit command for upgrading installed packages), or they mistakenly think 'rpm -Uvh' works with repository packages without a local file.

How to eliminate wrong answers

Option A is wrong because 'rpm -Uvh example-2.0.rpm' requires a local RPM file and does not query repositories; it would fail if the file is not present locally, and it bypasses automatic dependency resolution from repositories. Option C is wrong because 'yum check-update example' only lists available updates without performing any upgrade; it is a query command, not an installation command. Option D is wrong because 'yum install example' would install the package if not present, but if the package is already installed, it may not upgrade to a newer version unless the installed version is older; however, 'yum update' is the explicit command for upgrading an already installed package.

Full explanation →
57
MCQhard

A server configured with UEFI firmware and GPT partitioning fails to boot after a GRUB package update. The administrator suspects the bootloader is not correctly installed. Which command should be used to reinstall GRUB to the EFI system partition?

A.grub2-install /dev/sda1
B.grub-mkconfig -o /boot/grub/grub.cfg
C.grub-install /dev/sda
D.grub-install --target=x86_64-efi --efi-directory=/boot/efi
AnswerD

Correctly installs GRUB for UEFI, targeting the EFI system partition mounted at /boot/efi.

Why this answer

On a UEFI-based system with GPT partitioning, GRUB must be installed as an EFI application to the EFI System Partition (ESP). The `--target=x86_64-efi` flag specifies the EFI firmware target, and `--efi-directory=/boot/efi` points to the mount point of the ESP, ensuring the bootloader files (e.g., `grubx64.efi`) are placed in the correct EFI directory (e.g., `/boot/efi/EFI/GRUB/`).

Exam trap

The trap here is that candidates confuse `grub-install /dev/sda` (which works for BIOS/MBR systems) with the UEFI-specific command, or they mistakenly think regenerating the config file with `grub-mkconfig` reinstalls the bootloader.

How to eliminate wrong answers

Option A is wrong because `grub2-install /dev/sda1` targets a partition (e.g., `/dev/sda1`) rather than the disk device; GRUB installation for BIOS or EFI requires the whole disk (e.g., `/dev/sda`) or specific EFI parameters, and using a partition number is invalid. Option B is wrong because `grub-mkconfig -o /boot/grub/grub.cfg` only regenerates the GRUB configuration file from templates and does not install the bootloader to the disk or ESP; it cannot fix a missing or corrupted bootloader installation. Option C is wrong because `grub-install /dev/sda` without the `--target` and `--efi-directory` flags defaults to installing for BIOS/legacy boot (i386-pc), which writes to the Master Boot Record (MBR) and is incompatible with UEFI firmware that expects an EFI executable on the ESP.

Full explanation →
58
MCQhard

A script starts multiple background processes. An administrator wants to wait for all background jobs to complete before proceeding. Which command should be used?

A.jobs -l
B.wait %1
C.wait
D.sleep 5
AnswerC

Waits for all background jobs to complete.

Why this answer

The `wait` command without any arguments waits for all background jobs spawned by the current shell to complete before returning control to the script. This is the correct way to synchronize multiple background processes in a shell script, ensuring all child processes finish before proceeding to the next command.

Exam trap

The trap here is that candidates often confuse `wait` with `jobs` or assume that a fixed sleep duration is sufficient, not realizing that `wait` is the only command that dynamically synchronizes with the actual completion of all background jobs.

How to eliminate wrong answers

Option A is wrong because `jobs -l` lists background jobs with their process IDs but does not wait for them to finish; it merely displays their status. Option B is wrong because `wait %1` waits only for the specific job with job specifier `%1` (the first background job), not all background jobs. Option D is wrong because `sleep 5` simply pauses execution for 5 seconds and does not guarantee that any background jobs have completed; it is a fixed delay, not a synchronization mechanism.

Full explanation →
59
Multi-Selecthard

When writing a Bash script, which two constructs can be used to safely iterate over a list of filenames that may contain spaces or special characters? (Choose TWO)

Select 2 answers
A.for file in *.txt; do ... done
B.find . -name '*.txt' -exec echo {} \;
C.for file in $(find . -name '*.txt'); do ... done
D.while IFS= read -r file; do ... done < <(find . -name '*.txt' -print0)
E.for file in "*.txt"; do ... done
AnswersB, D

Executes a command per file without shell word splitting.

Why this answer

The `-exec` action in `find` passes each filename as a separate argument to the command, avoiding word splitting and glob expansion. This ensures that filenames containing spaces, tabs, or newlines are handled safely without being broken into multiple arguments.

Exam trap

The trap here is that candidates often assume command substitution (`$(...)`) or simple glob expansion safely handles filenames with spaces, but the shell performs word splitting and glob expansion on the unquoted result, leading to broken loops or security issues.

Full explanation →
60
MCQmedium

A Linux system using systemd fails to reach the default target after a recent change. The administrator wants to boot into a minimal environment to troubleshoot. Which kernel parameter should be added at the GRUB prompt?

A.single
B.systemd.unit=rescue.target
C.init=/bin/bash
D.systemd.unit=emergency.target
AnswerB

Rescue target provides a minimal environment with root read-write and basic services.

Why this answer

Systemd uses `systemd.unit=rescue.target` to boot into a minimal single-user environment with essential services, which is ideal for troubleshooting boot failures. This parameter overrides the default target at the GRUB prompt, allowing the administrator to diagnose and fix the issue without loading the full graphical or multi-user target.

Exam trap

The trap here is that candidates confuse 'rescue.target' with 'emergency.target' or legacy SysVinit parameters like 'single', not realizing that systemd (as used in LPI Linux) requires explicit unit names and that 'emergency.target' is even more stripped down, often lacking a writable root filesystem or networking.

How to eliminate wrong answers

Option A is wrong because `single` is a legacy SysVinit parameter; systemd ignores it unless a compatibility symlink is present, and it does not reliably set the unit to rescue.target. Option C is wrong because `init=/bin/bash` bypasses systemd entirely, starting only a bare shell without mounting filesystems or starting services, which is too minimal for most troubleshooting and can cause data loss. Option D is wrong because `systemd.unit=emergency.target` boots into an even more minimal environment than rescue.target, starting only a shell on the console without networking or multi-user support, which is typically too restrictive for general troubleshooting.

Full explanation →
61
MCQeasy

Based on the lsblk output, which of the following is true?

A.The disk /dev/sdb has an extended partition.
B.The root filesystem is mounted from /dev/sda5.
C.The partition /dev/sda2 is an extended partition.
D.The disk /dev/sda has a primary partition sda5.
AnswerC

Size 1K and no mount point indicate extended partition.

Why this answer

In the lsblk output, /dev/sda2 is listed as a partition of type 'Extended' (typically shown as 'Extended' or with a partition type ID of 5 in fdisk). Extended partitions cannot be directly formatted or mounted; they serve as containers for logical partitions (e.g., sda5). The lsblk output would show sda2 with no filesystem or mount point, and sda5 would appear as a child of sda2, confirming sda2 is extended.

Exam trap

The trap here is that candidates often confuse partition numbering with partition type, assuming that any partition numbered 5 or higher is automatically a primary partition, when in fact on MBR disks, partitions 5+ are always logical partitions inside an extended partition.

How to eliminate wrong answers

Option A is wrong because the lsblk output does not show /dev/sdb having an extended partition; /dev/sdb would need a partition listed as 'Extended' or with logical partitions nested under it, which is not indicated. Option B is wrong because the root filesystem is typically mounted from a primary or logical partition with a filesystem (e.g., ext4), and lsblk would show a mount point of '/' for that partition; if /dev/sda5 is a logical partition inside an extended partition, it could be root, but the question states 'based on the lsblk output' and without seeing the actual output, the statement is not universally true—it depends on the specific output. Option D is wrong because /dev/sda5, if it exists, is a logical partition (numbered 5 or higher) inside an extended partition, not a primary partition; primary partitions on MBR disks are numbered 1-4.

Full explanation →
62
MCQhard

An RPM-based system reports a file conflict during package installation. Which option to the rpm command will allow the installation to overwrite files from another package?

A.--force
B.--replacefiles
C.--nodeps
D.--justdb
AnswerB

This option replaces files from other packages.

Why this answer

The --replacefiles option tells rpm to overwrite files that already exist on the system from a different package, resolving file conflicts during installation. This is the correct and targeted way to allow overwriting without bypassing other important checks.

Exam trap

The trap here is that candidates often choose --force because it sounds like it would force overwrites, but it is a blunt instrument that also skips dependency checks, which is not what the question asks for.

How to eliminate wrong answers

Option A is wrong because --force is a legacy alias that actually combines --replacepkgs, --replacefiles, and --nodeps, which is overly broad and can mask dependency issues. Option C is wrong because --nodeps skips dependency checks entirely, not file conflict resolution. Option D is wrong because --justdb only updates the RPM database without actually installing or overwriting any files on disk.

Full explanation →
63
MCQmedium

A Linux system administrator is tasked with setting up a new server that will host multiple virtual machines using KVM. The server has 64 GB of RAM and two physical CPUs, each with 8 cores (16 threads). The administrator needs to allocate resources efficiently. The VMs will have varying workloads. The administrator wants to ensure that the host system has enough resources for itself and that VMs can use all available CPU cores. Which approach should the administrator take to configure CPU allocation for the host and VMs?

A.Use QEMU emulation instead of KVM to reduce CPU overhead.
B.Pin all physical CPU cores to the VMs using virsh vcpupin, and leave no cores for the host.
C.Use CPU pinning to reserve two physical cores for the host and distribute the remaining cores among VMs using host-passthrough mode.
D.Overcommit CPU resources by assigning 32 vCPUs to each VM, relying on the hypervisor to schedule.
AnswerC

This ensures host responsiveness and allows VMs to use all available CPU features.

Why this answer

It reserves two physical cores for the host system to ensure its stability and performance, while distributing the remaining cores among VMs using CPU pinning and host-passthrough mode. This approach allows VMs to access the full CPU feature set and all available cores efficiently, balancing host overhead with VM resource needs in a KVM environment.

Exam trap

The trap here is that candidates may assume overcommitting CPU resources is always safe (Option D) or that QEMU emulation is a performance improvement (Option A), when in fact KVM's hardware acceleration and proper pinning are critical for efficient virtualization.

How to eliminate wrong answers

Option A is wrong because QEMU emulation adds significant CPU overhead compared to KVM's hardware-assisted virtualization, which would degrade performance rather than reduce it. Option B is wrong because pinning all physical cores to VMs leaves no CPU resources for the host, causing the host to starve and potentially crash or become unresponsive. Option D is wrong because overcommitting CPU resources by assigning 32 vCPUs per VM (exceeding the total 32 threads) can lead to severe contention and performance degradation, as the hypervisor cannot efficiently schedule such an extreme overcommitment without proper resource limits.

Full explanation →
64
MCQmedium

A system administrator wants to monitor a log file in real-time for lines containing 'ERROR' and write them to a separate file. Which command combination is most appropriate?

A.less logfile
B.tail -f logfile | grep 'ERROR' > error.log
C.vi logfile
D.cat logfile | grep 'ERROR' > error.log
AnswerB

tail -f provides real-time output, grep filters.

Why this answer

`tail -f logfile` continuously outputs new lines appended to the file, and piping that output into `grep 'ERROR'` filters only lines containing 'ERROR', which are then redirected to `error.log`. This combination achieves real-time monitoring and selective logging without blocking the terminal or requiring manual intervention.

Exam trap

The trap here is that candidates may confuse `cat` with `tail -f`, thinking both can monitor a file in real time, but `cat` only dumps the current content and exits, while `tail -f` actively follows appended data.

How to eliminate wrong answers

Option A is wrong because `less logfile` is a pager for viewing file contents interactively; it does not provide real-time updates and cannot automatically filter lines to a separate file. Option C is wrong because `vi logfile` opens the file in a text editor, which is not designed for real-time monitoring or automated filtering and redirection. Option D is wrong because `cat logfile | grep 'ERROR' > error.log` only processes the current contents of the file at the moment of execution; it does not monitor for new lines appended in real time.

Full explanation →
65
Multi-Selecteasy

Which two commands can be used to display the amount of free and used memory in the system?

Select 2 answers
A.free
B.uptime
C.ps
D.top
E.vmstat
AnswersA, D

Displays amount of free and used memory in the system.

Why this answer

The `free` command displays the total amount of free and used physical memory and swap space in the system, along with buffers and cache. The `top` command provides a real-time, dynamic view of running processes and includes a summary of memory usage (both physical and swap) at the top of its output. Both commands are standard Linux utilities for monitoring memory consumption.

Exam trap

LPI often tests the distinction between commands that show system-wide memory summary (`free`, `top`) versus those that show per-process memory usage (`ps`) or system load/uptime (`uptime`), leading candidates to mistakenly select `ps` because it shows a %MEM column.

Full explanation →
66
MCQmedium

Refer to the exhibit. The system has two network interfaces: eth0 and eth1. Which interface will be used to reach a host at IP address 10.10.10.10?

A.eth1 via gateway 10.0.0.1.
B.eth0 via gateway 192.168.1.1.
C.eth0 via the default gateway.
D.eth0 directly.
AnswerA

10.10.10.10 falls within 10.0.0.0/8.

Why this answer

The routing table determines that the destination IP 10.10.10.10 is not within any directly connected subnet (eth0: 192.168.1.0/24, eth1: 10.0.0.0/24). The most specific matching route is the static route to 10.0.0.0/8 via gateway 10.0.0.1 on eth1, which covers the 10.10.10.10 address. Therefore, eth1 is used to reach the host.

Exam trap

The trap here is that candidates often assume the default gateway is always used for non-local traffic, forgetting that a more specific static route (like 10.0.0.0/8) takes precedence over the default route.

How to eliminate wrong answers

Option B is wrong because the route via gateway 192.168.1.1 on eth0 is for the 192.168.1.0/24 subnet, which does not include 10.10.10.10. Option C is wrong because the default gateway (0.0.0.0/0) is only used when no more specific route matches; here, the 10.0.0.0/8 route is more specific and takes precedence. Option D is wrong because 10.10.10.10 is not on the directly connected subnet of eth0 (192.168.1.0/24), so it cannot be reached directly without a gateway.

Full explanation →
67
MCQmedium

A Linux administrator is responsible for a server that runs a critical database application. The server uses SysV init and the current runlevel is 3. The administrator needs to schedule a maintenance window for next Sunday at 2:00 AM to apply security patches that require a reboot. The administrator wants to ensure that after the reboot, the system returns to runlevel 3 and the database service (db_service) starts automatically. The administrator also wants to log the maintenance actions to /var/log/maintenance.log. Which of the following is the BEST approach to accomplish these tasks?

A.Edit /etc/rc.d/rc.local to start db_service and set runlevel via 'init 3' in the script. Then use 'at 2am Sunday shutdown -r now' to schedule reboot and redirect output to /var/log/maintenance.log.
B.Edit /etc/inittab to change the initdefault line to 'id:3:initdefault:' and create an init script for db_service with appropriate symlinks in /etc/rc.d/rc3.d/. Schedule the reboot using 'shutdown -r 02:00' and configure syslog to capture messages to /var/log/maintenance.log.
C.Use 'systemctl set-default runlevel3.target' and 'systemctl enable db_service' then schedule reboot with 'shutdown -r 02:00' and log with 'logger' to /var/log/maintenance.log.
D.Use 'telinit 3' and 'service db_service start' then run 'reboot' at 2:00 AM. Log actions by appending to /var/log/maintenance.log manually.
AnswerA

rc.local runs after boot, but setting runlevel via 'init 3' in rc.local is redundant and may cause issues. 'shutdown -r now' reboots immediately, not at 2:00.

Why this answer

The best approach because it uses 'at' to schedule the reboot, which can be configured to run at a specific day and time (e.g., 'at 2am Sunday shutdown -r now'), and redirects output to /var/log/maintenance.log for simple logging. Although editing rc.local is not the standard SysV method for persistent service management, it effectively starts the database service and sets the runlevel to 3 upon boot. In contrast, option B's shutdown command does not allow specifying the day 'next Sunday', and configuring syslog for a custom log file is non-trivial.

Options C and D are incorrect due to systemd usage or lack of scheduling.

Exam trap

The trap is that candidates may assume option B is correct because it uses proper SysV init configuration (inittab and init scripts), but they overlook that 'shutdown -r 02:00' cannot schedule for a specific day like 'next Sunday', and that configuring syslog for custom logging is not straightforward. Option A, while using rc.local (a less standard method), provides direct scheduling via 'at' and simple output redirection.

How to eliminate wrong answers

Option A is wrong because editing /etc/rc.d/rc.local to start db_service and run 'init 3' is not the standard SysV method for persistent runlevel or service management; rc.local runs after init scripts and may not execute on all reboots, and redirecting output with '>' in an 'at' job does not capture all boot messages. Option C is wrong because it uses systemctl commands (systemctl set-default, systemctl enable) which are for systemd systems, not SysV init; the server uses SysV init, so these commands are invalid. Option D is wrong because 'telinit 3' and 'service db_service start' only affect the current session and do not persist after reboot; manually appending to the log is error-prone and does not capture system boot messages.

Full explanation →
68
Multi-Selectmedium

Which THREE of the following commands can be used to display information about block devices?

Select 3 answers
A.lsblk
B.free
C.fdisk -l
D.blkid
E.ip link
AnswersA, C, D

Lists block devices.

Why this answer

A is correct because `lsblk` lists all block devices (e.g., hard drives, SSDs, partitions) by reading the sysfs filesystem and the udev database, displaying their names, sizes, and mount points. It is the primary command for viewing block device topology.

Exam trap

The trap here is that candidates may confuse `free` (memory) or `ip link` (network) with block device commands, or forget that `fdisk -l` and `blkid` also display block device information, not just `lsblk`.

Full explanation →
69
Multi-Selecthard

Which TWO utilities can be used to check and repair an XFS filesystem?

Select 2 answers
A.e2fsck
B.fsck
C.xfs_repair
D.xfs_check
E.btrfs check
AnswersB, C

fsck correctly invokes xfs_repair for XFS filesystems, making it a valid tool for checking and repairing.

Why this answer

The fsck utility is a frontend that calls filesystem-specific checkers; for XFS, it invokes xfs_repair, which can both check and repair the filesystem. xfs_repair is the dedicated XFS repair tool. xfs_check is a read-only consistency checker and does not perform repairs, so it is not suitable for the 'repair' part of the question. The correct pair for checking and repairing an XFS filesystem are fsck (which invokes xfs_repair) and xfs_repair itself.

Exam trap

Candidates may mistakenly think that xfs_check is a repair tool because of its name, or that only xfs_repair is needed. However, fsck is also acceptable as it leverages xfs_repair for XFS.

Full explanation →
70
MCQmedium

Based on the exhibit, what is the most likely cause of the SSH service failure?

A.The sshd service is disabled.
B.The firewall is blocking port 22.
C.Another service is already listening on port 22.
D.The SSH configuration file has a syntax error.
AnswerC

Address already in use error.

Why this answer

The exhibit shows that the sshd service failed to start because the address (0.0.0.0:22) is already in use. This indicates that another process is already bound to port 22, preventing sshd from binding to it. Therefore, the most likely cause is that another service is already listening on port 22.

Exam trap

The trap here is that candidates often assume SSH failures are always due to firewall rules or disabled services, but the specific error message 'address already in use' directly points to a port conflict, not a firewall or configuration syntax issue.

How to eliminate wrong answers

Option A is wrong because if the sshd service were disabled, the system would not attempt to start it at all, and the error message would not indicate a port conflict. Option B is wrong because a firewall blocking port 22 would not cause sshd to fail to start; the service would still bind to the port, but connections would be dropped by the firewall. Option D is wrong because a syntax error in the SSH configuration file would produce a different error message (e.g., 'sshd: fatal: bad configuration options'), not an 'address already in use' error.

Full explanation →
71
MCQmedium

You are a Linux consultant hired by a university IT department. They have a custom scientific application that must be compiled from source on a cluster of identical workstations running Ubuntu 20.04. The compilation process requires a specific version of a library (libfoo 1.2) that is not available in the standard repositories, but an older version (libfoo 1.0) is available. You must provide instructions for installing libfoo 1.2 without breaking the system. The workstations have no internet access to external repositories; they can only access an internal repository. You have the source code and a .deb package for libfoo 1.2 built previously. Which approach would you recommend?

A.Install the pre-built .deb package using 'dpkg -i libfoo_1.2.deb' and then fix any dependency issues with 'apt-get install -f'.
B.Create a chroot environment with the required library and compile the application inside it.
C.Force install the library over the existing one using 'dpkg --force-depends -i'.
D.Download the source, configure with custom prefix and run 'make install' to place libraries in /usr/local/lib, then set LD_LIBRARY_PATH.
AnswerA

This is the standard way to install a local .deb.

Why this answer

Using `dpkg -i` to install the pre-built .deb package directly places libfoo 1.2 into the system's package database, ensuring it is tracked and can be managed by dpkg/APT. Running `apt-get install -f` afterward resolves any missing dependencies by automatically installing or upgrading required packages from the internal repository, maintaining system consistency without breaking existing packages.

Exam trap

The trap here is that candidates may think compiling from source (Option D) is safer because it avoids package manager conflicts, but they overlook that a .deb package provides proper integration with dpkg/APT, making it the recommended method for installing software on Debian-based systems when a pre-built package is available.

How to eliminate wrong answers

Option B is wrong because creating a chroot environment is overly complex for this scenario; the application needs to be compiled on the host system, and a chroot would isolate the library but require additional configuration to make it accessible to the compilation process, which is unnecessary when a .deb package is available. Option C is wrong because using `dpkg --force-depends -i` bypasses dependency checks, which can leave the system with unmet dependencies and potentially break other packages that rely on libfoo 1.0, leading to an inconsistent package state. Option D is wrong because compiling from source with a custom prefix and setting LD_LIBRARY_PATH does not register the library with the package manager, so it won't be tracked for updates or removals, and LD_LIBRARY_PATH can cause conflicts with system libraries if not managed carefully; this approach is less reliable than using a .deb package.

Full explanation →
72
Multi-Selecteasy

Which two commands can be used to list all packages that have the string 'kernel' in their name on a Debian system? (Choose two.)

Select 2 answers
A.`apt list --installed '*kernel*'`
B.`dpkg -l '*kernel*'`
C.`dpkg --get-selections | grep kernel`
D.`apt-cache search kernel`
E.`rpm -qa | grep kernel`
AnswersA, B

Lists installed packages matching the pattern.

Why this answer

`apt list --installed '*kernel*'` uses the APT package manager to list all installed packages whose names match the glob pattern `*kernel*`. Option B is correct because `dpkg -l '*kernel*'` uses the dpkg low-level tool with the `-l` (list) flag and a glob pattern to display all packages whose names contain 'kernel'. Both commands directly filter by package name on a Debian system.

Exam trap

The trap here is that candidates often confuse `dpkg --get-selections` (which lists all packages with their selection state, not just installed ones) with `dpkg -l` (which lists installed packages with a glob filter), or they mistakenly apply RPM-based commands like `rpm -qa` to a Debian system.

Full explanation →
73
Multi-Selecthard

Which THREE of the following are true regarding the use of systemd-networkd for network configuration? (Choose three.)

Select 3 answers
A.It can assign static IP addresses using .network files.
B.It can be used to configure network bridges.
C.It supports DHCP for dynamic IP assignment.
D.Configuration files are stored in /etc/network/.
E.It supports bonding of multiple interfaces.
AnswersA, B, C

Static IP via .network files.

Why this answer

Systemd-networkd uses .network files (e.g., /etc/systemd/network/10-static.network) to assign static IP addresses via the [Address] section. This allows precise control over IPv4/IPv6 addresses, subnet masks, and gateways without relying on DHCP.

Exam trap

The trap here is that candidates confuse the configuration directory /etc/systemd/network/ with the legacy /etc/network/ used by ifupdown, or assume systemd-networkd supports bonding natively when it actually requires additional kernel modules or external tools.

Full explanation →
74
MCQeasy

Refer to the exhibit. An administrator notices that /proc is mounted with 'noexec'. What is the impact of this mount option?

A.Device files are not interpreted.
B.Setuid programs do not work.
C.No binaries can be executed directly from /proc.
D.The filesystem cannot be written to.
AnswerC

noexec prevents execution of binaries on the filesystem.

Why this answer

The 'noexec' mount option prevents the direct execution of any binary files located on the mounted filesystem. Since /proc is a virtual filesystem that contains runtime system information and process data, mounting it with 'noexec' means that no binaries can be executed directly from /proc. This is a security measure to prevent malicious code from being run from procfs, as /proc should never contain executable programs in normal operation.

Exam trap

The trap here is that candidates often confuse 'noexec' with 'nosuid' or 'nodev', thinking it affects setuid binaries or device files, when in fact 'noexec' strictly controls whether binary executables can be run directly from the filesystem.

How to eliminate wrong answers

Option A is wrong because device files are not interpreted by the 'noexec' option; device file handling is governed by the 'nodev' mount option, which prevents the interpretation of device files. Option B is wrong because setuid programs are affected by the 'nosuid' mount option, not 'noexec'; 'noexec' only prevents direct execution of binaries, while setuid behavior is controlled separately. Option D is wrong because the ability to write to a filesystem is controlled by the 'ro' (read-only) or 'rw' (read-write) mount options, not by 'noexec', which only affects execution permissions.

Full explanation →
75
Multi-Selectmedium

A Debian system has some partially installed packages due to a failed installation. Which TWO commands can help resolve the broken dependencies? (Choose exactly two.)

Select 2 answers
A.apt-get -f install
B.apt-get dist-upgrade
C.apt-get upgrade
D.dpkg --configure -a
E.apt-get remove --purge
AnswersA, D

Fixes broken dependencies.

Why this answer

The `apt-get -f install` command (option A) is specifically designed to fix broken dependencies by attempting to correct a system with unsatisfied dependencies, often by installing missing packages or removing partially installed ones. The `dpkg --configure -a` command (option D) reconfigures any unpacked but not yet configured packages, which is a common state after a failed installation, and can resolve dependency issues by completing the configuration of partially installed packages.

Exam trap

The trap here is that candidates often confuse `apt-get upgrade` or `dist-upgrade` with dependency repair, but only `-f install` and `dpkg --configure -a` are the correct tools for fixing broken dependencies from a failed installation.

Full explanation →

Page 1 of 8

Page 2

All pages

12345678

Practice LPIC-1 by domain

Target a specific domain to shore up weak areas.

GNU and Unix CommandsDevices, Filesystems and FHSLinux Installation and Package ManagementEssential System Services and NetworkingAdministrative TasksShells, Scripting and Data ManagementSystem Architecture
See all domains with question counts →