Linux Professional Institute Certification Level 1 LPIC-1 LPIC-1 Questions 76–150 | Page 2/8

MCQhard

After modifying the /etc/fstab file, an administrator runs the command mount -a and receives the error 'mount: /data: special device /dev/sdb1 does not exist'. What is the most likely issue?

A.There is a typo in the device path in /etc/fstab.

B.The /dev/sdb1 device file is missing or corrupted.

C.The entry in /etc/fstab has an incorrect filesystem type.

D.The filesystem on /dev/sdb1 is not formatted.

AnswerA

A typo would cause the kernel to not find the device at the specified path, resulting in the 'does not exist' error.

Why this answer

The `mount -a` command reads all entries in /etc/fstab and attempts to mount them. The error 'special device /dev/sdb1 does not exist' indicates that the kernel cannot find the block device file at that path. The most likely cause is a typographical error in the device path within /etc/fstab, such as a misspelling (e.g., /dev/sdb1 vs /dev/sdb1) or an incorrect partition number, because the device file itself is created by udev and would exist if the hardware were properly detected.

Exam trap

The trap here is that candidates may assume the device file is missing due to a hardware or driver issue (Option B), but the error specifically points to a path mismatch in fstab, which is a common administrative mistake when editing configuration files.

How to eliminate wrong answers

Option B is wrong because if /dev/sdb1 were missing or corrupted, it would typically indicate a hardware detection issue or a missing driver, but the error message explicitly says 'does not exist', which is more commonly caused by a path mismatch in fstab rather than a missing device file (which udev would recreate on reboot). Option C is wrong because an incorrect filesystem type would produce a different error, such as 'wrong fs type, bad option, bad superblock', not a missing device error. Option D is wrong because an unformatted filesystem would cause a 'mount: /data: wrong fs type, bad option, bad superblock' error when mount tries to read the superblock, not a 'does not exist' error.

Full explanation →

MCQhard

The exhibit shows output from an RPM query on a RHEL 8 system. The installation time is shown as a Unix timestamp. Which command would display the installation date of the openssh-server package in a human-readable format?

A.rpm -q --dump openssh-server

B.rpm -q --changelog openssh-server

C.rpm -qi openssh-server

D.rpm -q --scripts openssh-server

AnswerC

Shows package info including install date.

Why this answer

`rpm -qi` (query info) displays detailed metadata for the specified package, including the installation date in a human-readable format. The `-i` flag retrieves information such as the installation date, build date, and other package metadata, converting Unix timestamps to a readable date string.

Exam trap

The trap here is that candidates may confuse `--dump` or `--scripts` with displaying metadata, but only `-i` (info) provides the installation date in a human-readable format, while the other options show different types of package data.

How to eliminate wrong answers

Option A is wrong because `rpm -q --dump` outputs file-level metadata (such as size, permissions, and MD5 digests) for each file in the package, not the package installation date. Option B is wrong because `rpm -q --changelog` displays the changelog entries for the package, which list historical changes and dates, but not the installation date of the package itself. Option D is wrong because `rpm -q --scripts` shows the pre-install, post-install, pre-uninstall, and post-uninstall scripts associated with the package, not the installation date.

Full explanation →

MCQhard

A server has a backup script that runs daily at midnight. The system administrator notices that the script sometimes fails because the filesystem is mounted read-only. Which approach is the best practice to ensure the script runs only when the filesystem is writable?

A.Add a cron job that runs before the backup to remount the filesystem read-write

B.Use anacron to run the job after boot

C.Wrap the backup command in a script that checks if the filesystem is writable before proceeding

D.Change the cron job to run every hour until it succeeds

AnswerC

Best practice: check condition inside script and exit gracefully if not met.

Why this answer

It implements a proactive check within the script itself, using a command like `touch /mountpoint/testfile 2>/dev/null` or checking `/proc/mounts` to verify write access before executing the backup. This avoids unnecessary remounts and ensures the script only proceeds when the filesystem is writable, which is a robust and self-contained solution.

Exam trap

The trap here is that candidates may assume remounting (Option A) is a safe fix, but LPIC-1 emphasizes that a read-only filesystem often indicates a deeper problem, and the best practice is to check state rather than force a change.

How to eliminate wrong answers

Option A is wrong because blindly remounting the filesystem read-write could override a forced read-only state caused by filesystem errors (e.g., from `fsck`), potentially leading to data corruption or system instability. Option B is wrong because anacron is designed to run jobs that were missed due to the system being off, not to handle a filesystem being read-only; it does not check filesystem state before execution. Option D is wrong because running the backup every hour until it succeeds wastes system resources, may cause overlapping backups, and does not address the root cause of the read-only filesystem.

Full explanation →

MCQeasy

A technician needs to remove a package named 'apache2' along with its configuration files from a Debian system. Which command should be used?

A.dpkg -r apache2

B.apt-get autoremove apache2

C.apt-get purge apache2

D.apt-get remove apache2

AnswerC

Removes package and config files.

Why this answer

The 'apt-get purge' command removes the specified package along with its configuration files from a Debian system. Unlike 'remove', which leaves configuration files intact, 'purge' deletes both the package binaries and the associated configuration data from /etc and other locations, fulfilling the requirement to remove 'apache2' completely.

Exam trap

The trap here is that candidates often confuse 'apt-get remove' with 'apt-get purge', mistakenly thinking 'remove' also deletes configuration files, or they incorrectly assume 'dpkg -r' performs a purge, when in fact it only removes the package without configuration cleanup.

How to eliminate wrong answers

Option A is wrong because 'dpkg -r apache2' removes the package but leaves configuration files on the system, which does not meet the requirement to remove configuration files. Option B is wrong because 'apt-get autoremove' is used to remove packages that were automatically installed as dependencies and are no longer needed; it does not accept a package name as an argument to remove a specific package like 'apache2'. Option D is wrong because 'apt-get remove apache2' removes the package binaries but retains configuration files, failing to satisfy the requirement to remove them.

Full explanation →

Multi-Selecthard

Which TWO of the following are valid methods to run a shell script named 'script.sh' using the bash shell, assuming the script has execute permission? (Choose two.)

Select 2 answers

A../script.sh

B.sh script.sh

C.script.sh (if in PATH)

D.source script.sh

E.bash script.sh

AnswersA, E

Executes the script using its shebang line, assumed to be bash.

Why this answer

'./script.sh' explicitly invokes the script using the current shell's shebang interpreter (e.g., #!/bin/bash) and requires execute permission. Option E is correct because 'bash script.sh' runs the script as an argument to the bash interpreter, which reads and executes the file line by line, also requiring execute permission.

Exam trap

The trap here is that candidates often confuse 'sh script.sh' with 'bash script.sh', not realizing that sh may be a different shell (e.g., dash) that lacks bash-specific features, and that 'source' is for importing functions/variables, not for running a script as a separate process.

Full explanation →

MCQmedium

Refer to the exhibit. An administrator runs ss -tuln and gets the output above. Which of the following statements about this server is true?

A.The server only runs SSH and DNS.

B.The server runs SSH and NTP only.

C.The server only runs SSH and HTTP.

D.The server runs SSH, HTTP, HTTPS, NTP, and mDNS.

AnswerD

Ports 22, 80, 443, 123, and 5353 correspond to these services.

Why this answer

The `ss -tuln` command displays listening TCP and UDP sockets with numeric addresses and ports. The output shows ports 22 (SSH), 80 (HTTP), 443 (HTTPS), 123 (NTP), and 5353 (mDNS). Therefore, the server is listening for SSH, HTTP, HTTPS, NTP, and mDNS services.

Option D correctly lists all these services.

Exam trap

The trap here is that candidates may overlook the UDP listening sockets (especially port 5353 for mDNS) or misidentify port 123 (NTP) as something else, leading them to select an incomplete list of services.

How to eliminate wrong answers

Option A is wrong because it omits HTTP, HTTPS, NTP, and mDNS, and incorrectly states the server only runs SSH and DNS. Option B is wrong because it omits DNS, HTTP, HTTPS, and mDNS, and incorrectly states the server only runs SSH and NTP. Option C is wrong because it omits DNS, HTTPS, NTP, and mDNS, and incorrectly states the server only runs SSH and HTTP.

Full explanation →

Matchingmedium

Match each SELinux context component to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

SELinux user identity

Role-based access control component

Type enforcement (most common)

Multi-Level Security sensitivity level

Combined sensitivity and category set

Why these pairings

In SELinux, the context format is user:role:type:level. User identifies the SELinux user, role defines accessible roles, type defines domain/object type, and level defines sensitivity/categories. Common confusions include swapping user/role or role/type.

Full explanation →

Multi-Selectmedium

Which three options are valid ways to install a package 'curl' on a RHEL 8 system? (Choose three.)

Select 3 answers

A.`apt-get install curl`

B.`dnf install curl`

C.`rpm -i curl.rpm`

D.`yum install curl`

E.`zypper install curl`

AnswersB, C, D

Dnf is the default package manager on RHEL 8.

Why this answer

`dnf` is the default package manager on RHEL 8, replacing `yum` for handling RPM packages with automatic dependency resolution. It directly installs the `curl` package from configured repositories.

Exam trap

The trap here is that candidates may think `yum` is obsolete on RHEL 8, but it still works as a compatibility wrapper, while `apt-get` and `zypper` are clearly from different distributions, and `rpm -i` requires a local file, not a package name.

Full explanation →

Multi-Selectmedium

Which TWO commands can be used to display the contents of a compressed text file (e.g., .gz, .bz2) directly to standard output without decompressing to disk?

Select 2 answers

A.gzcat

B.zless

C.bzcat

D.lzcat

E.zcat

AnswersC, E

bzcat decompresses .bz2 files to stdout.

Why this answer

(bzcat) is correct because it reads bzip2-compressed files (.bz2) and decompresses them directly to standard output without creating a decompressed file on disk. Option E (zcat) is correct because it does the same for gzip-compressed files (.gz), acting as a front-end to gzip -dc.

Exam trap

The trap here is that candidates may confuse zcat with gzcat (which is not standard) or think zless is equivalent to zcat, when in fact zless is a pager that does not output continuously to stdout.

Full explanation →

Matchingmedium

Match each Linux runlevel to its typical description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Halt

Single-user mode

Multi-user with networking

Multi-user with GUI

Reboot

Why these pairings

Standard SysV init runlevels: 0 (halt), 1 (single-user), 3 (multi-user with network), 5 (graphical multi-user), 6 (reboot). Common confusions involve swapping definitions between runlevels 3 and 5.

Full explanation →

Drag & Dropmedium

Order the steps to add a new user to the system and grant sudo privileges.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

User creation uses useradd, then password is set, and adding to sudo group grants privileges.

Full explanation →

MCQhard

An organization uses a custom YUM repository. After adding a new RPM package to the repository, clients running 'yum update' do not see the new package. The repository metadata was regenerated using 'createrepo'. What is the most likely reason the clients are not seeing the update?

A.Clients have cached metadata and need to run 'yum clean all' or wait for cache expiration

B.The 'gpgcheck=1' option in the repo file prevents metadata download

C.The repository metadata was not signed with a GPG key

D.The RPM package version number is lower than the currently installed version

AnswerA

Yum caches repomd.xml; a fresh 'yum makecache' is needed.

Why this answer

YUM clients cache repository metadata locally to improve performance. When a new package is added to a repository and 'createrepo' regenerates the metadata, clients will not see the update until they refresh their cached metadata. Running 'yum clean all' removes the cached metadata and forces a fresh download, or the cache will expire based on the 'metadata_expire' setting in the repo configuration (default is 6 hours).

Exam trap

The trap here is that candidates may think GPG signing or version numbers are the cause, but the real issue is that YUM's metadata caching prevents clients from immediately seeing repository changes without a cache refresh.

How to eliminate wrong answers

Option B is wrong because 'gpgcheck=1' only enables GPG signature verification on packages after they are downloaded, it does not prevent metadata download or repository access. Option C is wrong because repository metadata does not need to be signed with a GPG key for clients to download and use it; GPG signing of metadata is optional and not required for 'yum update' to see new packages. Option D is wrong because if the RPM package version number is lower than the currently installed version, YUM would simply not upgrade it, but the client would still see the package in the repository listing; the question states clients do not see the new package at all, indicating a metadata freshness issue, not a version comparison.

Full explanation →

MCQmedium

After a reboot, a server fails to obtain an IP address on its sole ethernet interface. The administrator checks /etc/netplan/01-netcfg.yaml and finds the configuration looks correct. However, the interface shows no IP. The system uses systemd-networkd. Which command should be run next to apply the configuration and bring up the interface?

A.netplan apply

B.ifup eth0

C.systemctl restart networking

D.systemctl restart systemd-networkd

AnswerA

netplan apply ensures the YAML config is parsed and applied to systemd-networkd.

Why this answer

The correct command is 'netplan apply' because the system uses netplan to manage network configuration, which generates backend configuration files for systemd-networkd. After editing the YAML file, 'netplan apply' parses the configuration, applies it to the running system, and triggers systemd-networkd to reconfigure the interface without requiring a full restart of the service.

Exam trap

The trap here is that candidates assume 'systemctl restart systemd-networkd' is sufficient, but without running 'netplan apply' first, the backend configuration files are not regenerated from the YAML, so the interface remains unconfigured.

How to eliminate wrong answers

Option B is wrong because 'ifup eth0' is a legacy tool from the ifupdown suite (used with /etc/network/interfaces) and does not interact with netplan or systemd-networkd; it would fail or be ignored on a system using netplan. Option C is wrong because 'systemctl restart networking' targets the legacy 'networking' service (ifupdown), which is not used when systemd-networkd is the backend; it may not be installed or enabled, and restarting it would not apply netplan YAML changes. Option D is wrong because 'systemctl restart systemd-networkd' would restart the service but would not cause netplan to regenerate the backend configuration files; the interface would still use the old or no configuration unless 'netplan apply' is run first to write the new .network files.

Full explanation →

MCQeasy

Refer to the exhibit. An administrator wants to unset the BASH_ALIASES associative array. Which command will correctly remove it?

A.export -n BASH_ALIASES

B.unset -v BASH_ALIASES

C.delete BASH_ALIASES

D.unset BASH_ALIASES

AnswerD

Correctly unsets the variable or array.

Why this answer

`unset` is the standard Bash built-in command to destroy a variable or function. For an associative array like BASH_ALIASES, `unset BASH_ALIASES` removes the entire array, including all its key-value pairs, from the current shell environment.

Exam trap

The trap here is that candidates may confuse `unset` with `export -n` or think a special flag like `-v` is required, when in fact `unset` alone is the correct and simplest way to remove any variable, including associative arrays.

How to eliminate wrong answers

Option A is wrong because `export -n` removes the export attribute from a variable but does not unset or delete the variable itself; the variable remains in the shell with its value intact. Option B is wrong because `unset -v` is valid for unsetting a variable, but the `-v` flag is unnecessary and not required for associative arrays; the plain `unset` command already handles variables correctly, and adding `-v` does not change behavior but is not the standard form for this task. Option C is wrong because `delete` is not a valid Bash built-in command; it is a common misconception from other shells or programming languages, and Bash has no `delete` command.

Full explanation →

MCQhard

Refer to the exhibit. The system has multiple SAS drives attached to this controller, but one of them is not detected during boot. Which command is most likely to provide information about the device detection order?

A.cat /proc/scsi/scsi

B.lsblk

C.dmesg | grep -i scsi

D.lsscsi

AnswerC

dmesg displays kernel messages with timestamps, revealing the order of SCSI device detection.

Why this answer

The `dmesg` command displays kernel ring buffer messages, which include hardware detection and initialization logs during boot. By piping to `grep -i scsi`, you filter for SCSI-related messages, revealing the order in which devices were discovered and any errors for undetected drives. This is the most direct way to see why a specific SAS drive failed to appear.

Exam trap

The trap here is that candidates often pick `lsscsi` or `cat /proc/scsi/scsi` because they show SCSI devices, but they fail to realize those commands only show the final state, not the boot-time detection order or failure messages that `dmesg` provides.

How to eliminate wrong answers

Option A is wrong because `cat /proc/scsi/scsi` shows a static list of currently detected SCSI devices, not the boot-time detection order or failure details. Option B is wrong because `lsblk` lists block devices that are already recognized by the kernel, providing no information about the detection sequence or why a drive was missed. Option D is wrong because `lsscsi` displays a snapshot of SCSI devices currently visible to the system, similar to `/proc/scsi/scsi`, and does not reveal the boot-time probe order or errors.

Full explanation →

MCQmedium

Which configuration file is the primary configuration file for logrotate?

A./var/log/messages

B./etc/logrotate.d/

C./etc/logrotate.conf

D./etc/rsyslog.conf

AnswerC

The main configuration file for logrotate.

Why this answer

The primary configuration file for logrotate is /etc/logrotate.conf. This file sets global options such as rotation frequency, compression, and the number of rotated logs to keep. It also includes configuration snippets from /etc/logrotate.d/ via an include directive, but the main control file is /etc/logrotate.conf.

Exam trap

The trap here is that candidates confuse the directory /etc/logrotate.d/ (which holds supplementary configs) with the primary configuration file /etc/logrotate.conf, or mistake /etc/rsyslog.conf (a logging daemon config) for logrotate's config.

How to eliminate wrong answers

Option A is wrong because /var/log/messages is a system log file managed by rsyslog or syslog-ng, not a configuration file for logrotate. Option B is wrong because /etc/logrotate.d/ is a directory containing per-service configuration snippets that are included by /etc/logrotate.conf, not the primary configuration file itself. Option D is wrong because /etc/rsyslog.conf is the configuration file for the rsyslog daemon, which handles system logging, not log rotation.

Full explanation →

Multi-Selectmedium

Which TWO of the following are valid methods to view kernel messages on a systemd-based system?

Select 2 answers

A.lsmod

B.journalctl -k

C.cat /var/log/syslog

D.grub-mkconfig

E.dmesg

AnswersB, E

Shows kernel messages from the systemd journal for the current boot.

Why this answer

On systemd-based systems, the `journalctl -k` command displays kernel messages from the systemd journal, which is the default logging system. The `-k` flag specifically filters for kernel messages, making it a direct and valid method to view kernel logs.

Exam trap

The trap here is that candidates may think `dmesg` is the only valid method for kernel messages, overlooking that `journalctl -k` is equally valid on systemd-based systems, or they may confuse `lsmod` with kernel message viewing due to its association with kernel information.

Full explanation →

Multi-Selectmedium

Which TWO commands can be used to set the default boot target (runlevel) in systemd?

Select 2 answers

A.ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target

B.systemctl isolate multi-user.target

C.systemctl default multi-user.target

D.systemctl enable multi-user.target

E.systemctl set-default multi-user.target

AnswersA, E

Manually creates the symlink for default target.

Why this answer

Creating a symbolic link from `/lib/systemd/system/multi-user.target` to `/etc/systemd/system/default.target` directly sets the default boot target in systemd. This is the traditional method that overrides the default target by pointing the `default.target` symlink to the desired target unit, which systemd reads at boot to determine the runlevel.

Exam trap

The trap here is that candidates confuse `systemctl isolate` (which changes the current runlevel immediately) with `systemctl set-default` (which sets the persistent default), or they mistakenly think `systemctl enable` sets the default target when it only enables a unit for automatic startup.

Full explanation →

MCQhard

A script uses a while loop to read lines from a file, but a variable set inside the loop is empty after the loop finishes. What is the most likely cause?

A.The file has an empty line at the end.

B.The variable is declared as readonly.

C.The variable name contains spaces.

D.The while loop is part of a pipeline, causing it to run in a subshell.

AnswerD

Pipeline subshells isolate variable changes.

Why this answer

When a while loop is part of a pipeline (e.g., `while read line; do ... done < file | command` or `command | while read line; do ... done`), each command in the pipeline runs in its own subshell. Variables set inside the subshell are not propagated back to the parent shell, so they appear empty after the loop finishes. This is a common pitfall in shell scripting.

Exam trap

The trap here is that candidates often overlook the subshell behavior of pipelines and incorrectly attribute the issue to file content or variable declaration errors, rather than recognizing that the pipeline creates a separate shell environment.

How to eliminate wrong answers

Option A is wrong because an empty line at the end of a file does not cause variables set inside a while loop to become empty after the loop; it may affect the loop's iteration count but not variable scope. Option B is wrong because a readonly variable would cause an error when trying to assign to it, not silently become empty after the loop. Option C is wrong because variable names with spaces are syntactically invalid in shell scripts and would cause a syntax error, not a post-loop empty value.

Full explanation →

Multi-Selecthard

An administrator needs to monitor real-time network bandwidth usage on a Linux server. Which two tools are specifically designed for this purpose? (Choose two.)

Select 2 answers

A.netstat

B.nload

C.traceroute

D.ping

E.iftop

AnswersB, E

Displays incoming and outgoing traffic graphs.

Why this answer

B (nload) is correct because it is a command-line tool that displays real-time network traffic and bandwidth usage on a per-interface basis, showing incoming and outgoing data rates with a dynamic graph. E (iftop) is correct because it listens to network traffic on a specified interface and displays a real-time table of bandwidth usage per connection, similar to top for processes. Both tools are specifically designed for monitoring live bandwidth consumption, unlike general networking utilities.

Exam trap

The trap here is that candidates often confuse netstat's interface statistics (e.g., -i option) with real-time monitoring, but netstat only provides cumulative byte/packet counts since boot, not live bandwidth rates, making it unsuitable for real-time bandwidth monitoring.

Full explanation →

MCQeasy

Which directory in the Filesystem Hierarchy Standard (FHS) contains essential user command binaries that are needed in single-user mode?

A./tmp

B./sbin

C./bin

D./boot

AnswerC

Correct: essential user binaries.

Why this answer

The /bin directory contains essential user command binaries (e.g., ls, cp, mv) that are required for system booting and repair in single-user mode. According to the FHS, /bin is intended for commands needed by both the system administrator and users when no other filesystems are mounted, making it critical for single-user mode operations.

Exam trap

The trap here is that candidates confuse /sbin with /bin, assuming that system administration binaries are the essential ones for single-user mode, when in fact /bin provides the user-level commands needed for basic system interaction and recovery.

How to eliminate wrong answers

Option A is wrong because /tmp is a temporary directory for files that may be deleted on reboot, not for essential command binaries. Option B is wrong because /sbin contains system administration binaries (e.g., fdisk, init) intended for the root user, not essential user commands needed in single-user mode. Option D is wrong because /boot contains static boot loader files (e.g., kernel images, initramfs) and not user command binaries.

Full explanation →

MCQeasy

A system administrator runs the command `fdisk -l` and sees the following line: Disk /dev/sda: 1000 GB, 1000204886016 bytes, 1953525168 sectors Based on this output, which statement is true?

A.The disk has write protection enabled

B.The disk has 5 partitions

C.The disk is 1 TB

D.The disk uses GPT partitioning

AnswerC

The log explicitly states 1.00 TB.

Why this answer

The output from `fdisk -l` shows the total disk size as 1000 GB, which is 1 TB. Thus, option C is correct. The output does not provide information about write protection, partition count, or partition table type.

Exam trap

The trap here is that candidates might assume the disk has a specific partition table type (like GPT) or partition count based on common defaults, but the output only provides disk size and geometry, not partition details, leading to overinterpretation of the data.

How to eliminate wrong answers

Option A is wrong because write protection is typically indicated by a read-only flag or specific error messages (e.g., 'Read-only file system'), not by the disk size or partition table type shown in the exhibit. Option B is wrong because the exhibit does not list any partitions; it only shows the disk size, so claiming 5 partitions is unsupported by the evidence. Option D is wrong because GPT partitioning is identified by a protective MBR or a 'gpt' label in partition table output, and the exhibit does not provide any partition table information to confirm GPT usage.

Full explanation →

MCQeasy

A system administrator wants to display all lines in /var/log/syslog that do NOT contain the string 'error'. Which command accomplishes this?

A.grep -v 'error' /var/log/syslog

B.grep -r 'error' /var/log/syslog

C.grep -l 'error' /var/log/syslog

D.grep -i 'error' /var/log/syslog

AnswerA

Inverts match, showing only lines without 'error'.

Why this answer

The `grep -v` option inverts the match, displaying only lines that do NOT contain the pattern. Therefore, `grep -v 'error' /var/log/syslog` outputs all lines from the file that lack the string 'error', which directly fulfills the requirement.

Exam trap

The trap here is that candidates often confuse `-v` (invert match) with `-i` (case-insensitive) or `-r` (recursive), leading them to select options that still show matching lines instead of excluding them.

How to eliminate wrong answers

Option B is wrong because `-r` enables recursive search through directories, not line inversion; it would search for lines containing 'error' in the file and any subdirectories, which is not the intended behavior. Option C is wrong because `-l` lists only filenames (not lines) that contain the pattern, so it would output the filename if 'error' is found anywhere, not the lines without 'error'. Option D is wrong because `-i` performs case-insensitive matching, still showing lines that contain 'error' (or 'Error', 'ERROR', etc.), which is the opposite of what is asked.

Full explanation →

MCQeasy

A junior admin is tasked with configuring network bonding on a Debian server with two Ethernet interfaces, eth0 and eth1. The goal is to provide link redundancy using active-backup mode. The admin edits /etc/network/interfaces and adds configuration for bond0 with slaves eth0 eth1, then runs 'ifup bond0'. However, the bond interface fails to come up and the error message indicates that the 'bond' kernel module is not loaded. The admin checks with 'lsmod | grep bonding' and finds no output. Which additional step is required to successfully bring up the bond interface? Options: A) Run 'modprobe bonding' before ifup, B) Use ifenslave directly after ifup, C) Reboot the system to load the module, D) Add 'auto bond0' in /etc/network/interfaces.

A.Run 'modprobe bonding' before ifup

B.Use ifenslave directly after ifup

C.Reboot the system to load the module

D.Add 'auto bond0' in /etc/network/interfaces

AnswerA

Loads the bonding kernel module, enabling bond interface creation.

Why this answer

The 'bond' kernel module must be loaded before the bonding interface can be created. Running 'modprobe bonding' loads the module into the kernel, making the bonding functionality available. Without this step, 'ifup bond0' fails because the kernel does not recognize the bonding driver.

Exam trap

The trap here is that candidates may think adding 'auto bond0' or rebooting will solve the module loading issue, but the kernel module must be explicitly loaded before the bonding interface can be created.

How to eliminate wrong answers

Option B is wrong because adding 'auto bond0' only configures the interface to start automatically at boot, but does not load the kernel module; the module must be loaded first. Option C is wrong because 'ifenslave' is a tool to attach slaves to an already existing bond interface, but the bond interface itself cannot be created without the bonding module. Option D is wrong because rebooting is unnecessary and inefficient; the module can be loaded dynamically with 'modprobe' without a reboot.

Full explanation →

100

Drag & Dropmedium

Order the steps to configure a Linux system to use a proxy server for HTTP.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Proxy configuration involves setting environment variables and application-specific configs.

Full explanation →

101

Multi-Selecteasy

Which TWO commands are used to manage Debian packages? (Choose two.)

Select 2 answers

A.zypper

B.apt-get

C.dpkg

D.yum

E.rpm

AnswersB, C

apt-get manages .deb packages via repositories.

Why this answer

apt-get is the primary command-line tool for handling Debian packages, handling dependency resolution and retrieval from repositories. dpkg is the low-level tool that directly installs, removes, and queries .deb package files without automatic dependency management. Both are essential for Debian-based package management.

Exam trap

The trap here is that candidates often confuse low-level package tools (dpkg, rpm) with high-level ones (apt-get, yum, zypper), or incorrectly associate a tool with the wrong distribution family, especially when multiple package managers are listed.

Full explanation →

102

MCQhard

A database server with high I/O requirements needs a filesystem layout optimized for performance. The server has four identical 500GB SSDs. Which design best balances performance and reliability, considering the need to separate transaction logs from data files?

A.Use all four SSDs in RAID 10.

B.Use two SSDs in RAID 1 for logs and two in RAID 1 for data.

C.Combine all four SSDs into a single RAID 0 volume, then partition for data and logs.

D.Use one SSD for transaction logs and the other three in RAID 0 for data files.

AnswerD

Separates logs from data for performance; RAID 0 maximizes data throughput, logs benefit from dedicated device.

Why this answer

It isolates transaction logs on a dedicated SSD to eliminate write contention with data files, while the remaining three SSDs in RAID 0 maximize sequential throughput for data. This design prioritizes performance for high-I/O workloads, accepting the reliability trade-off of RAID 0 for data, which is acceptable when logs (critical for recovery) are on a separate, non-striped device.

Exam trap

LPI often tests the misconception that RAID 10 is always the best balance of performance and reliability, but in this scenario, the need to physically separate logs from data and maximize throughput for high-I/O workloads makes a dedicated log device with RAID 0 for data the optimal performance choice, despite reduced redundancy.

How to eliminate wrong answers

Option A is wrong because RAID 10 (mirroring + striping) across all four SSDs provides redundancy but introduces write overhead from mirroring, which can reduce write performance for high-I/O transaction logs, and it does not physically separate logs from data, leading to contention. Option B is wrong because using two separate RAID 1 pairs isolates logs and data but wastes half the total capacity (only 1TB usable out of 2TB) and does not leverage striping for data throughput, which is suboptimal for high-I/O data files. Option C is wrong because a single RAID 0 volume across all four SSDs offers maximum capacity and speed but provides zero fault tolerance; a single drive failure destroys both logs and data, violating the reliability requirement, and it does not separate logs from data, causing contention.

Full explanation →

103

MCQeasy

Refer to the exhibit. Which file system is full and what is the likely consequence if the administrator does not take action?

A.Both are full; system will crash.

B./dev/sda1 is full; system may become unstable.

C.Neither is full; available space is sufficient.

D./dev/sdb1 is full; applications writing to /var may fail.

AnswerD

The mount point /var is at 100% usage.

Why this answer

The exhibit shows that /dev/sdb1, mounted on /var, has 0% available space (100% used). The /var directory stores variable data such as logs, spool files, and temporary files. If /var fills up, critical services like syslog, cron, or package managers (e.g., apt, yum) cannot write to their log or spool files, causing applications that depend on /var to fail.

This is why option D is correct.

Exam trap

LPI often tests the misconception that a full root filesystem (/dev/sda1) is the only critical issue, but the trap here is that /var (often a separate partition) can fill up silently, causing application failures without an immediate system crash.

How to eliminate wrong answers

Option A is wrong because only /dev/sdb1 is full; /dev/sda1 has available space, so the system will not crash outright, but services relying on /var may fail. Option B is wrong because /dev/sda1 is not full; it has 20% used and 80% available, so the system will not become unstable from that mount point. Option C is wrong because /dev/sdb1 is indeed full (100% used), so available space is not sufficient for /var.

Full explanation →

104

MCQhard

You are a system administrator at a hosting company. A customer reports that their website hosted on a shared LAMP server is returning error 500. The server runs Ubuntu 22.04 with Apache, MySQL, and PHP. You log in and find that the /var partition (on /dev/sda3, ext4) is almost full. You identify that the MySQL database directory /var/lib/mysql contains several large binary logs that are no longer needed. You delete the binary logs using 'rm -f /var/lib/mysql/mysql-bin.*'. However, the available space does not increase. You also notice that an inode leak is suspected. You check inode usage with 'df -i' and see that the partition has plenty of free inodes. You then check with 'lsof | grep deleted' and see several entries for mysqld holding deleted files. What is the correct procedure to free the space?

A.Restart the MySQL service with 'systemctl restart mysql'.

B.Use 'dpkg --purge mysql-server' to completely remove MySQL, then reinstall it.

C.Run 'e2fsck -f /dev/sda3' to reclaim inodes and fix filesystem inconsistencies.

D.Move the binary logs to a different partition using 'mv /var/lib/mysql/mysql-bin.* /tmp/' and then delete them.

AnswerA

Restarting MySQL closes all open file handles, allowing the kernel to release the disk space occupied by deleted files.

Why this answer

When a file is deleted while a process (like mysqld) still holds an open file descriptor to it, the file's inode remains allocated and the disk space is not freed until the process releases the descriptor. Restarting the MySQL service (systemctl restart mysql) causes mysqld to close all open file descriptors, allowing the kernel to release the deleted binary logs' inodes and reclaim the disk space.

Exam trap

The trap here is that candidates assume deleting a file immediately frees disk space, overlooking that processes with open file descriptors prevent the kernel from releasing the inode and data blocks until the descriptor is closed.

How to eliminate wrong answers

Option B is wrong because completely purging and reinstalling MySQL is an unnecessarily destructive and time-consuming procedure; the issue is simply that the MySQL process holds open file descriptors to the deleted logs, not a problem with the MySQL installation itself. Option C is wrong because e2fsck checks and repairs filesystem metadata, but it does not force processes to release open file descriptors; the inodes are already marked as deleted but are still held open by mysqld, so e2fsck cannot reclaim them. Option D is wrong because moving the files to /tmp/ and then deleting them would still leave the MySQL process holding open file descriptors to the moved (and then deleted) files, resulting in the same space-not-freed problem; the core issue is the open file descriptor, not the file's location.

Full explanation →

105

MCQmedium

Refer to the exhibit. When will the backup script run?

A.Daily at 4:30 AM

B.Monthly at 4:30 AM on the 1st

C.Yearly at 4:30 AM

D.Weekly at 4:30 AM

AnswerB

The '1' in the day-of-month field indicates the first day of each month.

Why this answer

The cron entry `30 4 1 * * /usr/local/bin/backup.sh` specifies that the script runs when the minute is 30, hour is 4, and day-of-month is 1, with the month and day-of-week fields set to `*` (meaning every month and every day of the week). This results in execution at 4:30 AM on the 1st day of every month, making option B correct.

Exam trap

LPI often tests the misconception that a `*` in the day-of-week field implies 'every day' but candidates forget that the day-of-month field of `1` restricts execution to only the 1st, not daily.

How to eliminate wrong answers

Option A is wrong because 'Daily at 4:30 AM' would require the day-of-month field to be `*` (or a day-of-week field set to `*` with no day-of-month restriction), but here the day-of-month is `1`, limiting execution to only the 1st of each month. Option C is wrong because 'Yearly at 4:30 AM' would typically use a specific month field (e.g., `30 4 1 1 *` for January 1st), but the month field is `*`, meaning every month, not just one month per year. Option D is wrong because 'Weekly at 4:30 AM' would require a specific day-of-week value (e.g., `30 4 * * 0` for Sunday), but the day-of-week field is `*` and the day-of-month is `1`, which does not guarantee a weekly schedule.

Full explanation →

106

MCQmedium

A log file access.log contains multiple entries per IP address. An administrator wants to display a list of unique IP addresses sorted by frequency (most frequent first). Which command pipeline achieves this?

A.awk '{print $1}' access.log | sort | uniq | sort -rn

B.awk '{print $1}' access.log | sort | uniq -c | sort -rn

C.awk '{print $1}' access.log | sort -rn | uniq -c

D.awk '{print $1}' access.log | sort | uniq -c | sort -k2

AnswerB

Correctly counts IP occurrences and sorts by frequency descending.

Why this answer

It extracts the first field (IP address) with awk, sorts them to group identical IPs, counts occurrences with uniq -c, and then sorts numerically in reverse order with sort -rn to display the most frequent IPs first. The -c flag prepends a count to each unique line, and sort -rn sorts by that count descending.

Exam trap

The trap here is that candidates often forget uniq -c outputs the count in the first column, so they mistakenly use sort -k2 to sort by frequency, or they omit the initial sort before uniq, causing incorrect counts for non-consecutive duplicates.

How to eliminate wrong answers

Option A is wrong because uniq without -c only removes duplicates, not counting them, and sort -rn then sorts the IPs themselves in reverse numeric order, not by frequency. Option C is wrong because sort -rn before uniq -c sorts IPs numerically descending, which is meaningless for IP addresses, and uniq -c then counts consecutive duplicates only, missing non-consecutive duplicates. Option D is wrong because sort -k2 sorts by the second field, but uniq -c outputs the count as the first field, so sort -k2 sorts by the IP address (second field) instead of by frequency.

Full explanation →

107

MCQeasy

A technician runs 'blkid' and sees output like '/dev/sda2: UUID="abc-def-ghi" TYPE="ext4"'. Which command can mount this partition using its UUID?

A.mount -U "abc-def-ghi" /mnt

B.mount -I "abc-def-ghi" /mnt

C.mount /dev/sda2 /mnt

D.mount -L "abc-def-ghi" /mnt

AnswerA

mount -U mounts by UUID.

Why this answer

The 'mount' command supports the '-U' option to specify a partition by its UUID, which is a unique identifier for the filesystem. This allows mounting without relying on device names like /dev/sda2, which can change across reboots. The UUID is taken directly from the 'blkid' output.

Exam trap

The trap here is that candidates may confuse the '-U' (UUID) option with the '-L' (label) option, or assume that any option that accepts a string can mount by UUID, leading them to select the incorrect '-L' or '-I' flags.

How to eliminate wrong answers

Option B is wrong because '-I' is not a valid option for the mount command; it is used with 'lsblk' to specify a device by major:minor number, not for mounting. Option C is wrong because while it would work in this specific case, it uses the device path /dev/sda2 instead of the UUID, which is not the command requested by the question (the question asks for a command that mounts using the UUID). Option D is wrong because '-L' is used to mount by filesystem label, not by UUID; the label is a human-readable name, while the UUID is a unique hexadecimal string.

Full explanation →

108

MCQmedium

After receiving a compressed tarball archive.tar.gz from a colleague, you want to list its contents without extracting. Which command should you use?

A.tar -xzf archive.tar.gz

B.tar -cvf archive.tar.gz

C.gzip -d archive.tar.gz | tar -t

D.tar -tvf archive.tar.gz

AnswerD

-t lists the contents of the archive without extracting.

Why this answer

The `tar -tvf archive.tar.gz` command lists the contents of a compressed tarball without extracting it. The `-t` option tells tar to list the archive's table of contents, `-v` provides verbose output (showing file permissions, ownership, etc.), and `-f` specifies the archive file. Tar automatically detects and decompresses the gzip compression when reading the file, so no separate decompression step is needed.

Exam trap

The trap here is that candidates confuse the `-x` (extract) flag with `-t` (list) because both are used for reading archives, but only `-t` lists without extracting; LPI often tests this by offering `-xzf` as a distractor, assuming candidates will misremember the flag for listing.

How to eliminate wrong answers

Option A is wrong because `tar -xzf archive.tar.gz` extracts the archive (the `-x` flag means extract), not lists its contents. Option B is wrong because `tar -cvf archive.tar.gz` creates a new archive (the `-c` flag means create) from files, which would overwrite the existing file or fail, and does not list contents. Option C is wrong because `gzip -d archive.tar.gz | tar -t` attempts to decompress the file and pipe the output to `tar -t`, but `gzip -d` without `-c` (or `--stdout`) writes the decompressed data to a file (removing the .gz extension) instead of sending it to stdout, so the pipe receives no data and tar fails; even if corrected with `gzip -dc`, it is unnecessarily complex since tar handles decompression natively.

Full explanation →

109

MCQmedium

A user complains that a filesystem is reporting 'Disk quota exceeded' even though the user has not stored any new files recently. What could be the cause?

A.Symlinks are counted against the quota

B.Hard links are consuming additional inodes

C.The user has exceeded the inode quota

D.File ownership is misconfigured

AnswerC

Inode quota limits the number of files, not just disk space.

Why this answer

Linux filesystems enforce two types of quotas: block quotas (for disk space) and inode quotas (for the number of files and directories). If the user has not stored new files recently but still receives a 'Disk quota exceeded' error, it is likely that they have exceeded their inode quota, meaning they have created too many files or directories (each consuming an inode), even if those files are small or empty. The error message is generic and can refer to either quota type, so the inode limit is the probable cause when no recent data writes have occurred.

Exam trap

The trap here is that candidates assume 'Disk quota exceeded' always refers to disk space (blocks), but LPIC-1 tests the distinction between block quotas and inode quotas, and that the same error message applies to both.

How to eliminate wrong answers

Option A is wrong because symlinks (symbolic links) are not counted against the quota of the user who owns the symlink; they are separate files that point to another file and do not consume the target's quota. Option B is wrong because hard links do not consume additional inodes; they are additional directory entries pointing to the same inode, so the inode count remains unchanged for the user. Option D is wrong because misconfigured file ownership would cause permission errors (e.g., 'Permission denied'), not a 'Disk quota exceeded' error, which is specifically a quota enforcement mechanism.

Full explanation →

110

MCQhard

A DevOps engineer is setting up an automated build pipeline for a Python application on a Debian system. The application must be packaged into a .deb for deployment. The engineer writes a Makefile that creates the package but the final 'dpkg -i' step fails due to unmet dependencies: the application requires python3-requests >= 2.0, but the repositories provide 1.0. The team has a local mirror with custom packages including python3-requests 2.0. The mirror is correctly listed in /etc/apt/sources.list. The engineer runs 'apt-get update' before building, but the dependency resolution still fails. What is the most likely cause?

A.The engineer must set the --force-depends option to skip dependency checks.

B.The .deb package should be installed using 'apt install ./package.deb' instead of 'dpkg -i'.

C.The 'apt-get update' command did not run successfully; the engineer should check the output.

D.The python3-requests 2.0 package has not been correctly built or uploaded to the local mirror.

AnswerB

apt automatically resolves and installs dependencies from repositories.

Why this answer

`dpkg -i` does not resolve dependencies from repositories; it only installs the local .deb file and checks dependencies against the local dpkg database. Using `apt install ./package.deb` leverages APT's dependency resolution, which will fetch `python3-requests 2.0` from the local mirror after `apt-get update` has refreshed the package index. This ensures unmet dependencies are automatically satisfied from the configured sources.

Exam trap

The trap here is that candidates assume `dpkg -i` will automatically resolve dependencies from repositories, but LPIC-1 tests the distinction that `dpkg` is a low-level tool with no network or repository awareness, while `apt` handles dependency resolution from configured sources.

How to eliminate wrong answers

Option A is wrong because `--force-depends` bypasses dependency checks entirely, which would allow installation but leave the system with broken dependencies, not resolve them. Option C is wrong because the question states the mirror is correctly listed and `apt-get update` is run before building; if it had failed, the engineer would likely see errors, and the issue is specifically about dependency resolution, not index freshness. Option D is wrong because the mirror is correctly listed and `apt-get update` ran, so the package is assumed present; the failure is due to using `dpkg -i` which does not consult the mirror at all.

Full explanation →

111

MCQhard

A system is running out of disk space on /var. The administrator finds that /var/log/syslog is 4GB. Which of the following is the best course of action to prevent future issues while keeping recent logs?

A.Use 'truncate -s 0 /var/log/syslog' to empty the file.

B.Configure logrotate to rotate and compress logs daily.

C.Configure syslog to stop logging.

D.Delete /var/log/syslog and create an empty file.

AnswerB

Correct: logrotate manages log sizes.

Why this answer

Logrotate is the standard Linux utility for managing log file growth. By configuring it to rotate and compress logs daily, the administrator can automatically archive old logs (e.g., /var/log/syslog.1.gz) and keep only recent entries in the active file, preventing disk space exhaustion without losing historical data.

Exam trap

The trap here is that candidates confuse immediate space recovery (truncation/deletion) with sustainable log management, overlooking that logrotate provides automated, policy-driven rotation and compression to prevent recurrence.

How to eliminate wrong answers

Option A is wrong because truncating the file to zero bytes only frees space immediately but does not prevent the file from growing again; it also discards all existing logs, which may violate compliance or troubleshooting needs. Option C is wrong because stopping syslog entirely would halt all system logging, losing critical diagnostic information and potentially violating security auditing requirements. Option D is wrong because deleting and recreating the file is functionally similar to truncation—it frees space now but offers no automated rotation or compression, so the problem will recur.

Full explanation →

112

MCQeasy

On a Debian-based system using ifupdown, which file should be edited to configure a static IP address for an interface?

A./etc/systemd/network/50-static.network

B./etc/network/interfaces

C./etc/netplan/01-netcfg.yaml

D./etc/sysconfig/network-scripts/ifcfg-eth0

AnswerB

This is the main configuration file for ifupdown on Debian.

Why this answer

On Debian-based systems using the traditional ifupdown suite, the file `/etc/network/interfaces` is the central configuration file for defining network interfaces, including static IP addresses. This file is parsed by the `ifup` and `ifdown` commands to bring interfaces up or down with the specified settings, such as `address`, `netmask`, and `gateway`.

Exam trap

The trap here is that candidates often confuse the default network configuration file for Debian-based systems with those used by other distributions (Red Hat) or newer abstraction layers (Netplan, systemd-networkd), leading them to pick a file that is technically valid but not used by the ifupdown tool specified in the question.

How to eliminate wrong answers

Option A is wrong because `/etc/systemd/network/50-static.network` is used by `systemd-networkd`, not by the ifupdown suite; Debian systems using ifupdown do not rely on systemd-networkd for interface configuration. Option C is wrong because `/etc/netplan/01-netcfg.yaml` is the configuration file for Netplan, which is used on Ubuntu (and some other distributions) as a frontend for systemd-networkd or NetworkManager, not for the traditional ifupdown system. Option D is wrong because `/etc/sysconfig/network-scripts/ifcfg-eth0` is the configuration file format used by Red Hat-based distributions (e.g., CentOS, Fedora) with the legacy network service, not by Debian-based systems.

Full explanation →

113

MCQmedium

Refer to the exhibit. The system administrator wants to determine which package provides the file /etc/passwd. Based on the output, which command would be most appropriate to find the package?

A.`dpkg -L base-passwd`

B.`apt-file search /etc/passwd`

C.`dpkg -S /etc/passwd`

D.`apt-cache show /etc/passwd`

AnswerC

Searches for the package that owns the file.

Why this answer

`dpkg -S /etc/passwd` queries the dpkg database to find which installed package owns the specified file. This is the standard Debian/Ubuntu command to map an absolute path to its originating package, making it the most appropriate choice for the administrator's goal.

Exam trap

The trap here is that candidates confuse `dpkg -S` (search for file) with `dpkg -L` (list files of a known package), or they incorrectly use `apt-cache` or `apt-file` which operate on repository data rather than the installed package database.

How to eliminate wrong answers

Option A is wrong because `dpkg -L base-passwd` lists all files installed by the `base-passwd` package, but it does not search for which package provides `/etc/passwd`; it assumes the package is already known. Option B is wrong because `apt-file search /etc/passwd` searches the package repository metadata (not the installed package database) for files, which is useful for finding packages that provide a file not yet installed, but the question asks about an installed file. Option D is wrong because `apt-cache show /etc/passwd` is invalid syntax; `apt-cache show` is used to display metadata about a package name, not to search for a file path.

Full explanation →

114

MCQeasy

A system administrator notices that the system time is incorrect by several minutes. Which command should be used first to check the status of NTP synchronization?

A.timedatectl

B.ntpdate

C.date

D.hwclock

AnswerA

timedatectl displays NTP synchronization status and allows detailed checks.

Why this answer

The `timedatectl` command is the correct first step because it shows the current system time, time zone, and NTP synchronization status in a single output. It directly reports whether NTP is active and whether the clock is synchronized, making it the standard diagnostic tool on modern systemd-based Linux distributions.

Exam trap

The trap here is that candidates often confuse `ntpdate` as a diagnostic tool because it can query an NTP server, but it is not designed to show the ongoing synchronization status of the system's NTP service.

How to eliminate wrong answers

Option B is wrong because `ntpdate` is a legacy command used for one-time manual time setting, not for checking synchronization status; it also requires stopping the NTP service first. Option C is wrong because `date` only displays or sets the system time without any NTP status information. Option D is wrong because `hwclock` manages the hardware clock (RTC) and does not show NTP synchronization status.

Full explanation →

115

MCQeasy

An administrator notices that SSH connections to a remote Linux server are timing out. After confirming network connectivity, which command should the administrator run on the server to check whether the SSH daemon is actively listening?

A.ls /etc/ssh/

B.systemctl status sshd

C.nc -zv localhost 22

D.netstat -tuln

AnswerB

This command shows the current status of the sshd service, including whether it is running.

Why this answer

The `systemctl status sshd` command checks the status of the SSH daemon service managed by systemd, directly reporting whether it is active (running) or inactive (stopped). This is the most straightforward way to verify that the SSH daemon is actively listening, as it queries the service manager rather than relying on network-level probing.

Exam trap

The trap here is that candidates often choose `netstat -tuln` (option D) because it shows listening ports, but they overlook that it does not confirm the specific daemon (sshd) is responsible, and the command may be deprecated or unavailable on systems using `ss` instead.

How to eliminate wrong answers

Option A is wrong because `ls /etc/ssh/` lists configuration files (e.g., sshd_config) but does not indicate whether the SSH daemon process is running or listening. Option C is wrong because `nc -zv localhost 22` tests connectivity to port 22 on the loopback interface, which could succeed even if the SSH daemon is not bound to all interfaces or if a firewall is misconfigured; it also requires netcat to be installed. Option D is wrong because `netstat -tuln` shows listening sockets but does not specifically identify the SSH daemon—it could show a different process listening on port 22, and the command may not be installed by default on modern systems (replaced by `ss`).

Full explanation →

116

MCQhard

After connecting a USB device, the system does not create a device node in /dev. Which command can be used to trigger udev to re-evaluate the device?

A.modprobe

B.udevadm control --reload

C.udevadm settle

D.udevadm trigger

AnswerD

This command generates uevents for existing devices, causing udev to process them again.

Why this answer

The correct command is `udevadm trigger`. This command causes udev to re-evaluate all devices by simulating kernel uevents, which forces udev to process rules and create device nodes in /dev for devices that were missed or not properly initialized.

Exam trap

The trap here is confusing `udevadm trigger` with `udevadm control --reload`; candidates often think reloading rules alone will fix missing device nodes, but without re-triggering uevents, udev does not re-evaluate already-connected devices.

How to eliminate wrong answers

Option A is wrong because `modprobe` is used to load or unload kernel modules, not to trigger udev rule processing or device node creation. Option B is wrong because `udevadm control --reload` reloads the udev rules and configuration files but does not re-trigger uevents for existing devices. Option C is wrong because `udevadm settle` waits for the udev event queue to finish processing; it does not initiate new uevents or force device node creation.

Full explanation →

117

MCQmedium

A developer has a directory /home/user/project with many files and subdirectories. They need to change the group ownership of all .txt files to 'developers' and set permissions to 640. Which single command accomplishes this?

A.find /home/user/project -name '*.txt' -exec chgrp developers {} \;

B.chmod -R 640 /home/user/project/*.txt

C.find /home/user/project -name '*.txt' -exec chown :developers {} \; -exec chmod 640 {} \;

D.find /home/user/project -name '*.txt' -exec chmod 640 {} \;

AnswerC

Changes both group and permissions in a single find command.

Why this answer

It uses `find` to locate all `.txt` files under `/home/user/project`, then executes `chown :developers` to change the group ownership to 'developers' (the colon before the group name is the correct syntax for setting only the group), followed by `chmod 640` to set the permissions to read/write for the owner and read for the group. Using `-exec` twice in a single `find` command ensures both operations are applied to each matching file without needing a separate command.

Exam trap

The trap here is that candidates often forget that `chmod` alone cannot change ownership, or they mistakenly think `chown :group` is invalid, leading them to pick an incomplete command like A or D, or they incorrectly assume `chmod -R` with a glob will recurse into subdirectories.

How to eliminate wrong answers

Option A is wrong because it only changes the group ownership to 'developers' but does not set the permissions to 640, leaving the permissions unchanged. Option B is wrong because `chmod -R 640 /home/user/project/*.txt` will fail if the glob `*.txt` expands to no files (or only files in the top directory), and it does not change group ownership; also `-R` is redundant for individual files and does not recurse into subdirectories for the glob pattern. Option D is wrong because it only sets permissions to 640 but does not change the group ownership to 'developers'.

Full explanation →

118

Multi-Selecthard

Which THREE of the following are valid sources to configure GRUB?

Select 3 answers

A./boot/grub/menu.lst

B./etc/grub.conf

C./boot/grub/grub.cfg

D./etc/default/grub

E./etc/grub.d/

AnswersC, D, E

The actual boot configuration file read by GRUB.

Why this answer

C is correct because `/boot/grub/grub.cfg` is the primary configuration file generated by GRUB 2 (the default bootloader on modern Linux distributions). It is automatically created by running `update-grub` or `grub-mkconfig`, which reads settings from `/etc/default/grub` and scripts in `/etc/grub.d/`. This file contains the actual menu entries and boot directives used at boot time.

Exam trap

The trap here is that candidates confuse GRUB Legacy files (`menu.lst` or `grub.conf`) with GRUB 2 files, or think `/etc/grub.conf` is a standard GRUB 2 configuration file, when in fact GRUB 2 uses `/etc/default/grub` and `/etc/grub.d/` as sources, with the generated output in `/boot/grub/grub.cfg`.

Full explanation →

119

Multi-Selectmedium

Which TWO of the following are valid methods to configure network interfaces on a Linux system? (Choose two.)

Select 2 answers

A.Editing /etc/network/interfaces file.

B.Using the 'ifconfig' command.

C.Using the 'ip' command.

D.Using the 'route' command.

E.Editing /etc/sysconfig/network-scripts/ network configuration files.

AnswersA, C

Used by Debian-based systems.

Why this answer

The `/etc/network/interfaces` file is the primary configuration file for network interfaces on Debian-based Linux distributions (e.g., Ubuntu). It allows static or dynamic (DHCP) configuration of interfaces using directives like `iface`, `address`, and `netmask`, and is read by the `ifup` and `ifdown` commands at boot or on demand.

Exam trap

The trap here is that candidates often confuse temporary runtime commands (like `ifconfig` and `route`) with persistent configuration methods, or they assume a distribution-specific path like `/etc/sysconfig/network-scripts/` is universally valid across all Linux systems.

Full explanation →

120

MCQhard

A Linux system fails to boot with the error 'Kernel panic: VFS: Unable to mount root fs on unknown-block(0,0)'. After investigation, the administrator suspects that the root filesystem device is not being detected. Which of the following is the most likely cause?

A.The root filesystem is corrupted

B.The initrd file is missing or corrupted

C.The root= kernel parameter points to a non-existent device

D.The SATA controller driver is not included in the kernel

AnswerC

If the root= parameter specifies a device that does not exist or is not recognized, the kernel fails with this error.

Why this answer

The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate the device specified by the 'root=' kernel parameter. If this parameter points to a non-existent device (e.g., wrong partition number or missing disk), the kernel fails to mount the root filesystem, causing a panic. This is the most direct cause among the options.

Exam trap

The trap here is that candidates often confuse a missing initrd (which handles driver loading) with a root device misconfiguration, but the specific 'unknown-block(0,0)' error directly points to the root= parameter pointing to a device that does not exist, not a driver or initrd issue.

How to eliminate wrong answers

Option A is wrong because a corrupted root filesystem would typically produce a different error (e.g., 'mount: /dev/sda1: can't read superblock') rather than 'unknown-block(0,0)', which indicates the device itself is not found. Option B is wrong because a missing or corrupted initrd would cause a failure to load necessary drivers or modules, but the error here specifically points to the root device not being recognized, not a missing initrd. Option D is wrong because if the SATA controller driver were missing, the kernel would not detect the disk at all, but the error 'unknown-block(0,0)' suggests the kernel is trying to mount a device it cannot find, not that the controller is unsupported; a missing driver would typically result in no block device being created, not a specific unknown-block error.

Full explanation →

121

Multi-Selecthard

Which THREE steps are required to configure a static IP address on a modern Linux system using systemd-networkd?

Select 3 answers

A.Edit /etc/hosts to map IP to hostname

B.Create a .network file in /etc/systemd/network/

C.Edit /etc/resolv.conf to set DNS servers

D.Run 'ip addr add <IP> dev eth0'

E.Run 'systemctl restart systemd-networkd'

AnswersB, C, E

Required for static configuration.

Why this answer

Systemd-networkd uses .network files in /etc/systemd/network/ to define static IP configurations. These files contain sections like [Match] and [Network] to specify the interface and address details, replacing traditional ifcfg scripts or manual ip commands.

Exam trap

The trap here is that candidates confuse temporary commands like 'ip addr add' with persistent configuration, or assume editing /etc/hosts is part of IP assignment, when systemd-networkd requires dedicated .network files and a service restart to apply static IPs permanently.

Full explanation →

122

MCQmedium

Based on the exhibit, which of the following is true about the cleanup.sh job?

A.It runs at 4:30 AM every day

B.It runs at 4:30 AM on Monday through Friday

C.It runs at 4:00 AM on weekdays

D.It runs at 4:30 AM on weekends

AnswerB

Correct interpretation of the cron schedule.

Why this answer

The cron expression `30 4 * * 1-5` specifies that the job runs at minute 30, hour 4 (4:30 AM), every day of month (*), every month (*), but only on days of the week 1 through 5 (Monday=1, Tuesday=2, Wednesday=3, Thursday=4, Friday=5). Therefore, the job runs at 4:30 AM on Monday through Friday.

Exam trap

The trap here is that candidates often misread the minute field (30) as the hour or confuse the day-of-week range `1-5` with 'every day', leading them to select 'every day' or 'weekends' instead of the correct weekday-only schedule.

How to eliminate wrong answers

Option A is wrong because it states 'every day', but the day-of-week field `1-5` restricts execution to weekdays only, not all seven days. Option C is wrong because it specifies 4:00 AM, but the minute field is `30`, not `0`, so the job runs at 4:30 AM, not 4:00 AM. Option D is wrong because it says 'on weekends', but the day-of-week range `1-5` explicitly excludes Saturday (6) and Sunday (0 or 7), so the job does not run on weekends.

Full explanation →

123

MCQmedium

A system administrator notices that the /tmp directory is filling up quickly, causing applications to fail. The administrator wants to ensure that files in /tmp are automatically cleaned after a certain period. Which of the following is the best approach without installing additional software?

A.Add a cron job that runs 'rm -rf /tmp/*' every hour.

B.Install tmpwatch and configure it to clean files older than 1 day.

C.Set the sticky bit on /tmp to automatically delete old files.

D.Configure the systemd-tmpfiles service with a configuration file to clean /tmp regularly.

AnswerD

systemd-tmpfiles is part of systemd and is available by default; it provides a clean mechanism for temporary file management.

Why this answer

Systemd-based Linux distributions include the systemd-tmpfiles service, which can be configured via files in /etc/tmpfiles.d/ to automatically clean temporary files based on age, size, or other criteria. This approach uses built-in systemd functionality without requiring additional software, and it is the recommended method for managing /tmp cleanup on modern systems.

Exam trap

The trap here is that candidates may confuse the sticky bit (which only prevents deletion by other users) with automatic cleanup, or assume that a brute-force cron job is acceptable, while the correct answer leverages a built-in systemd service that is already present on most modern Linux distributions.

How to eliminate wrong answers

Option A is wrong because using 'rm -rf /tmp/*' in a cron job is dangerous and unreliable: it will delete all files regardless of age, may fail on hidden files or subdirectories with special characters, and can cause race conditions or data loss for running applications. Option B is wrong because tmpwatch is not installed by default on most modern distributions and the question explicitly states 'without installing additional software'. Option C is wrong because the sticky bit (chmod +t) only prevents users from deleting files they do not own; it does not automatically delete old files.

Full explanation →

124

MCQmedium

Which command displays all error messages from the systemd journal since the last boot?

A.journalctl -b -p warning

B.journalctl -b -p err

C.journalctl -b -p crit

D.journalctl -b -p info

AnswerB

Correct: shows error messages for current boot.

Why this answer

`journalctl -b -p err` filters the systemd journal to show only messages with a priority level of 'err' (error) or higher since the last boot. The `-b` flag restricts output to the current boot, and `-p err` selects messages at the 'err' level and above (including 'crit', 'alert', and 'emerg'), which are all error-related. This matches the requirement to display 'all error messages' from the systemd journal since the last boot.

Exam trap

The trap here is that candidates may confuse the 'level-or-above' behavior of `-p` and think `-p err` only shows exact 'err' messages, or they may incorrectly assume `-p warning` includes errors, when in fact 'warning' is a lower priority and does not cover all error levels.

How to eliminate wrong answers

Option A is wrong because `-p warning` filters for 'warning' priority messages and above, which includes 'warning' itself but also 'err', 'crit', 'alert', and 'emerg'; however, 'warning' is not an error message—it indicates a potential issue, not an actual error, so it does not display 'all error messages' exclusively. Option C is wrong because `-p crit` filters for 'crit' (critical) priority and above, which is a subset of error messages but excludes 'err' (error) level messages, so it does not display 'all error messages'—it only shows the most severe ones. Option D is wrong because `-p info` filters for 'info' priority and above, which includes informational messages, notices, warnings, and errors; this is too broad and includes non-error messages, failing to display only error messages.

Full explanation →

125

MCQeasy

You are a junior administrator for a company that uses a standard disk image for all Linux servers. The image is based on CentOS 7. You need to ensure that new servers automatically install all available security updates during the first boot. You plan to run a command in a startup script. Which command should you use?

A.yum check-update

B.yum install yum-cron

C.yum update -y

D.apt-get upgrade -y

AnswerC

Updates all packages automatically.

Why this answer

`yum update -y` installs all available updates, including security updates, without prompting for confirmation. On CentOS 7, this command updates all packages to their latest versions, which encompasses security patches. Running this in a startup script ensures that security updates are applied automatically on first boot.

Exam trap

The trap here is that candidates may confuse the command for listing updates (`check-update`) with the command for installing them, or mistakenly apply a Debian-based command (`apt-get`) to a Red Hat-based system like CentOS 7.

How to eliminate wrong answers

Option A is wrong because `yum check-update` only lists available updates without installing any, so it would not apply security updates. Option B is wrong because `yum install yum-cron` installs the yum-cron package, which is used for automatic periodic updates, but does not itself install updates immediately; it requires configuration and is not a one-time command for first boot. Option D is wrong because `apt-get upgrade -y` is a Debian/Ubuntu package manager command, not applicable to CentOS 7 which uses yum (or dnf in later versions).

Full explanation →

126

MCQeasy

Which command lists all installed packages on a Debian-based system by querying the dpkg database?

A.apt-cache search .

B.dpkg -L

C.dpkg --get-selections

D.apt-show-versions

AnswerC

Lists all installed packages.

Why this answer

`dpkg --get-selections` queries the dpkg database directly and outputs a list of all installed packages along with their installation state (e.g., 'install'). This command does not rely on remote repositories or cache files, making it a reliable method for listing installed packages on a Debian-based system.

Exam trap

The trap here is that candidates confuse `dpkg -L` (which lists files for a specific package) with a command that lists all installed packages, or they assume `apt-cache search .` shows only installed packages when it actually queries the entire repository cache.

How to eliminate wrong answers

Option A is wrong because `apt-cache search .` searches the APT package cache for packages matching a pattern (the dot matches any character), but it lists all available packages in the repositories, not just those installed. Option B is wrong because `dpkg -L` lists files installed by a specific package (e.g., `dpkg -L bash`), not all installed packages; it requires a package name as an argument. Option D is wrong because `apt-show-versions` is not a standard Debian command; the correct tool for showing installed package versions is `apt list --installed` or `dpkg -l`, and `apt-show-versions` is a third-party script that may not be present by default.

Full explanation →

127

MCQeasy

A systems administrator downloads a .deb package file but it fails to install due to unmet dependencies. Which command sequence should be used to resolve the dependencies and complete the installation?

A.apt-get install -f

B.dpkg -i package.deb; apt-get install -f

C.dpkg --configure -a

D.apt-get upgrade

AnswerB

dpkg -i installs the package; apt-get install -f resolves dependencies.

Why this answer

When a .deb package fails to install due to unmet dependencies, `dpkg -i package.deb` installs the package but leaves dependencies unresolved. Running `apt-get install -f` (or `apt install -f`) then fixes broken dependencies by downloading and installing any missing packages from the configured repositories. This two-step sequence is the standard method for resolving dependency issues after a direct dpkg installation.

Exam trap

The trap here is that candidates assume `apt-get install -f` alone can install the .deb package, but it only fixes dependencies and does not process the original .deb file, so the package must first be installed (even partially) with `dpkg -i`.

How to eliminate wrong answers

Option A is wrong because `apt-get install -f` alone only fixes broken dependencies; it does not install the original .deb package, so the package remains uninstalled. Option C is wrong because `dpkg --configure -a` only reconfigures partially installed or unpacked packages, but it does not download or install missing dependencies from repositories. Option D is wrong because `apt-get upgrade` upgrades all installed packages to their latest versions and does not address unmet dependencies for a specific .deb package that was never fully installed.

Full explanation →

128

Multi-Selecteasy

Which three files are essential for network configuration and name resolution on a typical Linux system? (Choose three.)

Select 3 answers

A./etc/network/interfaces

B./etc/hosts

C./etc/sysctl.conf

D./etc/nsswitch.conf

E./etc/resolv.conf

AnswersB, D, E

Maps hostnames to IP addresses locally.

Why this answer

The `/etc/hosts` file provides static hostname-to-IP address mapping, allowing name resolution before DNS is queried. It is essential for local network configuration and fallback resolution, as defined by RFC 952 and the glibc Name Service Switch (NSS) framework.

Exam trap

The trap here is that candidates often confuse distribution-specific network configuration files (like `/etc/network/interfaces`) with essential system-wide name resolution files, leading them to select options that are not universally required across all Linux distributions.

Full explanation →

129

MCQmedium

Refer to the exhibit. The system administrator notices the /var/log partition is nearly full. The syslog file is 2GB. Which command will safely reduce the size of this log file without stopping the logging daemon?

A.cp /dev/null /var/log/syslog

B.rm /var/log/syslog && touch /var/log/syslog

C.> /var/log/syslog

D.mv /var/log/syslog /var/log/syslog.old

AnswerC

Truncating the file to zero length is safe; the file descriptor remains valid.

Why this answer

Using the shell redirection operator `> /var/log/syslog` truncates the file to zero length without deleting or closing its file descriptor. The syslog daemon (rsyslogd or syslogd) continues writing to the same inode, so no service interruption occurs. This is the safest method to free disk space while maintaining continuous logging.

Exam trap

The trap here is that candidates confuse truncating a file with deleting or moving it, not realizing that the logging daemon holds an open file descriptor tied to the inode, so only in-place truncation preserves continuous logging without a restart.

How to eliminate wrong answers

Option A is wrong because `cp /dev/null /var/log/syslog` replaces the file with a new inode, which causes the logging daemon to lose its file handle and stop writing until restarted or signaled. Option B is wrong because `rm` followed by `touch` also creates a new inode, breaking the daemon's open file descriptor and requiring a restart or SIGHUP to resume logging. Option D is wrong because `mv` renames the file, but the daemon still holds the old inode; the renamed file remains open and continues to grow, so disk space is not freed until the daemon is restarted or the old file is deleted.

Full explanation →

130

MCQmedium

Refer to the exhibit. An application uses this JSON policy to control execution of commands. If a user tries to run /usr/bin/passwd, what will happen?

A.Denied because the deny rule is more specific.

B.Allowed because the allow rule matches.

C.The policy is invalid due to conflicting rules.

D.The path pattern does not match.

AnswerA

The deny rule explicitly blocks /usr/bin/passwd, so execution is denied.

Why this answer

The deny rule is more specific than the allow rule. In this JSON policy, the deny rule explicitly matches the exact path `/usr/bin/passwd`, while the allow rule uses a wildcard pattern `*` that matches all commands. When a more specific rule (deny) conflicts with a less specific rule (allow), the more specific rule takes precedence, so the execution is denied.

Exam trap

The trap here is that candidates assume the allow rule's wildcard `*` always grants access, ignoring that a more specific deny rule takes precedence over a broader allow rule.

How to eliminate wrong answers

Option B is wrong because even though the allow rule matches all commands via the wildcard `*`, the deny rule is more specific to `/usr/bin/passwd` and overrides the broader allow rule. Option C is wrong because the policy is not invalid; conflicting rules are resolved by specificity, and the policy is syntactically valid JSON. Option D is wrong because the path pattern `/usr/bin/passwd` in the deny rule exactly matches the command the user tries to run, so the pattern does match.

Full explanation →

131

MCQhard

During boot, a Linux system displays 'Kernel panic – not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

A.The root filesystem is corrupted and needs fsck.

B.The kernel lacks the necessary driver for the storage controller.

C.The root= parameter in the boot loader points to a non-existent device.

D.The initrd is missing or corrupted.

AnswerB

Missing driver prevents accessing the root filesystem.

Why this answer

The error 'unknown-block(0,0)' indicates the kernel cannot find a device to mount as root. This typically occurs when the kernel lacks the driver for the storage controller (e.g., SATA, NVMe, SCSI host adapter) needed to access the root filesystem. Without the driver, the kernel cannot enumerate the block device, even if the root= parameter is correct and the filesystem is intact.

Exam trap

The trap here is that candidates often confuse 'unknown-block(0,0)' with a missing root= parameter or a corrupted filesystem, but the error specifically indicates the kernel cannot find the block device at all, which is almost always a missing storage driver.

How to eliminate wrong answers

Option A is wrong because a corrupted root filesystem would produce a different error, such as 'mount: /dev/sda1: can't read superblock' or a kernel panic with a filesystem-specific error, not 'unknown-block(0,0)'. Option C is wrong because if root= pointed to a non-existent device, the kernel would still attempt to mount it and fail with a 'mount: special device does not exist' or 'no such device' message, not the generic 'unknown-block(0,0)' which indicates the device node was never created. Option D is wrong because a missing or corrupted initrd typically causes a different panic like 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' only if the initrd itself contains the necessary storage driver; however, the error here is specifically about the root device not being found, which can occur even with a valid initrd if the initrd lacks the correct driver or the root= parameter is misconfigured, but the most common and direct cause is a missing storage controller driver in the kernel or initrd.

Full explanation →

132

MCQeasy

An administrator wants to run a shell script every day at 2:00 AM. Which command should be used to edit the user's personal crontab?

A.crontab -l

B.crontab -e

C.at 2:00 AM

D.vi /var/spool/cron/crontabs/username

AnswerB

Opens the personal crontab in the default editor for modifications.

Why this answer

The correct command to edit a user's personal crontab is `crontab -e`. This invokes the default text editor (as defined by the EDITOR or VISUAL environment variable) on the user's crontab file, ensuring proper syntax validation and locking to prevent concurrent edits. It is the standard and recommended way to modify cron jobs for the current user.

Exam trap

The trap here is that candidates may think they can directly edit the crontab file in `/var/spool/cron/` with `vi`, but the LPIC-1 exam expects you to know that only the `crontab` command should be used to safely modify user crontabs to avoid syntax errors and file corruption.

How to eliminate wrong answers

Option A is wrong because `crontab -l` lists the current user's crontab entries to standard output, it does not open an editor for modifications. Option C is wrong because `at 2:00 AM` is used for scheduling a one-time job at a specific time, not for recurring daily execution at 2:00 AM; `at` does not edit crontab files. Option D is wrong because directly editing the file `/var/spool/cron/crontabs/username` (or `/var/spool/cron/username` on some systems) bypasses the `crontab` command's syntax checking and locking mechanisms, which can lead to corruption or invalid entries; the `crontab` command should always be used to safely modify these files.

Full explanation →

133

MCQeasy

Which file is used by GRUB to load the kernel at boot time?

A./etc/grub.d/

B./etc/default/grub

C./boot/vmlinuz

D./boot/grub/grub.cfg

AnswerD

This is the generated configuration file used by GRUB at boot.

Why this answer

GRUB (GRand Unified Bootloader) reads its main configuration file, /boot/grub/grub.cfg, to determine which kernel to load and with what parameters. This file contains the menu entries, kernel paths, and initrd directives that GRUB uses at boot time. It is automatically generated by update-grub or grub-mkconfig based on scripts in /etc/grub.d/ and settings in /etc/default/grub.

Exam trap

The trap here is that candidates confuse the configuration file that GRUB reads at boot (/boot/grub/grub.cfg) with the files used to generate it (/etc/default/grub and /etc/grub.d/), leading them to pick a wrong answer that is part of the generation process rather than the runtime configuration.

How to eliminate wrong answers

Option A is wrong because /etc/grub.d/ is a directory containing shell scripts that generate parts of the GRUB configuration, not the file GRUB reads to load the kernel. Option B is wrong because /etc/default/grub is a configuration file that sets default boot options (like timeout and kernel parameters) for the grub-mkconfig tool, but it is not read directly by GRUB at boot. Option C is wrong because /boot/vmlinuz is the actual kernel image file, not a configuration file; GRUB loads the kernel from this path after reading its configuration.

Full explanation →

134

MCQeasy

An administrator added a new APT repository to sources.list. Which command must be run to make the system aware of the packages from that repository?

A.apt-get upgrade

B.apt upgrade

C.apt-cache search

D.apt update

AnswerD

apt update synchronizes the package index files from sources.

Why this answer

After adding a new APT repository to sources.list, you must run 'apt update' (or 'apt-get update') to refresh the local package index from all configured repositories. This command downloads the latest package lists from the repository's Release and Packages files, making the system aware of available packages and their versions. Without this step, APT will not know about the new repository's packages, and subsequent install or upgrade commands will fail to find them.

Exam trap

The trap here is that candidates confuse 'update' (refreshing package lists) with 'upgrade' (installing newer versions of installed packages), leading them to choose 'apt upgrade' or 'apt-get upgrade' thinking it will also fetch new repository data.

How to eliminate wrong answers

Option A is wrong because 'apt-get upgrade' installs newer versions of already-installed packages based on the current package index; it does not refresh the index itself, so it cannot make the system aware of new repository packages. Option B is wrong because 'apt upgrade' is functionally identical to 'apt-get upgrade' (it upgrades installed packages) and does not update the package cache from repositories. Option C is wrong because 'apt-cache search' queries the local package index for package names or descriptions; it does not update the index, so it will not find packages from a newly added repository until the index is refreshed.

Full explanation →

135

MCQmedium

Refer to the exhibit. Which file has a special permission that allows a user to execute the file with the privileges of the file owner?

A./usr/bin/myapp

B./tmp/shared

C./usr/bin/su

D.None of the above

AnswerC

Has setuid bit (rws).

Why this answer

The /usr/bin/su command has the SUID (Set User ID) special permission set (typically mode 4755). This allows any user who executes the file to run it with the effective user ID of the file owner (root), enabling privilege escalation to perform administrative tasks. The SUID bit is represented by an 's' in the owner's execute position when viewed with ls -l.

Exam trap

The trap here is that candidates often confuse the SUID permission with the SGID or sticky bit, or assume that any executable file in /usr/bin has special permissions, when in fact only specific system binaries like su, sudo, and passwd are configured with SUID for security reasons.

How to eliminate wrong answers

Option A is wrong because /usr/bin/myapp is a generic application file that does not inherently have the SUID permission set; without the SUID bit, it executes with the privileges of the user who runs it, not the file owner. Option B is wrong because /tmp/shared is a directory (or a regular file without SUID), and directories use the SGID or sticky bit for different purposes (e.g., group inheritance or preventing file deletion by non-owners), not for executing with the file owner's privileges. Option D is wrong because /usr/bin/su does have the special permission described, so 'None of the above' is incorrect.

Full explanation →

136

MCQmedium

An administrator needs to copy a directory hierarchy from one server to another over SSH, preserving permissions, ownership, and timestamps. Which command is most appropriate?

A.cp -a /source /mnt/remote

B.tar cf - /source | ssh user@dest "tar xf - -C /target"

C.scp -rp /source user@dest:/target

D.rsync -avz /source user@dest:/target

AnswerB

Preserves all metadata and works over SSH.

Why this answer

It uses `tar` to create an archive of the source directory, pipes it over SSH, and extracts it on the remote server with `tar xf - -C /target`. This method preserves all file metadata (permissions, ownership, timestamps) because `tar` captures and restores these attributes by default, and the pipe over SSH transfers the raw archive without any transformation. Unlike `scp` or `rsync` (without root privileges), this approach can preserve ownership even when the user is not root, as long as the remote `tar` runs with appropriate privileges.

Exam trap

The trap here is that candidates often choose `rsync -avz` (Option D) because it is commonly used for backups, but they overlook that preserving ownership over SSH requires root privileges and the `--numeric-ids` flag, which is not specified in the option, making `tar` the more reliable choice for this specific requirement.

How to eliminate wrong answers

Option A is wrong because `cp -a /source /mnt/remote` assumes the remote directory is mounted locally (e.g., via NFS or SSHFS), not over SSH directly; it does not use SSH for transport and would fail if the remote server is not mounted. Option C is wrong because `scp -rp` does not preserve ownership (it resets ownership to the connecting user) and may not preserve all timestamps in all cases; it also lacks the ability to preserve extended attributes or ACLs that `tar` can handle. Option D is wrong because `rsync -avz` without `--numeric-ids` and running as root on both sides will not preserve ownership (it maps UIDs/GIDs based on the remote user's permissions), and it may alter timestamps if the remote filesystem does not support nanosecond precision; additionally, `rsync` over SSH requires the remote user to have write permissions to the target, and ownership preservation typically requires root privileges.

Full explanation →

137

MCQhard

To prevent the 'nouveau' kernel module from loading at boot, which configuration file should be edited?

A./etc/modprobe.d/nouveau.conf with 'blacklist nouveau'

B./etc/modules-load.d/nouveau.conf

C.Both A and B are valid

D./etc/modprobe.d/blacklist.conf with 'blacklist nouveau'

AnswerA, D

Correct. A configuration file under /etc/modprobe.d/ with the 'blacklist' directive is the standard method to block a kernel module.

Why this answer

Both A and D are valid because any .conf file under /etc/modprobe.d/ can contain 'blacklist nouveau' to prevent the module from loading. Option B is incorrect because /etc/modules-load.d/ is intended for loading modules, not blacklisting. Option C is incorrect because option B is not valid.

Exam trap

Candidates may assume that only a specific filename like 'blacklist.conf' is valid, but any .conf file in /etc/modprobe.d/ can contain blacklist directives. However, files in /etc/modules-load.d/ are not used for blacklisting.

How to eliminate wrong answers

Option A is wrong because it is actually a correct method, not a wrong one; the question's answer key marks C as correct, meaning A alone is insufficient as an answer. Option B is wrong because /etc/modules-load.d/ is designed to specify modules to load at boot, not to blacklist them; using it to prevent loading is a misuse and not the standard practice. Option D is wrong because while /etc/modprobe.d/blacklist.conf is a common file name, the directive 'blacklist nouveau' is correct, but the option is incomplete as it does not include the alternative method in B, and the exam expects both A and B to be valid.

Full explanation →

138

Multi-Selecthard

Which TWO commands can be used to display the current firewall rules in a system using nftables? (Choose two.)

Select 2 answers

A.systemctl status nftables

B.iptables -L -n

C.nft list ruleset

D.nft list table inet filter

E.firewall-cmd --list-all

AnswersC, D

Lists entire nftables ruleset.

Why this answer

`nft list ruleset` is the primary command in nftables to display the entire ruleset, including all tables, chains, and rules, regardless of the address family. Option D is also correct because `nft list table inet filter` specifically displays the rules within the 'filter' table of the 'inet' family, which is a valid way to show a subset of the firewall rules. Both commands rely on the nftables framework, which is the modern replacement for iptables on Linux.

Exam trap

The trap here is that candidates may confuse the legacy iptables command (`iptables -L -n`) with nftables, or assume that `systemctl status nftables` shows rules, when in fact it only shows the service's runtime state.

Full explanation →

139

Drag & Dropmedium

Arrange the steps to schedule a cron job that runs a script every day at 2 AM.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Crontab -e opens the user's cron file; the syntax minute hour day month weekday command must be correct.

Full explanation →

140

MCQmedium

A Linux administrator manages a server that runs a custom application requiring a specific kernel module to be loaded at boot. The server uses SysV init and has the module listed in /etc/modules. However, after a recent kernel update, the module fails to load automatically at boot. The administrator can manually load the module with 'modprobe <module>' after the system is running. The application depends on this module being loaded before any network services start. Which of the following actions should the administrator take to ensure the module loads automatically at the correct time during boot?

A.Create a SysV init script that loads the module and place it in /etc/init.d/ with appropriate symlinks in /etc/rc?.d/ to ensure it runs before network services.

B.Add the module name to /etc/modules-load.d/ directory.

C.Add an install directive in /etc/modprobe.d/ for the module.

D.Add a blacklist entry for the module in /etc/modprobe.d/blacklist.conf.

AnswerA

This ensures the module is loaded early in the boot process, before network services that depend on it.

Why this answer

SysV init systems use init scripts in /etc/init.d/ with symlinks in /etc/rc?.d/ to control the order of service startup. By creating a custom init script that loads the module via modprobe and placing it with a symlink that has a lower number (e.g., S01module) than network services (e.g., S10network), the module will be loaded before network services start, satisfying the application's dependency.

Exam trap

The trap here is that candidates confuse the systemd-based /etc/modules-load.d/ mechanism with SysV init's /etc/modules file, assuming both are equivalent, when in fact SysV init requires explicit init scripts to control boot order.

How to eliminate wrong answers

Option B is wrong because /etc/modules-load.d/ is used by systemd's modules-load service, not by SysV init; on a SysV init system, this directory is ignored. Option C is wrong because an install directive in /etc/modprobe.d/ controls how modprobe handles module dependencies or custom commands when the module is requested, but it does not trigger automatic loading at boot; it only modifies modprobe behavior when the module is explicitly loaded. Option D is wrong because adding a blacklist entry would prevent the module from loading automatically, which is the opposite of what the administrator needs.

Full explanation →

141

Matchingmedium

Match each package manager to its associated distribution family.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Debian, Ubuntu

RHEL, CentOS 7

Fedora, RHEL 8+

openSUSE

Arch Linux

Why these pairings

Common package managers and their distribution families: APT (Debian), YUM/DNF (Red Hat), ZYpp (SUSE), pacman (Arch). Distractor options swap these associations.

Full explanation →

142

MCQmedium

Which directory under the root filesystem is defined by FHS as containing variable data that may change in size, such as logs and spools?

A./opt

B./var

C./run

D./tmp

AnswerB

Correct: /var holds variable data like logs and spools.

Why this answer

The Filesystem Hierarchy Standard (FHS) defines /var as the directory for variable data that changes in size during normal system operation, including log files (e.g., /var/log), spool directories (e.g., /var/spool/mail), and temporary files that persist across reboots. This is distinct from /tmp, which is cleared on reboot, and /run, which holds runtime variable data that is volatile and cleared at boot.

Exam trap

The trap here is that candidates confuse /var with /run or /tmp because both hold variable data, but the FHS specifically assigns persistent variable data (logs, spools) to /var, while /run is for volatile runtime state and /tmp for temporary files that may be cleared on reboot.

How to eliminate wrong answers

Option A is wrong because /opt is reserved for the installation of add-on application software packages, not for variable data like logs or spools. Option C is wrong because /run contains runtime variable data (e.g., PID files, sockets) that is cleared at system boot, whereas /var retains data across reboots. Option D is wrong because /tmp is for temporary files that may be deleted on reboot and is not intended for persistent variable data like logs or spools.

Full explanation →

143

MCQhard

An administrator is configuring a new server with two SATA disks. The first disk (/dev/sda) holds the root filesystem. The second disk (/dev/sdb) is intended to provide additional storage for user home directories. The administrator partitions /dev/sdb using 'fdisk' to create a single partition /dev/sdb1, formats it with 'mkfs.ext4' and adds the following line to /etc/fstab: '/dev/sdb1 /home ext4 defaults 0 2'. After rebooting, the /home directory is empty and the command 'df -h' does not show /dev/sdb1. However, running 'mount /dev/sdb1 /home' manually works perfectly. The disk is not listed in 'cat /proc/mounts' before the manual mount. What is the most likely cause of this issue?

A.The fstab entry is missing the _netdev option, which is required for local SATA disks.

B.The /home directory is not empty and contains files that conflict with the mount.

C.The fstab entry uses the device file /dev/sdb1 instead of the UUID.

D.The filesystem on /dev/sdb1 has errors and needs to be checked with fsck before mounting.

AnswerD

If the filesystem has errors, the system may not mount it automatically at boot to prevent further damage, but manual mount may still succeed if the errors are not severe.

Why this answer

The filesystem on /dev/sdb1 has errors that prevent it from being mounted automatically at boot. The 'mount -a' command (run during boot) will skip filesystems that fail a pre-mount check, but a manual mount with 'mount /dev/sdb1 /home' will still succeed if the errors are not critical. The '0 2' in the fstab entry specifies that the filesystem should be checked by fsck on boot; if fsck finds errors, the mount is aborted to avoid data corruption.

Exam trap

The trap here is that candidates assume a missing UUID or a non-empty mount point is the cause, but the real issue is the fsck pass number in fstab causing the mount to be skipped when errors are detected.

How to eliminate wrong answers

Option A is wrong because the _netdev option is used for network filesystems (e.g., NFS, iSCSI) to delay mounting until the network is available; it is not required for local SATA disks. Option B is wrong because if /home were non-empty, the mount would still succeed (the existing files would be hidden under the mount point), and the problem is that the mount does not occur at all. Option C is wrong because using /dev/sdb1 instead of a UUID is perfectly valid and would not cause a boot-time mount failure; the device file is stable for a single-disk system.

Full explanation →

144

MCQeasy

You are the system administrator of a small office network. The company has a Debian-based server that runs a critical database application. The database package was installed from the official Debian repository. After an ‘apt upgrade’, the database service fails to start. The error log indicates a library version mismatch. You suspect the upgrade updated a shared library that the database depends on, but the database binary was not updated because the repository no longer supports it. The vendor provides a custom .deb package for the database on their website. You need to restore the database functionality as quickly as possible, but you also want to avoid breaking other packages that may depend on the newer library. What should you do?

A.Restore the entire system from a backup taken before the upgrade.

B.Download the vendor's .deb package and install it using 'dpkg -i' after removing the old database package.

C.Downgrade the library to the previous version using 'apt-get install <package>=<oldversion>'.

D.Use 'dpkg --force-depends -i' to force installation of the old database binary against the new library.

AnswerB

Vendor's package should be compatible and minimize disruption.

Why this answer

The vendor's custom .deb package is specifically built for the database and its required library versions, ensuring compatibility. Installing it with 'dpkg -i' after removing the old database package avoids conflicts with the newer shared library that other packages depend on, restoring functionality without breaking the system.

Exam trap

The trap here is that candidates may choose to downgrade the library (option C) thinking it's a quick fix, without realizing that apt's dependency resolution will prevent the downgrade if other packages require the newer version, or that it could break those packages, whereas the vendor's custom package is the intended solution for unsupported software.

How to eliminate wrong answers

Option A is wrong because restoring the entire system from a backup is overly drastic and time-consuming; it would revert all changes, including potentially losing other updates, and does not address the targeted library version mismatch. Option C is wrong because downgrading the library with 'apt-get install <package>=<oldversion>' could break other packages that now depend on the newer library, as apt's dependency resolution would not allow a partial downgrade without risking system instability. Option D is wrong because using 'dpkg --force-depends -i' to force installation of the old database binary against the new library ignores the actual library version mismatch; the binary will still fail to run due to unresolved symbol or ABI incompatibilities, and this approach can corrupt the package database.

Full explanation →

145

MCQmedium

A system administrator writes a script that extracts data from a CSV file and inserts it into a database. The script works correctly when run manually but fails when executed by cron. Which environment variable is most likely causing the issue?

A.SHELL

B.LANG

C.HOME

D.PATH

AnswerD

PATH is often not set in cron, causing command not found errors.

Why this answer

When a script runs manually, the user's interactive shell inherits a fully populated PATH environment variable that includes directories like /usr/local/bin, /usr/bin, and possibly custom script directories. Cron jobs, however, execute with a minimal environment, and the default PATH for cron is often just /usr/bin:/bin. If the script relies on commands (e.g., mysql, psql, or custom scripts) located outside these directories, cron will fail with a 'command not found' error.

Setting the full PATH explicitly inside the script or in the crontab file resolves the issue.

Exam trap

The trap here is that candidates often assume the script's failure is due to a missing HOME or SHELL variable, but the most frequent cron-related issue is the restricted PATH environment, which prevents the script from locating executables.

How to eliminate wrong answers

Option A is wrong because SHELL defines the shell binary used to interpret the script (e.g., /bin/bash), but cron already uses the user's default shell from /etc/passwd; a mismatch would cause syntax errors, not a missing command failure. Option B is wrong because LANG affects locale settings like character encoding and sorting order, which could cause data corruption or sorting issues but not a complete failure to execute commands. Option C is wrong because HOME defines the user's home directory; while some scripts may rely on relative paths or config files in ~, the most common cron failure is due to a truncated PATH, not a missing HOME.

Full explanation →

146

MCQmedium

An administrator wants to allow user 'john' to run all commands as root without a password. Which sudoers entry accomplishes this?

A.john ALL=(ALL) NOPASSWD: ALL

B.john ALL=NOPASSWD: /bin/su

C.john ALL=(ALL) ALL

D.john ALL=(ALL) PASSWD: ALL

AnswerA

Correct: allows all commands without password.

Why this answer

The sudoers entry 'john ALL=(ALL) NOPASSWD: ALL' grants user 'john' permission to run any command as any user (including root) from any host, and the NOPASSWD tag overrides the default password requirement, allowing passwordless execution. This matches the requirement precisely.

Exam trap

The trap here is that candidates often confuse the absence of a TAG (which defaults to requiring a password) with passwordless access, or they mistakenly think that specifying 'ALL' without the NOPASSWD tag implies no password is needed.

How to eliminate wrong answers

Option B is wrong because it restricts john to only running '/bin/su' without a password, not all commands as root. Option C is wrong because it omits the NOPASSWD tag, so john would still be prompted for a password before executing commands as root. Option D is wrong because it explicitly specifies PASSWD: ALL, which forces password authentication, the opposite of the requirement.

Full explanation →

147

MCQmedium

An administrator notices the system clock is drifting. Which command can be used to enable automatic time synchronization using NTP on a system with systemd?

A.ntpdate pool.ntp.org

B.timedatectl set-ntp yes

C.systemctl start ntpd

D.date --set

AnswerB

This enables automatic time synchronization using NTP.

Why this answer

`timedatectl set-ntp yes` enables automatic time synchronization via NTP on systems using systemd. This command configures the `systemd-timesyncd` service, which is the default NTP client for systemd-based distributions, to synchronize the system clock with remote NTP servers. It is the standard, modern method for managing NTP settings in such environments.

Exam trap

The trap here is that candidates often confuse one-time synchronization commands (like `ntpdate` or `date --set`) with the persistent enabling of automatic NTP synchronization, or they assume starting the `ntpd` service alone is sufficient without using `timedatectl` to manage systemd's time synchronization framework.

How to eliminate wrong answers

Option A is wrong because `ntpdate pool.ntp.org` performs a one-time manual synchronization of the system clock, not enabling automatic time synchronization; it is also deprecated in favor of `timedatectl` and `ntpd` or `chronyd`. Option C is wrong because `systemctl start ntpd` starts the traditional NTP daemon, but this command alone does not enable automatic synchronization at boot or integrate with systemd's timedatectl mechanism; it also requires the `ntpd` service to be installed and configured separately. Option D is wrong because `date --set` manually sets the system clock to a specified value, which does not enable automatic synchronization and is a temporary, non-persistent change.

Full explanation →

148

Multi-Selecthard

Which THREE files are used by CUPS to manage printer queues? (Choose THREE.)

Select 3 answers

A./etc/cups/lpoptions

B./etc/cups/ppd/

C./etc/cups/classes.conf

D./etc/cups/cupsd.conf

E./etc/cups/printers.conf

AnswersC, D, E

This file defines printer classes.

Why this answer

CUPS uses /etc/cups/printers.conf to define printer queues and their associated options, /etc/cups/classes.conf to manage printer classes (groups of queues), and /etc/cups/cupsd.conf as the main daemon configuration file that controls access, logging, and other server settings. These three files are directly read by the CUPS daemon to manage and serve printer queues.

Exam trap

The trap here is that candidates confuse the PPD directory (/etc/cups/ppd/) or the lpoptions file with the actual queue configuration files, because they are all located under /etc/cups/ and are involved in printing, but only printers.conf, classes.conf, and cupsd.conf directly manage queue definitions and server behavior.

Full explanation →

149

MCQmedium

A web server running Apache on Linux is experiencing slow response times. The administrator runs 'netstat -tuln' and sees many connections in TIME_WAIT state. Which of the following is the best course of action to improve performance?

A.Increase the KeepAliveTimeout directive.

B.Disable the KeepAlive directive.

C.Enable TCP keepalive and adjust kernel parameters for faster reuse.

D.Increase the MaxKeepAliveRequests directive.

AnswerC

Adjusting tcp_tw_reuse and tcp_tw_recycle can reduce TIME_WAIT.

Why this answer

TIME_WAIT connections indicate that the server is waiting for lingering packets before fully closing TCP sockets. Enabling TCP keepalive and adjusting kernel parameters like net.ipv4.tcp_tw_reuse (or net.ipv4.tcp_tw_recycle in older kernels) allows the kernel to reuse sockets in TIME_WAIT state for new connections, reducing resource exhaustion and improving performance under high connection rates.

Exam trap

The trap here is that candidates confuse Apache's KeepAlive directives (HTTP-level persistent connections) with TCP-level keepalive and TIME_WAIT management, leading them to incorrectly choose options that adjust HTTP keep-alive settings instead of addressing the TCP socket state.

How to eliminate wrong answers

Option A is wrong because increasing KeepAliveTimeout (which controls how long Apache waits for the next request on a persistent connection) does not affect the TIME_WAIT state of TCP sockets; it only extends idle keep-alive duration, potentially worsening resource usage. Option B is wrong because disabling KeepAlive forces a new TCP connection for every HTTP request, which increases the number of TIME_WAIT sockets and degrades performance further. Option D is wrong because MaxKeepAliveRequests limits the number of requests per persistent connection, but does not address the underlying TCP TIME_WAIT issue; it may even increase connection churn if set too low.

Full explanation →

150

MCQhard

A developer needs to ensure a bash script exits immediately if any command fails, and also prints each command before executing it. Which set of shell options should be used at the beginning of the script?

A.set -ex

B.set -e

C.set -vx

D.set -ux

AnswerA

-e exits on error, -x prints commands.

Why this answer

`set -ex` combines two essential shell options: `-e` (errexit) causes the script to exit immediately if any command returns a non-zero exit status, and `-x` (xtrace) prints each command (after expansion) to stderr before executing it. This is the standard way to achieve both behaviors in a single line, as required by the question.

Exam trap

The trap here is that candidates often confuse `-v` (verbose, which prints input lines as read) with `-x` (xtrace, which prints commands before execution), or forget that `-e` is required for exit-on-error, leading them to pick `set -vx` or `set -ux` instead of the correct `set -ex`.

How to eliminate wrong answers

Option B is wrong because `set -e` only enables exit-on-error but does not print commands before execution, missing the requirement to print each command. Option C is wrong because `set -vx` enables verbose mode (`-v`, which prints shell input lines as they are read) and xtrace (`-x`), but verbose mode does not print commands before execution in the same way as `-x`; the question specifically asks for printing each command before executing it, which is `-x`'s behavior, and `-v` is redundant or incorrect for this purpose. Option D is wrong because `set -ux` enables nounset (`-u`, which treats unset variables as an error) and xtrace (`-x`), but does not enable exit-on-error (`-e`), so the script will not exit immediately if a command fails.

Full explanation →

Linux Professional Institute Certification Level 1 LPIC-1 (LPIC-1) — Questions 76–150