Linux Professional Institute Certification Level 1 LPIC-1 LPIC-1 Questions 151–225 | Page 3/8

151

Multi-Selectmedium

Which THREE directories under the root filesystem are typically used for variable data that changes frequently during system operation, according to FHS?

Select 3 answers

A./usr

B./var

C./run

D./tmp

E./opt

AnswersB, C, D

/var is for variable data such as logs, mail spools, etc.

Why this answer

The Filesystem Hierarchy Standard (FHS) designates /var for variable data that changes in size and content during normal system operation, such as logs (/var/log), spool files (/var/spool), and databases (/var/lib). /run holds runtime variable data describing the system since boot, while /tmp is for temporary files that may be deleted on reboot. Together, these three directories are the standard locations for frequently changing data under the root filesystem.

Exam trap

The trap here is that candidates often confuse /usr with /var because /usr contains some subdirectories like /usr/local/var in older systems, but the FHS explicitly separates read-only /usr from writable /var, and /usr is not intended for frequently changing data.

Full explanation →

152

Multi-Selecthard

Which THREE locations are used to configure package repositories on a typical Linux system? (Choose three.)

Select 3 answers

A./etc/zypp/repos.d/

B./etc/apt.conf.d/

C./etc/yum.repos.d/

D./etc/pacman.d/

E./etc/apt/sources.list

AnswersA, C, E

Repository directory for Zypper.

Why this answer

/etc/zypp/repos.d/ is the directory where SUSE's Zypper package manager stores repository configuration files (each .repo file defines a repository's URL, GPG keys, and other settings). This is the standard location for configuring repositories on openSUSE and SUSE Linux Enterprise systems.

Exam trap

The trap here is that candidates confuse the configuration directory for APT (/etc/apt.conf.d/) with the actual repository source location (/etc/apt/sources.list), or assume that all package managers use a repos.d subdirectory pattern, when in fact pacman uses a single configuration file.

Full explanation →

153

MCQmedium

A system is not logging messages to /var/log/syslog. Which command should an administrator use first to diagnose the issue?

A.tail -f /var/log/syslog

B.logger test

C.ps aux | grep syslog

D.systemctl status rsyslog

AnswerD

Checks the status of the rsyslog service to see if it is active and running.

Why this answer

The first step in diagnosing why messages are not appearing in /var/log/syslog is to verify that the rsyslog service is running and active. The 'systemctl status rsyslog' command shows the current service state, recent logs, and any errors that might prevent logging. Without confirming the service status, other diagnostic steps may be misleading.

Exam trap

The trap here is that candidates often jump to testing the logging pipeline (with 'logger') or checking for a process by name, instead of first verifying the service status with systemctl, which is the systematic and most efficient diagnostic step.

How to eliminate wrong answers

Option A is wrong because 'tail -f /var/log/syslog' only monitors the log file for new entries; if no messages are being written, it will simply hang and provide no diagnostic information about why logging has stopped. Option B is wrong because 'logger test' sends a test message to the syslog system, but if the service is not running or misconfigured, the message will not be logged and the command gives no feedback about the underlying issue. Option C is wrong because 'ps aux | grep syslog' only checks for a process named 'syslog' in the process list, but modern systems use rsyslog or syslog-ng, and this command may miss the actual daemon or show unrelated processes, failing to reveal service status or configuration errors.

Full explanation →

154

Multi-Selecthard

Which TWO files are used to configure kernel boot parameters in GRUB?

Select 2 answers

A./sys/kernel/cmdline

B./etc/default/grub

C./etc/grub.d/

D./proc/cmdline

E./boot/grub/grub.cfg

AnswersB, C

Correct. /etc/default/grub is the main configuration file where users define kernel boot parameters.

Why this answer

The correct answers are B and C. /etc/default/grub (B) is the primary configuration file for GRUB 2 where users set kernel boot parameters such as GRUB_CMDLINE_LINUX. /etc/grub.d/ (C) is a directory containing scripts that are executed by grub-mkconfig to generate the final /boot/grub/grub.cfg file; these scripts can be modified to add or change kernel boot parameters. Option E (/boot/grub/grub.cfg) is a generated file, not used for direct configuration. Options A (/sys/kernel/cmdline) and D (/proc/cmdline) display the current kernel command line but are not configuration files.

Full explanation →

155

MCQmedium

A Linux system has two network interfaces: eth0 and eth1. The administrator wants to bond them for increased throughput. Which kernel module is required for bonding?

A.aggregation

B.bonding

C.team

D.bond

AnswerB

The bonding kernel module provides network interface bonding.

Why this answer

The bonding driver in Linux allows multiple network interfaces to be aggregated into a single logical interface for increased throughput or redundancy. The correct kernel module is named 'bonding' (loaded via modprobe bonding or compiled into the kernel), which implements the IEEE 802.3ad Link Aggregation standard and other bonding modes. Option B is correct because 'bonding' is the exact module name used in the Linux kernel.

Exam trap

The trap here is that candidates confuse the interface name (bond0) with the kernel module name (bonding), or think 'team' is a synonym for bonding, when in fact they are separate technologies with different kernel modules.

How to eliminate wrong answers

Option A is wrong because 'aggregation' is a generic term for combining links, not a specific Linux kernel module; the actual module is 'bonding'. Option C is wrong because 'team' refers to the libteam project, which is a separate user-space-based teaming solution that uses the 'team' kernel module, not the standard bonding driver. Option D is wrong because 'bond' is a common abbreviation but not the exact kernel module name; the module is loaded as 'bonding' (e.g., modprobe bonding), and the resulting interface is named bond0, bond1, etc.

Full explanation →

156

Multi-Selectmedium

Which THREE commands are used to manage systemd services? (Choose THREE.)

Select 3 answers

A.systemctl status

B.systemctl start

C.systemctl enable

D.chkconfig --add

E.service start

AnswersA, B, C

Correct: shows the status of a systemd service.

Why this answer

The `systemctl` command is the primary tool for managing systemd services on Linux systems. `systemctl status` displays the current state of a service, including whether it is active, enabled, and recent log entries. `systemctl start` immediately activates a service by sending it a start signal via systemd's D-Bus interface. `systemctl enable` creates symbolic links in the filesystem (e.g., in `/etc/systemd/system/multi-user.target.wants/`) to ensure the service starts automatically at boot.

Exam trap

The trap here is that candidates confuse legacy SysV init commands like `chkconfig` and `service` with systemd's `systemctl`, expecting them to be interchangeable, but LPIC-1 tests the modern systemd toolset explicitly.

Full explanation →

157

Multi-Selecthard

A system administrator is troubleshooting a package dependency issue on a Debian system. Which three commands can be used to display dependency information for a package? (Choose three.)

Select 3 answers

A.`dpkg --info curl.deb`

B.`apt show curl`

C.`apt-cache depends curl`

D.`dpkg -s curl`

E.`apt-get check`

AnswersB, C, D

Displays package details including dependencies.

Why this answer

The `apt show curl` command displays detailed information about the curl package, including its dependencies, from the APT repository metadata. This is a standard way to view dependency information on Debian-based systems.

Exam trap

The trap here is that candidates may think `dpkg --info` or `apt-get check` are appropriate for displaying dependencies, but `dpkg --info` works on .deb files and `apt-get check` only verifies the database integrity, not specific package dependencies.

Full explanation →

158

Multi-Selecthard

Which THREE are valid fields in a GRUB 2 configuration file (grub.cfg) generated by update-grub? (Choose three.)

Select 3 answers

A.set root

B.password

C.chainloader

D.linux

E.menuentry

AnswersA, D, E

This sets the device for the kernel and initrd.

Why this answer

A is correct because 'set root' is a valid GRUB 2 command used in grub.cfg to specify the root device (e.g., 'set root=(hd0,msdos1)') from which GRUB loads kernel and initrd images. This directive is automatically generated by update-grub based on the system's partition layout.

Exam trap

The trap here is that candidates confuse GRUB Legacy syntax (like 'password' or 'chainloader' being common in manual entries) with the auto-generated GRUB 2 configuration, which only includes 'set root', 'linux', and 'menuentry' as core directives produced by update-grub.

Full explanation →

159

Drag & Dropmedium

Arrange the steps to troubleshoot a service that fails to start.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Troubleshooting starts with checking status and logs, then examining config files, fixing, and restarting.

Full explanation →

160

Multi-Selectmedium

Which TWO of the following commands can be used to list all installed packages on a Debian-based system?

Select 2 answers

A.apt-get check

B.apt list --installed

C.apt-cache showpkg

D.dpkg -l

E.dpkg --get-selections

AnswersB, D

Lists installed packages.

Why this answer

`apt list --installed` is a modern APT command that lists all installed packages on Debian-based systems. Option D is correct because `dpkg -l` displays the status and names of all packages known to dpkg, including those installed, effectively listing installed packages.

Exam trap

The trap here is that candidates often confuse `dpkg --get-selections` with a command that lists only installed packages, when in fact it lists all packages with their selection state (including those marked for removal), requiring additional filtering to isolate installed ones.

Full explanation →

161

MCQmedium

Based on the exhibit, what does the 'rc' status for the package 'apache2-bin' indicate?

A.The package is unpacked but not yet configured

B.The package has been completely purged

C.The package is installed and configured

D.The package has been removed but configuration files remain

AnswerD

'rc' means removed but config files left.

Why this answer

In Debian-based package management (dpkg/APT), the 'rc' status code means the package was marked for removal ('r') but its configuration files were left behind ('c'). This occurs when using 'apt-get remove' or 'dpkg -r' without the --purge option, leaving residual config files in /etc or other locations.

Exam trap

The trap here is that candidates confuse 'rc' with a fully removed or purged state, not realizing that 'c' specifically indicates residual configuration files remain on the filesystem.

How to eliminate wrong answers

Option A is wrong because 'unpacked but not yet configured' is represented by status 'iU' (installed/unpacked) or 'U' (unpacked), not 'rc'. Option B is wrong because a completely purged package shows status 'pn' (purged/not installed) or no entry at all, not 'rc'. Option C is wrong because an installed and configured package shows status 'ii' (installed/installed), not 'rc'.

Full explanation →

162

MCQmedium

The system administrator wants to use the entire sdb disk as a single partition. Which command will partition sdb with a single partition occupying the whole disk?

A.fdisk /dev/sdb, then create a new primary partition accepting all defaults

B.dd if=/dev/zero of=/dev/sdb bs=1M count=1

C.mkfs.ext4 /dev/sdb

D.parted /dev/sdb mklabel gpt && parted /dev/sdb mkpart primary 0% 100%

AnswerD

Correctly creates a GPT label and a partition spanning the entire disk.

Why this answer

It uses parted to first create a GPT partition table on /dev/sdb (mklabel gpt) and then creates a single primary partition spanning the entire disk (mkpart primary 0% 100%). This is the proper method to partition the whole disk as one partition, ensuring the disk has a valid partition table and a defined partition that can later be formatted.

Exam trap

The trap here is that candidates may think fdisk with default options creates a full-disk partition, but fdisk defaults to a small partition size unless the user explicitly specifies the end sector, leading to an incomplete partition.

How to eliminate wrong answers

Option A is wrong because fdisk with all defaults does not automatically create a partition that uses the entire disk; it typically creates a partition of a default size (e.g., 2048 sectors) unless the user manually specifies the end sector. Option B is wrong because dd if=/dev/zero of=/dev/sdb bs=1M count=1 only wipes the first 1 MB of the disk (overwriting the boot sector and partition table), but does not create any partition. Option C is wrong because mkfs.ext4 /dev/sdb attempts to create a filesystem directly on the raw block device without a partition table, which is not a standard partitioning method and will fail or produce an unpartitioned filesystem that cannot be used as a partitioned disk.

Full explanation →

163

MCQhard

An administrator ran 'dnf update' and a critical application broke. The administrator wants to undo the last transaction and return to previous state. Which command should be used?

A.dnf undo last

B.dnf rollback

C.yum rollback

D.dnf history undo last

AnswerD

Correct: undoes the last transaction.

Why this answer

The correct command is 'dnf history undo last' because DNF maintains a transaction history that can be reverted. The 'undo' subcommand reverses the specified transaction (in this case, the last one) by applying the inverse operations, restoring packages to their previous state. This is the standard way to roll back a DNF transaction without affecting unrelated changes.

Exam trap

The trap here is that candidates confuse 'undo' with 'rollback' or assume DNF uses the same syntax as YUM, leading them to pick 'dnf rollback' or 'yum rollback' instead of the correct 'dnf history undo last'.

How to eliminate wrong answers

Option A is wrong because 'dnf undo last' is not a valid DNF command; DNF requires the 'history' subcommand before 'undo'. Option B is wrong because 'dnf rollback' does not exist; DNF uses 'history undo' or 'history rollback' (the latter reverts to a specific transaction ID, not the last one). Option C is wrong because 'yum rollback' is a legacy YUM command that is not available in DNF; DNF replaced YUM and uses 'dnf history' for transaction management.

Full explanation →

164

MCQmedium

Refer to the exhibit. The administrator is unable to SSH into the server (TCP port 22) from a remote host. The iptables rules are as shown. What is the most likely cause?

A.The default policy is ACCEPT, so SSH should be accepted.

B.The second rule drops all incoming traffic, including SSH.

C.The SSH service is not running.

D.The first rule only allows loopback, not SSH.

AnswerB

The DROP rule matches all traffic not yet matched.

Why this answer

The second rule in the iptables ruleset explicitly drops all incoming traffic with `iptables -A INPUT -j DROP`. Since SSH traffic on TCP port 22 is incoming from a remote host, it matches this rule before any later rule could accept it. The default policy being ACCEPT does not override explicit DROP rules; iptables processes rules sequentially, and the DROP rule terminates the packet's traversal, preventing SSH access.

Exam trap

The trap here is that candidates assume a default policy of ACCEPT overrides explicit DROP rules, but iptables processes rules sequentially and a matching DROP rule terminates processing, making the default policy irrelevant for packets that match it.

How to eliminate wrong answers

Option A is wrong because the default policy of ACCEPT only applies if no explicit rule matches the packet; here, the second rule explicitly drops all incoming traffic, so the default policy is never reached. Option C is wrong because the question focuses on iptables rules blocking SSH, not the SSH service status; even if SSH is running, the DROP rule prevents the connection. Option D is wrong because the first rule allows loopback traffic (interface lo), which is irrelevant to SSH from a remote host; SSH traffic arrives on a physical network interface, not loopback, so it is not affected by that rule.

Full explanation →

165

Multi-Selecteasy

According to the Filesystem Hierarchy Standard (FHS), which TWO directories are intended for variable data that persists across system reboots? (Choose two.)

Select 1 answer

A./run

B./opt

C./var

D./usr/local

E./tmp

AnswersC

/var is the primary directory for variable data such as logs and databases that persist across reboots.

Why this answer

According to the Filesystem Hierarchy Standard (FHS), /var is the designated directory for variable data such as logs, spools, and databases that persist across reboots. /run is intended for runtime variable data and is typically cleared on boot, so it does not persist. Therefore, only /var is correct.

Exam trap

The LPI exam often tests the misconception that /run is persistent, but according to FHS, /run is cleared on boot. Only /var is intended for variable data that persists across reboots.

Full explanation →

166

MCQeasy

According to the Filesystem Hierarchy Standard (FHS), which directory contains essential system binaries required during boot?

A./usr/bin

B./usr/local/bin

C./sbin

D./bin

AnswerC

Correct: /sbin holds system binaries needed for booting and system repair.

Why this answer

According to the Filesystem Hierarchy Standard (FHS), /sbin contains essential system binaries required for booting, repairing, and recovering the system. These binaries are critical before /usr is mounted, such as fsck, init, and route. While /bin also contains essential binaries, the FHS specifically designates /sbin for system administration binaries needed during boot.

Exam trap

The trap here is that candidates confuse /bin with /sbin, assuming both contain essential boot binaries, but the FHS specifically assigns system administration binaries to /sbin, and /bin is often a symlink to /usr/bin on modern systems, making it non-essential during early boot.

How to eliminate wrong answers

Option A is wrong because /usr/bin contains non-essential user binaries that are not required during boot; it is typically mounted later in the boot process. Option B is wrong because /usr/local/bin contains locally installed software binaries, which are not part of the essential boot set and are also mounted after /usr. Option D is wrong because although /bin historically held essential binaries, the FHS now specifies that /bin may be a symbolic link to /usr/bin on many modern systems, and the essential system administration binaries are specifically placed in /sbin.

Full explanation →

167

MCQeasy

An administrator needs to find all files in the /var/log directory that have been modified in the last 24 hours. Which command should be used?

A.find /var/log -ctime 0

B.find /var/log -mtime 0

C.find /var/log -atime 0

D.find /var/log -mmin 1440

AnswerB

mtime 0 matches files modified within the last 24 hours.

Why this answer

The `find` command with `-mtime 0` searches for files whose data modification time is within the last 24 hours. The `-mtime` option uses a 24-hour period, and a value of 0 means modified less than 24 hours ago, which matches the requirement to find files modified in the last 24 hours in /var/log.

Exam trap

The trap here is that candidates confuse `-ctime` (inode change time) with `-mtime` (modification time), or mistakenly think `-atime` (access time) is relevant for modification, leading them to pick options that do not match the requirement for content modification.

How to eliminate wrong answers

Option A is wrong because `-ctime 0` checks the inode change time (ctime), which includes metadata changes like permission or ownership changes, not file content modification; this can return files that were not modified in terms of content. Option C is wrong because `-atime 0` checks the access time (atime), which is updated when a file is read, not when it is modified; this would include files that were simply accessed, not modified. Option D is wrong because `-mmin 1440` checks for files modified within the last 1440 minutes (exactly 24 hours), but the question asks for files modified in the last 24 hours, and `-mmin` uses a precise minute count, which is technically correct but less standard for this requirement; however, the primary issue is that the question expects `-mtime 0` as the standard approach, and `-mmin 1440` could miss files modified exactly 1440 minutes ago due to integer rounding behavior in `-mtime` vs `-mmin`.

Full explanation →

168

Multi-Selecteasy

Which TWO commands can be used to display the current runlevel of a SysV init system?

Select 2 answers

A.init 3

B.who -r

C.telinit

D.runlevel

E.systemctl get-default

AnswersB, D

The 'who -r' command displays the current runlevel and process since last boot.

Why this answer

The `who -r` command displays the current runlevel and the time it was last changed, making it a valid way to check the runlevel in a SysV init system. The `runlevel` command directly outputs the previous and current runlevel, which is the standard tool for this purpose.

Exam trap

The trap here is that candidates confuse commands that change runlevels (like `init` or `telinit`) with those that display them, or mistakenly apply systemd commands like `systemctl get-default` to SysV init systems.

Full explanation →

169

Multi-Selecteasy

Which TWO commands can be used to view all running processes on a Linux system? (Choose TWO.)

Select 2 answers

A.jobs

B.ls /proc

C.pstree

D.top

E.ps aux

AnswersD, E

Correct: interactive process viewer showing all running processes.

Why this answer

`top`, is correct because it provides a real-time, interactive view of all running processes, including their PID, CPU and memory usage, and other dynamic metrics. Option E, `ps aux`, is correct because it displays a static snapshot of all processes on the system using the BSD-style syntax, where `a` shows all users, `u` provides user-oriented output, and `x` includes processes without a controlling terminal.

Exam trap

The trap here is that candidates often confuse `jobs` (which only shows shell background jobs) with a system-wide process listing, or they think `ls /proc` alone is sufficient to view processes, when in fact it only lists directory names and requires additional commands to extract meaningful process data.

Full explanation →

170

MCQmedium

An administrator wants to add a kernel parameter 'quiet splash' to the default boot entry. Which file should be edited?

A./etc/default/grub

B./etc/grub.d/00_header

C./etc/grub.conf

D./boot/grub/grub.cfg

AnswerA

This is the configuration file where kernel parameters are set and then applied by running update-grub.

Why this answer

The correct file to edit is /etc/default/grub because it is the main configuration file for GRUB 2 where kernel boot parameters like 'quiet splash' are defined in the GRUB_CMDLINE_LINUX_DEFAULT variable. After editing this file, the administrator must run update-grub (or grub-mkconfig) to regenerate the actual boot configuration file /boot/grub/grub.cfg.

Exam trap

The trap here is that candidates often confuse the auto-generated /boot/grub/grub.cfg (option D) with the source configuration file, or mistakenly think the legacy /etc/grub.conf (option C) is still used in GRUB 2 environments.

How to eliminate wrong answers

Option B is wrong because /etc/grub.d/00_header is a script that generates part of the GRUB 2 configuration, not a file where kernel parameters are directly set; editing it would be overwritten on updates and is not the intended method. Option C is wrong because /etc/grub.conf is a legacy file used by GRUB Legacy (version 0.97) and is not the standard location for GRUB 2 on modern Linux distributions. Option D is wrong because /boot/grub/grub.cfg is the auto-generated boot configuration file; editing it directly is discouraged as changes are overwritten by update-grub and it is not the source of truth for kernel parameters.

Full explanation →

171

MCQmedium

Refer to the exhibit. The root filesystem is at 95% capacity. Which option will free space on the root filesystem?

A.Resize /dev/sda1 using resize2fs

B.Move /var/log to /mnt/backup and create a symlink

C.Delete all files in /var/log

D.Move /home to /mnt/backup and create a symlink

AnswerB

/var/log is on the root filesystem; moving it to /mnt/backup frees space on /, and the symlink allows continued access.

Why this answer

Moving the /var/log directory to a separate partition or filesystem (e.g., /mnt/backup) and creating a symbolic link from /var/log to the new location frees space on the root filesystem without losing log data. This approach preserves the filesystem hierarchy and allows logs to continue growing on a different volume, preventing the root filesystem from filling up.

Exam trap

The trap here is that candidates may think deleting log files (Option C) is acceptable, but the exam tests understanding of non-destructive methods that preserve data and system functionality, while also recognizing that /var/log is the most common directory to fill the root filesystem.

How to eliminate wrong answers

Option A is wrong because resize2fs is used to resize ext2/ext3/ext4 filesystems, but it cannot free space on a filesystem that is already at 95% capacity; it only changes the size of the filesystem on a block device, and shrinking a filesystem requires unmounting and sufficient free space to move data, which is not the goal here. Option C is wrong because deleting all files in /var/log would free space but is destructive and violates system administration best practices, as it removes critical log files needed for troubleshooting and auditing. Option D is wrong because moving /home to /mnt/backup and creating a symlink would free space on the root filesystem, but the question specifically asks about freeing space on the root filesystem, and /home is typically a separate partition or mount point; moving it is unnecessary and could break user access if not done correctly, whereas /var/log is the more common culprit for filling the root filesystem.

Full explanation →

172

MCQmedium

A system administrator notices that a server with an ext4 filesystem fails to boot after editing /etc/fstab. The error message indicates that the root filesystem cannot be mounted. Which of the following is the most likely cause?

A.The root filesystem is mounted read-only.

B.The swap partition entry is missing.

C.The UUID or device name for the root filesystem is incorrect.

D.The filesystem type is specified as 'auto' instead of 'ext4'.

AnswerC

An incorrect UUID or device path in /etc/fstab prevents the kernel from mounting the root filesystem.

Why this answer

If the UUID or device name for the root filesystem in /etc/fstab is incorrect, the kernel cannot locate the root device during boot, resulting in a mount failure. The init process reads /etc/fstab to mount the root filesystem, and any mismatch—such as a typo in the UUID or a stale device path—will cause the system to drop into emergency mode.

Exam trap

The trap here is that candidates may think 'auto' is invalid for the root filesystem or that a missing swap entry is critical, but the core issue is always the correct identification of the root device in /etc/fstab.

How to eliminate wrong answers

Option A is wrong because mounting the root filesystem read-only is a common recovery technique (e.g., via kernel boot parameter 'ro') and does not prevent mounting; it actually helps avoid corruption. Option B is wrong because a missing swap partition entry does not affect the mounting of the root filesystem; swap is optional and only used for virtual memory. Option D is wrong because specifying 'auto' as the filesystem type tells the system to auto-detect the type (e.g., via blkid), which is valid and often recommended for flexibility; it would not cause a mount failure for ext4.

Full explanation →

173

MCQhard

An admin needs to create a new filesystem on /dev/sdc1 with a 256-byte inode size and a 1:512 block to inode ratio for a mail server expected to store millions of small files. Which mkfs command best meets these requirements?

A.mkfs.ext4 -I 256 -i 512 /dev/sdc1

B.mkfs.ext4 -b 4096 -I 256 /dev/sdc1

C.mkfs.xfs -i maxpct=50 /dev/sdc1

D.mkfs.btrfs -s 4k /dev/sdc1

AnswerA

Correctly sets inode size and bytes-per-inode.

Why this answer

The `-I 256` flag sets the inode size to 256 bytes, and the `-i 512` flag sets the bytes-per-inode ratio to 512, meaning one inode is created for every 512 bytes of filesystem space. This yields a 1:512 block-to-inode ratio (assuming a 4096-byte block size, each block would have 8 inodes), which is ideal for a mail server storing millions of small files, as it provides a very high inode density to avoid running out of inodes.

Exam trap

The trap here is that candidates often confuse the `-I` (inode size) flag with the `-i` (bytes-per-inode) flag, or assume that setting a large block size (`-b 4096`) alone is sufficient to handle many small files, when in fact the inode ratio is the critical parameter for inode count.

How to eliminate wrong answers

Option B is wrong because while it sets the inode size to 256 bytes with `-I 256`, it does not specify the bytes-per-inode ratio; the `-b 4096` flag only sets the block size to 4096 bytes, leaving the inode ratio at the default (typically 16384 bytes per inode), which would create far too few inodes for millions of small files. Option C is wrong because `mkfs.xfs` does not support a direct bytes-per-inode ratio flag like `-i`; the `-i maxpct=50` option limits the maximum percentage of filesystem space used for inodes, but XFS is not designed for extremely high inode counts and cannot match the fine-grained control of ext4's `-i` parameter. Option D is wrong because `mkfs.btrfs` with `-s 4k` sets the sector size to 4KB, not the inode size or inode ratio; Btrfs dynamically allocates inodes and does not allow manual tuning of inode density, making it unsuitable for the specific requirement of a 1:512 block-to-inode ratio.

Full explanation →

174

Drag & Dropmedium

Arrange the steps to configure a static IP address on a Linux system using the command line.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Static IP configuration requires editing the appropriate config file, then restarting networking to apply changes.

Full explanation →

175

Multi-Selecteasy

Which TWO tools can be used to query DNS records? (Choose two.)

Select 2 answers

A.nslookup

B.ss

C.dig

D.ping

E.traceroute

AnswersA, C

Name server lookup, queries DNS.

Why this answer

A is correct because nslookup is a classic DNS query tool that sends DNS queries to name servers to resolve domain names to IP addresses or vice versa. It directly queries DNS records (A, AAAA, MX, CNAME, etc.) using the DNS protocol (UDP/TCP port 53).

Exam trap

The trap here is that candidates may confuse network diagnostic tools (ping, traceroute, ss) with DNS-specific utilities, assuming any tool that tests connectivity can also query DNS records.

Full explanation →

176

MCQmedium

The system administrator wants to add a new swap partition on /dev/sdb2. After creating the partition, which command should be used to initialize it as swap?

A.mkfs.ext4 /dev/sdb2

B.fsck /dev/sdb2

C.mkswap /dev/sdb2

D.swapon /dev/sdb2

AnswerC

mkswap sets up a Linux swap area.

Why this answer

The `mkswap` command is specifically designed to initialize a partition or file as a swap area by writing a swap signature (UUID and swap superblock) to the device. After creating the partition, you must run `mkswap /dev/sdb2` to set it up for use as swap before activating it with `swapon`.

Exam trap

The trap here is that candidates often confuse `swapon` (which activates swap) with `mkswap` (which initializes it), mistakenly thinking `swapon` can both prepare and enable the swap area.

How to eliminate wrong answers

Option A is wrong because `mkfs.ext4` creates an ext4 filesystem, which is a standard data filesystem, not a swap area; using it would overwrite the partition with filesystem metadata, making it unusable as swap. Option B is wrong because `fsck` checks and repairs an existing filesystem, but it cannot initialize a partition as swap and would fail on a partition without a recognized filesystem. Option D is wrong because `swapon` activates an already-initialized swap area; it cannot initialize a partition that has not been set up with `mkswap` first.

Full explanation →

177

MCQmedium

During system startup, GRUB 2 displays a prompt. Which command should be typed at the GRUB prompt to boot the currently selected entry normally?

A.normal

B.linux

C.initrd

D.boot

AnswerD

This command boots the already loaded kernel image.

Why this answer

At the GRUB 2 prompt, the 'boot' command instructs GRUB to load the operating system using the currently configured kernel, initrd, and root device settings. This is the standard way to proceed with normal booting after any manual adjustments or when the menu is not displayed. Without 'boot', GRUB remains at the prompt and does not transfer control to the kernel.

Exam trap

The trap here is that candidates confuse the 'boot' command with the 'linux' or 'initrd' commands, thinking those alone start the boot process, when in fact they only load components and must be followed by 'boot' to execute the actual boot.

How to eliminate wrong answers

Option A is wrong because 'normal' is not a valid GRUB 2 command; it is a GRUB Legacy command that was used to load the normal module, but in GRUB 2 the equivalent functionality is handled by the 'normal' module being loaded automatically or via 'insmod normal'. Option B is wrong because 'linux' is used to specify the kernel image path and boot parameters, not to boot the entry; it must be followed by 'boot' to actually start the kernel. Option C is wrong because 'initrd' loads an initial ramdisk image into memory, but it does not initiate the boot process; it is a preparatory command that must be followed by 'boot'.

Full explanation →

178

MCQeasy

A user reports that a cron job is not executing. The cron job is defined in /etc/crontab. The administrator checks the system logs and finds no errors. Which command should the administrator use to verify that the cron daemon is running?

A.pgrep cron

B.systemctl status cron

C.crontab -l

D.ps aux | grep cron

AnswerA

Correct. `pgrep cron` searches the process list for processes named 'cron' and returns their PIDs, quickly confirming the daemon is running.

Why this answer

`pgrep cron` searches the process table for processes named 'cron' and returns the PID(s) if running. This is a quick, reliable way to verify the cron daemon is active without parsing full process lists or relying on systemd-specific commands.

Exam trap

The trap here is that candidates may choose `systemctl status cron` assuming all Linux systems use systemd, or `ps aux | grep cron` without realizing it can produce false matches, while `pgrep cron` is the most portable and precise command for checking if a process is running.

How to eliminate wrong answers

Option B is wrong because `systemctl status cron` is a systemd command; on many Linux distributions (e.g., older SysVinit systems or minimal containers), systemd may not be the init system, and the cron service might be managed differently, so this command could fail or return misleading results. Option C is wrong because `crontab -l` lists the current user's personal crontab entries, not the system crontab (/etc/crontab), and it does not check whether the cron daemon is running. Option D is wrong because `ps aux | grep cron` can show false positives (e.g., the grep process itself matching 'cron') and is less direct than `pgrep`, which matches exact process names.

Full explanation →

179

Multi-Selectmedium

Which two commands can be used to send a test email from the command line to verify SMTP functionality? (Choose two.)

Select 2 answers

A.telnet localhost 25

B.mutt -s test user@example.com

C.mail -s test user@example.com

D.echo 'test' | sendmail user@example.com

E.sendmail -bv user@example.com

AnswersC, D

The mail command reads input and sends an email.

Why this answer

The `mail` command (option C) sends an email via the local MTA, directly testing SMTP delivery. The `sendmail` command (option D) with a piped message also invokes the MTA to deliver the email, verifying SMTP functionality. Both commands rely on the system's configured MTA to handle SMTP communication.

Exam trap

The trap here is that candidates confuse `sendmail -bv` (which only verifies addresses) with `sendmail` used to actually send a message, or they think `telnet` alone constitutes sending an email without manual SMTP commands.

Full explanation →

180

MCQeasy

Which sed command will replace the first occurrence of 'foo' with 'bar' on each line of a file?

A.sed 's/foo/bar/g' file

B.sed 's/foo/bar/0' file

C.sed 's/foo/bar/2' file

D.sed 's/foo/bar/' file

AnswerD

Default replaces first occurrence per line.

Why this answer

The default behavior of the `s` (substitute) command in sed is to replace only the first occurrence of the pattern on each line. Without a numeric flag, `sed 's/foo/bar/' file` replaces the first 'foo' on each line with 'bar'. The `g` flag would replace all occurrences, not just the first.

Exam trap

The trap here is that candidates often confuse the default behavior of sed's substitute command, assuming it replaces all occurrences unless told otherwise, and thus incorrectly choose the `g` flag option.

How to eliminate wrong answers

Option A is wrong because the `g` flag causes sed to replace all occurrences of 'foo' with 'bar' on each line, not just the first. Option B is wrong because sed does not support a `0` flag for the substitute command; the numeric flag must be a positive integer, and `0` is invalid or ignored. Option C is wrong because the `2` flag replaces the second occurrence of 'foo' on each line, not the first.

Full explanation →

181

MCQeasy

An administrator wants to list all lines in a log file that do NOT contain the word 'ERROR'. Which command should be used?

A.grep -i 'ERROR' logfile

B.grep -w 'ERROR' logfile

C.grep -v 'ERROR' logfile

D.grep 'ERROR' logfile

AnswerC

The -v option inverts the match.

Why this answer

The `-v` flag inverts the match, causing `grep` to output only lines that do NOT contain the pattern 'ERROR'. This is the standard way to exclude lines matching a pattern in a file.

Exam trap

The trap here is that candidates often confuse the `-v` invert-match flag with other common flags like `-i` (case-insensitive) or `-w` (whole-word), or simply forget that `grep` by default shows matching lines, not excluding them.

How to eliminate wrong answers

Option A is wrong because `-i` performs a case-insensitive search, which would still show lines containing 'ERROR' (or 'error', 'Error', etc.), not exclude them. Option B is wrong because `-w` matches whole words only, but it still selects lines containing 'ERROR', not excludes them. Option D is wrong because it simply prints all lines containing 'ERROR', which is the opposite of what the administrator wants.

Full explanation →

182

MCQeasy

A user reports that running '/usr/local/bin/myapp' from the command line results in 'bash: /usr/local/bin/myapp: No such file or directory'. The exhibit shows the file exists and is a valid executable. What is the most likely cause of the error?

A.The script interpreter specified in the shebang is missing.

B.The library libc.so.6 is missing.

C.The dynamic linker /lib64/ld-linux-x86-64.so.2 is missing or corrupted.

D.The file does not have execute permission for the user.

AnswerC

The binary uses this interpreter; if missing, loading fails.

Why this answer

When a dynamically linked executable exists and is valid but fails with 'No such file or directory', the most common cause is that the dynamic linker (e.g., /lib64/ld-linux-x86-64.so.2) is missing or corrupted. Bash reports this error because the kernel's execve() syscall cannot find the interpreter specified in the ELF's PT_INTERP segment, not because the executable itself is absent. This is a classic symptom distinct from a missing library, which would produce 'error while loading shared libraries'.

Exam trap

The trap here is that candidates confuse the 'No such file or directory' error for the executable itself with a missing library or permission issue, but the error actually refers to the dynamic linker that the executable depends on, not the executable file.

How to eliminate wrong answers

Option A is wrong because a missing script interpreter (e.g., /usr/bin/python) would produce a different error like 'bad interpreter: No such file or directory' or 'command not found', not the generic 'No such file or directory' for the executable path itself. Option B is wrong because a missing library such as libc.so.6 would cause a runtime error like 'error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory', not the initial 'No such file or directory' for the executable. Option D is wrong because missing execute permission would produce 'Permission denied', not 'No such file or directory'.

Full explanation →

183

MCQhard

A Linux system's hostname resolution does not consult /etc/hosts before querying DNS. Which file controls the order of name resolution services?

A./etc/nsswitch.conf

B./etc/host.conf

C./etc/resolv.conf

D./etc/dnsmasq.conf

AnswerA

This file controls the order of sources for name resolution, such as files (hosts) and DNS.

Why this answer

The /etc/nsswitch.conf file controls the order of name resolution services by defining the 'hosts' database entry, which specifies the sources (e.g., files, dns) and their lookup order. If the entry is 'hosts: dns files', the system queries DNS before /etc/hosts, bypassing the local file. This file is part of the GNU C Library's Name Service Switch (NSS) framework, which governs all system databases like passwd, group, and hosts.

Exam trap

The trap here is that candidates confuse /etc/nsswitch.conf with /etc/resolv.conf or /etc/host.conf, assuming DNS order is controlled by resolver configuration files rather than the NSS database order.

How to eliminate wrong answers

Option B is wrong because /etc/host.conf is a legacy configuration file used by the old glibc resolver (pre-NSS) to control resolver behavior, such as order (bind, hosts), but it is deprecated and not the primary mechanism on modern Linux systems. Option C is wrong because /etc/resolv.conf only specifies DNS resolver parameters (nameservers, search domains, options) and does not control the order of name resolution services or whether /etc/hosts is consulted. Option D is wrong because /etc/dnsmasq.conf is the configuration file for the dnsmasq DNS forwarder and DHCP server, which is a separate service and does not control the system-wide name resolution order used by the resolver library.

Full explanation →

184

MCQeasy

An administrator needs to check the system's load averages without displaying any process information. Which command should be used?

A.w

B.top

C.ps

D.uptime

AnswerD

Correctly displays load averages with minimal output.

Why this answer

The `uptime` command displays the current time, how long the system has been running, the number of logged-in users, and the system load averages for the past 1, 5, and 15 minutes. It does not show any process-level information, making it the correct choice for checking load averages alone.

Exam trap

The trap here is that candidates often confuse `uptime` with `w` or `top` because both also display load averages, but the question explicitly requires no process information, which `w` and `top` include.

How to eliminate wrong answers

Option A is wrong because `w` displays load averages but also shows detailed information about currently logged-in users and their processes. Option B is wrong because `top` provides a real-time, dynamic view of running processes along with load averages, which is more than what the question asks for. Option C is wrong because `ps` reports a snapshot of current processes and does not display system load averages at all.

Full explanation →

185

MCQhard

A systems administrator maintains a Linux web server running Apache HTTP Server (version 2.4) with three virtual hosts. The server logs are stored in /var/log/httpd/ and are rotated using logrotate, which is configured with the default settings that came with the Apache package. The administrator has noticed that after the nightly log rotation, the main access log file (access_log) is empty, while the rotated log files (e.g., access_log.1, access_log.2) contain the previous day's data. Furthermore, new HTTP requests are being logged into the most recent rotated file (access_log.1) instead of the current access_log file. The administrator has verified that the logrotate cron job runs successfully, and that the log files are owned by the root user with read/write permissions for the root group. No errors appear in the system logs. The Apache service continues to run and serve web pages. Which of the following actions should the administrator take to ensure that Apache writes new log entries to the current access_log file after rotation?

A.Modify the Apache configuration to set the 'RotateLogs' directive and restart the service.

B.Add a postrotate script to the logrotate configuration that sends a USR1 or HUP signal to the Apache process to cause it to reopen the log files.

C.Change the logrotate frequency to 'weekly' so that the log is not rotated as often.

D.Set the 'copytruncate' directive in the logrotate configuration to copy the log file and truncate the original, so Apache can continue writing without interruption.

AnswerB

This is the standard method: after rotation, Apache needs to be signaled to reopen the log files to write to the new file.

Why this answer

The issue is that after logrotate moves the current access_log to access_log.1, Apache continues writing to the old file descriptor (now pointing to access_log.1) because it never reopened the log file. Sending a USR1 or HUP signal to Apache causes it to close and reopen its log files, creating a new access_log and writing new entries there. This is the standard method for log rotation with Apache and other daemons that keep file handles open.

Exam trap

The trap here is that candidates may think 'copytruncate' is a safe, signal-free solution, but they overlook the risk of data loss between the copy and truncate operations, making the postrotate signal method the correct and reliable choice for Apache.

How to eliminate wrong answers

Option A is wrong because Apache 2.4 does not have a 'RotateLogs' directive; log rotation is handled externally by logrotate, not by Apache itself. Option C is wrong because changing the frequency to weekly does not fix the core problem of Apache writing to the wrong file after rotation; it only delays the issue. Option D is wrong because 'copytruncate' would copy the log and truncate the original, which avoids the need for a signal, but it can cause data loss (entries written between copy and truncate) and is not the standard or recommended approach for Apache; the correct method is to use a postrotate script with a signal.

Full explanation →

186

MCQeasy

You are a system administrator for a small company running a web server on Ubuntu 20.04 LTS. The web server application was installed using apt from the official repositories. Recently, a critical security patch was released for the web server package. You run 'apt update' and 'apt upgrade' but the package is not upgraded. You check the package status with 'apt-cache policy <package>' and see that the installed version is 2.4.41-4ubuntu3.6, and the candidate version is the same. The latest patched version in the repository is 2.4.41-4ubuntu3.7. You verify that the system has internet connectivity and that the repository URLs in /etc/apt/sources.list are correct. What is the most likely reason the upgrade is not being offered?

A.Add the universe repository to sources.list and run 'apt update'.

B.Run 'apt-mark unhold <package>' and then 'apt upgrade'.

C.Use 'apt dist-upgrade' instead of 'apt upgrade'.

D.Run 'apt install <package>' which will force the upgrade.

AnswerB

If the package is held, it will not be upgraded. Unholding allows the upgrade.

Why this answer

The most likely reason is that the package has been placed on hold using 'apt-mark hold', which prevents it from being upgraded even when a newer version is available in the repository. Running 'apt-mark unhold <package>' removes this hold, allowing 'apt upgrade' to proceed normally.

Exam trap

The trap here is that candidates may assume the issue is with repository configuration or command syntax, when in fact the package hold mechanism is a subtle but common administrative action that directly prevents upgrades.

How to eliminate wrong answers

Option A is wrong because the universe repository is not relevant; the web server package is in the main repository, and adding universe would not provide the patched version. Option C is wrong because 'apt dist-upgrade' handles dependency changes but does not bypass package holds; if the package is held, dist-upgrade will also skip it. Option D is wrong because 'apt install <package>' will upgrade the package even if it is held, but this is not the most likely reason the upgrade is not being offered; the question asks for the most likely cause, and a hold is a common administrative action that prevents upgrade, whereas force-installing bypasses the hold without addressing the underlying issue.

Full explanation →

187

MCQmedium

A technician is troubleshooting a system that fails to boot with the error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. What is the most likely cause?

A.The init binary is missing or corrupted.

B.The root filesystem is corrupted and needs fsck.

C.The kernel lacks the necessary driver for the storage controller.

D.The boot loader is not installed correctly.

AnswerC

Kernel cannot access the root device due to missing storage driver.

Why this answer

The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate or access the root filesystem. This typically occurs because the kernel lacks the necessary driver (module) for the storage controller (e.g., SATA, SCSI, NVMe) that the root device is connected to, so it cannot read the partition table or mount the root filesystem.

Exam trap

The trap here is that candidates often confuse a root filesystem corruption error with a missing storage driver error, because both can prevent booting, but the specific 'unknown-block(0,0)' message uniquely points to the kernel's inability to identify the block device, not a filesystem issue.

How to eliminate wrong answers

Option A is wrong because a missing or corrupted init binary would cause a different error, such as 'Kernel panic - not syncing: No init found' or 'Failed to execute /sbin/init', not a VFS mount failure on unknown-block(0,0). Option B is wrong because a corrupted root filesystem would typically produce filesystem-specific errors (e.g., 'EXT4-fs error') or a kernel panic with a different message, not the unknown-block(0,0) error which indicates the device itself is unrecognized. Option D is wrong because an incorrectly installed boot loader would prevent the kernel from being loaded at all (e.g., 'Missing operating system' or 'GRUB error'), not cause the kernel to fail mounting the root filesystem after it has already started executing.

Full explanation →

188

MCQmedium

Refer to the exhibit. A user runs 'python --version' and gets 'Python 3.9.1'. Which command would run Python 2 instead?

A.python --version2

B.python2

C.python3

D.python2 --version

AnswerB

python2 is a separate executable and will run Python 2.

Why this answer

On many Linux distributions, Python 2 and Python 3 are installed side by side, with the `python` command typically linked to Python 2 (or sometimes Python 3, depending on the distribution). However, in this scenario, `python --version` returns 'Python 3.9.1', indicating that `python` is linked to Python 3. To explicitly run Python 2, you must use the `python2` command, which is the standard binary name for Python 2.x installations.

Exam trap

The trap here is that candidates may assume `python` always refers to Python 2, but the question shows it is Python 3, so they must recognize that `python2` is the explicit command for Python 2, not `python3` or a version flag.

How to eliminate wrong answers

Option A is wrong because `--version2` is not a valid flag for Python; it would cause an error or be ignored. Option C is wrong because `python3` would run Python 3, not Python 2, and the question asks for Python 2. Option D is wrong because while `python2 --version` would display the version of Python 2, the question asks for the command that would run Python 2, not just display its version; the correct command to run Python 2 is simply `python2`.

Full explanation →

189

MCQhard

A company's server administrator needs to replace an existing DNS server (192.168.1.10) with a new one (192.168.1.20). Which file must be updated on all DHCP clients to ensure they use the new DNS server?

A./etc/dhcp/dhcpd.conf

B./etc/resolv.conf

C./etc/nsswitch.conf

D./etc/hosts

AnswerA

DHCP server config; update DNS options and restart DHCP.

Why this answer

The DHCP server configuration file /etc/dhcp/dhcpd.conf contains the 'option domain-name-servers' directive that specifies which DNS servers are handed out to DHCP clients. When a client renews its lease, it receives the new DNS server IP (192.168.1.20) from the DHCP server, updating the client's /etc/resolv.conf automatically. This is the proper way to centrally manage DNS server assignments across all DHCP clients.

Exam trap

The trap here is that candidates confuse the client-side file /etc/resolv.conf with the server-side configuration that actually controls what DNS servers are distributed, leading them to think editing resolv.conf directly is the correct approach.

How to eliminate wrong answers

Option B is wrong because /etc/resolv.conf is the client-side file that lists DNS servers for local resolution, but it is typically overwritten by the DHCP client (e.g., dhclient) with values received from the DHCP server; manually editing it on each client is not a scalable solution for replacing a DNS server. Option C is wrong because /etc/nsswitch.conf controls the order of name resolution sources (e.g., files, dns, mdns) but does not specify DNS server IP addresses. Option D is wrong because /etc/hosts provides static IP-to-hostname mappings and has no role in assigning DNS server addresses to clients.

Full explanation →

190

Multi-Selecteasy

Which TWO commands are used to install packages on a Debian-based system? (Choose two.)

Select 2 answers

A.pacman -S

B.apt-get install

C.dpkg -i

D.rpm -i

E.yum install

AnswersB, C

This installs packages from repositories.

Why this answer

B is correct because `apt-get install` is the standard command-line tool for installing packages from Debian repositories, handling dependencies automatically. C is correct because `dpkg -i` installs a local `.deb` package file directly, though it does not resolve dependencies.

Exam trap

The trap here is that candidates often confuse package managers across distributions, mistakenly associating `rpm` or `yum` with Debian systems due to superficial familiarity with Linux package management.

Full explanation →

191

MCQhard

A directory contains files with spaces and special characters in their names. An administrator wants to delete all files older than 30 days using find and xargs. Which command is safe?

A.find /path -type f -mtime +30 -delete

B.find /path -type f -mtime +30 -exec rm {} \;

C.find /path -type f -mtime +30 | xargs rm

D.find /path -type f -mtime +30 -print0 | xargs -0 rm

AnswerD

Uses null delimiter to safely handle any filename.

Why this answer

It uses `-print0` with `find` to output null-delimited filenames, and `xargs -0` to process them safely. This handles spaces, newlines, and special characters in filenames without word-splitting or shell interpretation, ensuring all matching files older than 30 days are deleted reliably.

Exam trap

The trap here is that candidates often choose option C, overlooking the fact that default xargs splits on whitespace and interprets quotes, making it unsafe for filenames with spaces or special characters, while `-print0` and `-0` are the correct safe approach.

How to eliminate wrong answers

Option A is wrong because `-delete` is not a standard POSIX find option and may not be available on all systems; it also does not use xargs as required. Option B is wrong because `-exec rm {} \;` forks a new rm process for each file, which is inefficient and does not use xargs. Option C is wrong because piping `find` output directly to `xargs rm` without `-print0` and `-0` causes filenames with spaces or special characters to be split into multiple arguments, leading to errors or unintended deletions.

Full explanation →

192

MCQmedium

A Linux system has a 500GB SSD. The administrator wants to partition it to support a web server with the following requirements: root (/) 20GB, swap 4GB, /var 50GB, /home 100GB, and the remaining for /srv. Which partitioning strategy is best practice according to the FHS and performance considerations?

A.Use a single partition for root, but create separate partitions for /tmp, /var, /home, and /srv.

B.Create a single LVM volume group with logical volumes for each mount point.

C.Create separate partitions for root, swap, /var, /home, and /srv.

D.Allocate one large partition for root and use bind mounts for /var, /home, and /srv.

AnswerC

Separate partitions provide isolation, prevent one oversize from affecting others, and allow different mount options per filesystem.

Why this answer

Creating separate partitions for root, swap, /var, /home, and /srv aligns with best practices for the Filesystem Hierarchy Standard (FHS) and performance isolation. This approach prevents one filesystem from exhausting space needed by another (e.g., runaway logs in /var cannot fill /home) and allows independent mount options (e.g., noexec on /home) and filesystem tuning for each mount point.

Exam trap

The trap here is that candidates often choose LVM (Option B) thinking it is always best practice for flexibility, but the question explicitly asks for best practice according to the FHS and performance considerations — for a fixed-size single disk with known requirements, simple partitions are simpler, faster, and more aligned with FHS separation principles than LVM's added abstraction layer.

How to eliminate wrong answers

Option A is wrong because it omits a separate swap partition (required for virtual memory) and includes /tmp, which is not requested; the FHS does not mandate separate /tmp for a web server, and the requirement specifies swap, not /tmp. Option B is wrong because while LVM offers flexibility, the question asks for 'best practice according to the FHS and performance considerations' — LVM adds complexity and potential performance overhead (e.g., metadata I/O, lack of direct block alignment) compared to simple partitions for a fixed-size, single-disk scenario; the FHS does not require LVM. Option D is wrong because bind mounts do not provide independent filesystem boundaries; all data resides on the root partition, so a full root filesystem would still affect /var, /home, and /srv, defeating the purpose of isolation and risking system instability.

Full explanation →

193

MCQhard

An administrator reviews the above DHCP server logs. Based on the output, which statement is correct about the DHCP transaction?

A.The client sent a DHCPINFORM to renew its existing lease.

B.The DHCP server is configured to assign IP addresses from a pool that includes 192.168.1.100.

C.The client successfully obtained the IP address 192.168.1.100.

D.The DHCP server rejected the client's request because the DHCPREQUEST was not broadcast.

AnswerC

DHCPACK confirms the lease assignment.

Why this answer

The DHCP server logs show a successful four-way handshake: DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, and DHCPACK. The final DHCPACK from the server confirms that the client has been granted the IP address 192.168.1.100, making option C correct.

Exam trap

The trap here is that candidates may confuse the DHCPREQUEST broadcast requirement with a rejection, or incorrectly assume that a DHCPINFORM is used for lease renewal, when in fact DHCPINFORM is only for stateless configuration requests.

How to eliminate wrong answers

Option A is wrong because a DHCPINFORM is used by a client that already has an IP address to request additional configuration parameters (like DNS servers), not to renew a lease; lease renewal uses DHCPREQUEST (unicast). Option B is wrong because the logs only show that 192.168.1.100 was offered and acknowledged; they do not indicate whether this address comes from a pool that includes 192.168.1.100 — the server could be configured with a static reservation or a different pool. Option D is wrong because the DHCPREQUEST in a typical renewal or selection phase is sent as a broadcast (with the 'broadcast' flag set) to ensure all DHCP servers on the subnet receive it; the server did not reject the request, as evidenced by the DHCPACK.

Full explanation →

194

MCQeasy

Refer to the exhibit. A system administrator runs 'ip route show default' and gets this output. What does it indicate?

A.The DNS server is 192.168.1.1.

B.The default route points to gateway 192.168.1.1 on interface eth0.

C.The system has no internet access.

D.The IP address of the system is 192.168.1.1.

AnswerB

That is exactly what the output means.

Why this answer

The command 'ip route show default' displays the default route entry in the kernel routing table. The output shows that the default route (destination 0.0.0.0/0) is via gateway 192.168.1.1 and uses interface eth0, meaning all traffic not matching a more specific route is sent to that gateway on that interface.

Exam trap

The trap here is confusing the default gateway with other network parameters like DNS server or the system's own IP address, leading candidates to incorrectly associate the gateway IP with those unrelated services.

How to eliminate wrong answers

Option A is wrong because the default route specifies a gateway for network traffic, not a DNS server; DNS server configuration is handled in /etc/resolv.conf or via systemd-resolved, not in the routing table. Option C is wrong because having a default route to 192.168.1.1 indicates the system has a path to reach external networks, provided the gateway is operational and the system has proper connectivity. Option D is wrong because the IP address of the system is not shown in the default route output; the system's IP address is typically found using 'ip addr show' or 'ifconfig', and 192.168.1.1 is the gateway address, not the system's own address.

Full explanation →

195

MCQmedium

A Linux administrator is troubleshooting a package dependency issue. When attempting to install package 'foo', the package manager reports a missing dependency 'libbar.so.2'. Which of the following is the most appropriate next step?

A.Run 'ldconfig' to update the library cache

B.Reinstall the 'foo' package using 'rpm -i --force foo.rpm'

C.Run 'rpm -q --whatrequires libbar.so.2'

D.Use 'apt-file search libbar.so.2' or 'dnf provides libbar.so.2' to find the package that contains the file

AnswerD

Identifies the package providing the missing library.

Why this answer

The error indicates that the file 'libbar.so.2' is missing from the system. The most appropriate next step is to identify which package provides this file, so that it can be installed to satisfy the dependency. On Debian-based systems, 'apt-file search' queries the package repository metadata to find the package containing a specific file; on Red Hat-based systems, 'dnf provides' performs the same function.

This targeted search is the correct first troubleshooting step before any installation or library cache update.

Exam trap

The trap here is that candidates may confuse 'ldconfig' (which only updates the cache for already-installed libraries) with a tool that can resolve missing dependencies, or they may think that forcing installation with '--force' is an acceptable workaround, when in fact it bypasses safety checks and can lead to system instability.

How to eliminate wrong answers

Option A is wrong because 'ldconfig' updates the runtime linker cache for shared libraries that are already installed; it cannot install missing libraries or resolve a missing file dependency. Option B is wrong because using 'rpm -i --force' forces installation of the package even if dependencies are missing, which can leave the system in a broken or inconsistent state and is not a proper resolution. Option C is wrong because 'rpm -q --whatrequires libbar.so.2' queries which installed packages depend on that file, but the file is not present on the system, so the command will return nothing useful and does not help locate the missing provider.

Full explanation →

196

MCQmedium

An administrator wants to prevent a specific user, 'john', from being able to schedule cron jobs. Which file should the administrator modify?

A./var/spool/cron/crontabs

B./etc/cron.allow

C./etc/crontab

D./etc/cron.deny

AnswerD

Add 'john' to this file to prevent him from using cron.

Why this answer

The /etc/cron.deny file lists users who are explicitly denied access to schedule cron jobs. If this file exists and the user 'john' is listed in it, he will be prevented from using crontab. This is the standard mechanism for restricting cron access when /etc/cron.allow does not exist.

Exam trap

The trap here is that candidates confuse /etc/cron.allow with /etc/cron.deny, thinking that modifying the allow file is the only way to control access, but the question specifically asks for a file to prevent a user, which is the deny file.

How to eliminate wrong answers

Option A is wrong because /var/spool/cron/crontabs is a directory containing individual user crontab files, not a configuration file for access control. Option B is wrong because /etc/cron.allow is used to explicitly allow users to schedule cron jobs; modifying it would not prevent 'john' unless he is removed from it, but the question asks for a file to prevent him, and /etc/cron.deny is the direct method. Option C is wrong because /etc/crontab is the system-wide cron table for scheduled tasks, not a user access control file.

Full explanation →

197

MCQeasy

Which directory contains information about hardware devices in a hierarchical structure, such as PCI devices and USB devices?

A./sys

B./dev

C./etc

D./proc

AnswerA

/sys (sysfs) provides detailed device hierarchy and attributes.

Why this answer

The /sys directory (sysfs) is a virtual filesystem that exports information about hardware devices, drivers, and kernel objects in a hierarchical structure. It organizes devices by their bus type (e.g., PCI, USB) and provides detailed attributes such as vendor IDs, device IDs, and power management states, making it the correct location for querying hardware topology.

Exam trap

The trap here is that candidates confuse /proc (which also contains some hardware info like /proc/cpuinfo) with /sys, but /proc lacks the structured, hierarchical device topology that sysfs provides for buses like PCI and USB.

How to eliminate wrong answers

Option B (/dev) is wrong because it contains device special files (e.g., /dev/sda, /dev/ttyUSB0) for accessing hardware via block or character I/O, not a hierarchical representation of device relationships. Option C (/etc) is wrong because it stores system configuration files (e.g., /etc/fstab, /etc/ssh/sshd_config), not dynamic hardware information. Option D (/proc) is wrong because it primarily exposes process and kernel runtime data (e.g., /proc/cpuinfo, /proc/meminfo) in a flat or process-centric structure, not a hierarchical device tree.

Full explanation →

198

Multi-Selectmedium

Which TWO of the following are true about the 'source' command in bash?

Select 2 answers

A.It executes a script in a subshell.

B.It is only available in bash and not in POSIX sh.

C.It can be abbreviated as '.' (dot).

D.It executes a script in the current shell.

E.It requires the script to have execute permission.

AnswersC, D

The dot is a synonym for source.

Why this answer

The 'source' command can be abbreviated as a single dot ('.') in bash and other POSIX-compliant shells. This dot notation is a standard feature defined by POSIX, and both forms execute the script in the current shell environment, not a subshell.

Exam trap

The trap here is that candidates often confuse 'source' with executing a script directly (which requires execute permission and runs in a subshell), or mistakenly think the dot abbreviation is a bash-only feature, when it is actually defined by POSIX.

Full explanation →

199

MCQhard

A mail server using Postfix is rejecting emails from a partner domain. The administrator checks the maillog and sees 'relay access denied'. Which Postfix configuration parameter is most likely misconfigured?

A.mydestination

B.inet_interfaces

C.relayhost

D.mynetworks

AnswerD

mynetworks specifies IP ranges allowed to relay.

Why this answer

(mynetworks) is correct because it defines which client IP addresses are allowed to relay mail through the server. The 'relay access denied' error indicates that the partner domain's mail server is not in the trusted network list. Option A (mydestination) specifies local destination domains, not relay permissions.

Option B (inet_interfaces) controls listening interfaces. Option C (relayhost) sets the next-hop relay for outbound mail. Therefore, mynetworks is the likely misconfiguration.

Full explanation →

200

Multi-Selecthard

Which TWO of the following are true about the /proc filesystem?

Select 2 answers

A.It is formatted with the ext4 filesystem.

B.It is a network filesystem.

C.It is a pseudo-filesystem that contains runtime system information.

D.It is used to store persistent configuration data.

E.It is typically mounted at boot time.

AnswersC, E

Correct: /proc is virtual.

Why this answer

The /proc filesystem is a pseudo-filesystem that does not exist on disk; it is created by the kernel at runtime to expose system and process information (e.g., /proc/cpuinfo, /proc/meminfo). It provides a mechanism for user-space programs to query kernel data structures without making system calls directly.

Exam trap

The trap here is that candidates often confuse /proc with a real filesystem stored on disk, leading them to select Option A, or they mistake its runtime nature for persistent storage (Option D), when in fact /proc is a volatile kernel interface that is mounted automatically at boot (Option E).

Full explanation →

201

MCQeasy

The administrator wants the sshd service to start automatically at boot. Which command should be used?

A.systemctl start sshd.service

B.systemctl daemon-reload

C.systemctl set-default multi-user.target

D.systemctl enable sshd.service

AnswerD

Enables the service to start automatically at boot.

Why this answer

The `systemctl enable sshd.service` command creates the necessary symlinks in the systemd unit configuration directories (e.g., `/etc/systemd/system/multi-user.target.wants/`) so that the sshd service is automatically started when the system boots into its default target. This is the correct way to enable a service to start at boot in a systemd-based Linux distribution.

Exam trap

The trap here is confusing `systemctl start` (immediate, one-time activation) with `systemctl enable` (persistent boot-time activation), leading candidates to choose option A when the question asks for automatic startup at boot.

How to eliminate wrong answers

Option A is wrong because `systemctl start sshd.service` only starts the service immediately in the current session; it does not configure it to start automatically at boot. Option B is wrong because `systemctl daemon-reload` reloads the systemd manager configuration after unit files have been changed, but it does not enable or disable any service for boot-time startup. Option C is wrong because `systemctl set-default multi-user.target` changes the default systemd target (runlevel) that the system boots into, but it does not enable a specific service like sshd to start at boot.

Full explanation →

202

MCQeasy

A system administrator needs to check if a filesystem has any errors without actually performing a repair. Which command should be used?

A.fsck -y /dev/sdb1

B.fsck -N /dev/sdb1

C.fsck -n /dev/sdb1

D.e2fsck -p /dev/sdb1

AnswerC

fsck -n performs a non-interactive, read-only check.

Why this answer

The `-n` option with `fsck` performs a read-only check, displaying any filesystem errors without making any modifications or repairs. This is the correct choice for a non-destructive check that only reports issues.

Exam trap

The trap here is confusing `-N` (which only shows what would be checked without actually scanning) with `-n` (which performs a read-only scan), leading candidates to mistakenly choose the dry-run option instead of the actual read-only check.

How to eliminate wrong answers

Option A is wrong because `fsck -y` automatically answers 'yes' to all repair prompts, which would attempt to fix errors, not just check for them. Option B is wrong because `fsck -N` only shows what would be done (a dry-run) without actually checking the filesystem for errors. Option D is wrong because `e2fsck -p` automatically repairs filesystem issues without prompting, which performs repairs rather than just checking.

Full explanation →

203

MCQmedium

Which command can be used to check whether a specific kernel module is currently loaded?

A.modinfo <module>

B.lsmod | grep <module>

C.depmod -a

D.insmod <module>

AnswerB

lsmod lists loaded modules; grep filters.

Why this answer

`lsmod` lists all currently loaded kernel modules by reading the `/proc/modules` file, and piping its output through `grep` filters for the specific module name. This directly shows whether the module is loaded in the running kernel, which is the exact requirement of the question.

Exam trap

The trap here is that candidates confuse `modinfo` (which shows module information from disk) with `lsmod` (which shows runtime load status), leading them to incorrectly select option A.

How to eliminate wrong answers

Option A is wrong because `modinfo` displays metadata about a kernel module (such as description, author, and parameters) from the module file itself, but it does not check whether the module is currently loaded into the kernel. Option C is wrong because `depmod -a` generates dependency files (modules.dep) for all modules in the kernel tree, but it does not report on the current load status of any module. Option D is wrong because `insmod` is used to insert (load) a module into the kernel, not to check if it is already loaded; attempting to load an already-loaded module will typically fail with an error like 'File exists'.

Full explanation →

204

Multi-Selectmedium

Which THREE steps are required to configure a network interface with a static IP address using the ip command (assuming interface eth0)? (Choose three.)

Select 3 answers

A.ifconfig eth0 192.168.1.10 netmask 255.255.255.0

B.ip route add default via 192.168.1.1

C.ip addr add 192.168.1.10/24 dev eth0

D.ip link set eth0 up

E.echo 'nameserver 8.8.8.8' > /etc/resolv.conf

AnswersB, C, D

Adds default gateway.

Why this answer

The `ip route add default via 192.168.1.1` command sets the default gateway for the system, which is essential for routing traffic to networks beyond the local subnet. Without a default route, the static IP configuration would only allow communication within the local network (192.168.1.0/24), making this step mandatory for full network connectivity.

Exam trap

The trap here is that candidates often confuse the `ip` command with legacy tools like `ifconfig` (option A) or include DNS configuration (option E) as part of the `ip` command workflow, when in fact DNS is handled by separate system services and not by the `ip` command.

Full explanation →

205

Multi-Selectmedium

Which TWO commands can display the UUID of block devices?

Select 2 answers

A.blkid

B.lsblk -f

C.df -T

D.fdisk -l

E.parted /dev/sda print

AnswersA, B

blkid displays block device attributes including UUID.

Why this answer

The `blkid` command directly queries the libblkid library to locate and display block device attributes, including the UUID, from the device's superblock. `lsblk -f` lists block devices and their filesystem information, which includes the UUID, by reading sysfs and udev databases. Both commands reliably output the UUID for block devices.

Exam trap

The trap here is that candidates confuse commands that display partition table information (like `fdisk` and `parted`) with commands that display filesystem metadata (like `blkid` and `lsblk -f`), leading them to select options that show partition layout but not UUIDs.

Full explanation →

206

MCQhard

A medium-sized company runs a web server on Linux with two 1TB disks in a software RAID1 (mdadm) configuration for the root filesystem and /var. Recently, the /var partition is reporting low disk space. The administrator discovers that old log files are consuming space but should be rotated. However, the logrotate service is not running. After starting logrotate, it fails to rotate some logs because of missing directories. Additionally, the administrator wants to add a third disk (500GB SSD) for additional storage and mount it under /srv/webdata. The disk is new and not partitioned. The server uses systemd and the current /etc/fstab uses UUIDs. What is the correct sequence of steps to add the new disk and ensure it is mounted automatically at boot?

A.Format the disk with ext4, add an entry to /etc/fstab using the device path /dev/sdc with the nofail option, then mount -a.

B.Partition the disk with fdisk, create an ext4 filesystem, create the mount point, mount the filesystem, obtain the UUID, add an entry to /etc/fstab using the UUID, and run mount -a to verify.

C.Add the disk to the existing RAID1 array to expand it, then grow the filesystem to use the new space.

D.Initialize the disk as an LVM physical volume, extend the existing volume group, create a logical volume, format it, mount it, and add to /etc/fstab.

AnswerB

This is the correct, standard procedure.

Why this answer

It follows the standard procedure for adding a new disk to a Linux system: partition the disk (even if only one partition is needed), create a filesystem, create a mount point, mount it, obtain the UUID (e.g., via blkid), add an entry to /etc/fstab using the UUID for reliable boot-time mounting, and verify with mount -a. This ensures the disk is mounted automatically at boot, independent of device name changes, and aligns with systemd's expectation of UUID-based fstab entries.

Exam trap

The trap here is that candidates may think they can skip partitioning (Option A) or assume LVM is always better (Option D), but the LPIC-1 exam expects the standard, safe procedure of partitioning, formatting, and using UUIDs in fstab for a new disk.

How to eliminate wrong answers

Option A is wrong because it skips partitioning (a new disk must be partitioned before creating a filesystem, even if using the whole disk), uses the device path /dev/sdc instead of a UUID (which can change on reboot, especially with multiple disks), and the nofail option is unnecessary and not a substitute for proper fstab configuration. Option C is wrong because adding the disk to the existing RAID1 array would expand the array but not create a separate mount point under /srv/webdata; it would also require resyncing and growing the filesystem, which is not the stated goal of adding a third disk for additional storage. Option D is wrong because while LVM is a valid approach, the question does not mention LVM being in use, and the current setup uses software RAID1 and UUID-based fstab; introducing LVM would require additional steps (creating a volume group, logical volume) that are not part of the standard simple disk addition procedure, and the correct answer must match the simplest and most direct method described in the scenario.

Full explanation →

207

MCQhard

An administrator runs the command 'find / -name "*.conf" 2>/dev/null | head -n 10' and notices that the command returns very quickly. Which statement best describes what happened?

A.It scans the entire filesystem but stops after sending the first 10 lines to head due to a broken pipe.

B.It lists 10 .conf files only from the current directory because the path is /.

C.It lists all .conf files in the filesystem because head only affects output, not find.

D.It lists only the first 10 .conf files found in the filesystem.

AnswerA

Find continues until it tries to write after head closes, then stops.

Why this answer

The `find` command starts scanning the entire filesystem from root (`/`), but its output is piped to `head -n 10`, which reads only the first 10 lines and then closes the pipe. When `head` closes the pipe, `find` receives a SIGPIPE signal (broken pipe) and terminates early, so the command returns very quickly without scanning the entire filesystem.

Exam trap

The trap here is that candidates often think `head` simply filters output after the command finishes, not realizing that pipe-induced SIGPIPE causes the upstream command to terminate early, which is why the command returns quickly.

How to eliminate wrong answers

Option B is wrong because the path `/` specifies the root directory, not the current directory; `find /` starts the search from the root of the filesystem, not from the current working directory. Option C is wrong because `head` does affect the `find` command via the pipe: when `head` exits after reading 10 lines, it closes the pipe, causing `find` to receive a broken pipe signal and stop. Option D is wrong because it implies `find` completes its full scan and then `head` selects the first 10 lines, but in reality `find` stops early due to the broken pipe, which is why the command returns quickly.

Full explanation →

208

MCQhard

A server runs systemd-resolved and uses a VPN. DNS queries fail intermittently. The administrator checks /etc/resolv.conf and finds it is a symlink to /run/systemd/resolve/stub-resolv.conf. Which command should be used to view the effective DNS servers and debug the issue?

A.cat /etc/resolv.conf

B.resolvectl status

C.systemctl restart systemd-resolved

D.dig @localhost

AnswerB

resolvectl status shows per-link DNS servers and overall resolver configuration.

Why this answer

B is correct because `resolvectl status` is the native command for querying systemd-resolved's internal state, showing the per-link DNS servers, search domains, and current resolver configuration. Since `/etc/resolv.conf` is a symlink to the stub resolver, `cat /etc/resolv.conf` only shows the stub listener address (127.0.0.53), not the actual upstream DNS servers used by systemd-resolved. `resolvectl status` reveals the effective DNS servers for each network interface, including VPN interfaces, which is essential for debugging intermittent failures.

Exam trap

The trap here is that candidates assume `cat /etc/resolv.conf` shows the real DNS servers, but because it is a symlink to the stub resolver's configuration, it only shows 127.0.0.53, masking the actual upstream servers that systemd-resolved uses.

How to eliminate wrong answers

Option A is wrong because `cat /etc/resolv.conf` only displays the stub resolver's loopback address (127.0.0.53), not the actual upstream DNS servers that systemd-resolved queries; this gives no insight into which DNS servers are failing. Option C is wrong because `systemctl restart systemd-resolved` is a brute-force action that disrupts all active DNS resolution and does not provide diagnostic information about current DNS servers or intermittent failures. Option D is wrong because `dig @localhost` sends queries to the stub resolver on 127.0.0.53, which may succeed even when upstream queries fail, and it does not reveal which upstream servers are configured or their status.

Full explanation →

209

MCQmedium

You work for a hosting company that manages hundreds of CentOS 7 servers. Each server runs a standard set of monitoring tools. Your team needs to deploy a custom monitoring agent that is only available as source code (tarball). The agent must be installed on all servers from a central repository. You have set up an internal YUM repository with the compiled RPMs of the agent. On a test server, you run 'yum install custom-agent', but it fails with a message that the package is not found. You verify the package is present in the repository directory and that the createrepo command has been run. Which step is most likely missing?

A.The GPG key for the repository is not imported.

B.The package architecture does not match (e.g., x86_64 package on i386).

C.The .repo file references the wrong baseurl hostname.

D.The repository is not being served via HTTP or FTP; it is only available as a local file path.

AnswerD

YUM expects an HTTP/HTTPS/FTP URL unless using file:/// but baseurl often omitted.

Why this answer

The scenario states the repository is set up as an internal YUM repository with compiled RPMs, but yum requires the repository to be accessible via HTTP, FTP, or a local file:// path. If the repository is only available as a local file path on the server and not served via a web server (e.g., Apache or Nginx) or FTP, yum will fail to find the package unless the .repo file explicitly uses a file:// URL. Since the question implies a central repository accessed by multiple servers, a local file path without proper serving would not be reachable by yum over the network.

Exam trap

The trap here is that candidates assume running createrepo is sufficient for yum to find packages, overlooking that yum must be able to access the repository metadata over a network protocol, not just have the files present locally.

How to eliminate wrong answers

Option A is wrong because a missing GPG key would cause a signature verification warning or error, not a 'package not found' message; yum would still locate the package but refuse to install it due to missing key. Option B is wrong because an architecture mismatch would produce a specific error about incompatible architecture, not a generic 'package not found' message; yum would still see the package but reject it. Option C is wrong because a wrong baseurl hostname would cause a connection error (e.g., 'Cannot find a valid baseurl for repo') rather than a 'package not found' message; the repository would be unreachable entirely.

Full explanation →

210

MCQeasy

Which command displays information about currently loaded kernel modules?

A.insmod

B.modinfo

C.lsmod

D.modprobe -l

AnswerC

Lsmod shows currently loaded kernel modules from /proc/modules.

Why this answer

The `lsmod` command reads the `/proc/modules` file to display a list of all currently loaded kernel modules, showing their name, size, usage count, and dependent modules. This is the standard tool for querying the current module state in the Linux kernel.

Exam trap

The trap here is that candidates confuse `lsmod` (list loaded modules) with `modinfo` (show module metadata) or `modprobe -l` (list available modules), because all three commands relate to kernel modules but serve distinct purposes.

How to eliminate wrong answers

Option A is wrong because `insmod` is used to insert a kernel module into the running kernel, not to display information about loaded modules. Option B is wrong because `modinfo` displays metadata (such as description, author, and parameters) from a module file, not a list of currently loaded modules. Option D is wrong because `modprobe -l` is a deprecated option that listed available module files in the module tree, not currently loaded modules; modern `modprobe` does not support `-l` and it was never used to show loaded modules.

Full explanation →

211

MCQeasy

Which of the following directories is NOT defined in the Filesystem Hierarchy Standard (FHS)?

A./run

B./proc

C./net

D./media

E./sys

AnswerC

/net is not defined in the FHS.

Why this answer

The /net directory is not defined in the Filesystem Hierarchy Standard (FHS). The FHS specifies standard directory locations like /run, /proc, /media, and /sys, but /net is not a required or standard directory; it may appear in some systems as a mount point for network filesystems but is not part of the FHS specification.

Exam trap

The trap here is that candidates may assume /net is a standard FHS directory because it appears in some distributions for network mounts, but the FHS does not define it, and the exam expects knowledge of the official standard directories.

How to eliminate wrong answers

Option A is wrong because /run is defined in FHS as a tmpfs directory for storing volatile runtime data since FHS 3.0. Option B is wrong because /proc is defined in FHS as a virtual filesystem providing process and kernel information. Option D is wrong because /media is defined in FHS as the mount point for removable media devices.

Option E is wrong because /sys is defined in FHS as a virtual filesystem for kernel and device information (sysfs).

Full explanation →

212

MCQhard

Refer to the exhibit. The /var partition is nearly full. Which of the following is the most appropriate first step to free up space?

A.Move some files from /var to / and create a symbolic link.

B.Delete old log files in /var/log and clear package cache.

C.Increase the size of /dev/sdb2 using resize2fs.

D.Add a new disk and mount it to /var.

AnswerB

Log files and cached packages often consume large space and can be safely removed.

Why this answer

The most common cause of a full /var partition is accumulated log files in /var/log and cached package data. Deleting old logs (e.g., via logrotate or manual cleanup) and clearing the package manager cache (e.g., apt-get clean or yum clean all) directly reclaims space without requiring disk resizing or additional hardware. This is the safest and fastest first step before considering more invasive actions.

Exam trap

The trap here is that candidates often jump to resizing the partition or adding a disk (options C and D) because they think the problem requires a hardware or filesystem-level solution, when in fact the simplest and most appropriate first step is to clean up temporary and log files that can be safely removed.

How to eliminate wrong answers

Option A is wrong because moving files from /var to / and creating a symbolic link may break system services that expect specific paths under /var, and it does not address the root cause of space usage; it also risks filling the root partition. Option C is wrong because resize2fs can only increase the size of an ext2/ext3/ext4 filesystem if there is unallocated space on the underlying block device (e.g., after resizing the partition with fdisk or parted), and simply running resize2fs without first expanding the partition will fail or do nothing. Option D is wrong because adding a new disk and mounting it to /var is an overly complex and disruptive first step; it requires repartitioning, formatting, and moving data, which is unnecessary when simple cleanup can free space immediately.

Full explanation →

213

MCQmedium

Refer to the exhibit. The system has a single disk with three partitions. Which partition contains the root filesystem?

A.sda

B.sda1

C.sda2

D.sda3

AnswerD

sda3 is mounted at / (root).

Why this answer

The root filesystem is mounted from the partition that contains the / (root) directory. In Linux, partitions are numbered starting from 1 (e.g., sda1, sda2, sda3). The device sda itself refers to the entire disk, not a partition.

Since the system has three partitions and the correct answer is sda3, partition sda3 must be the one designated as the root filesystem, typically identified by the mount point '/' in /etc/fstab or by the kernel boot parameter root=.

Exam trap

The trap here is that candidates often confuse the entire disk device (sda) with a partition (sda1, sda2, sda3), or assume the root filesystem is always on the first partition (sda1), ignoring that it can be on any numbered partition based on system design.

How to eliminate wrong answers

Option A is wrong because sda refers to the entire disk device, not a partition; the root filesystem must reside on a partition, not the raw disk. Option B is wrong because sda1 is a partition, but it is typically used for /boot or swap, not the root filesystem, unless explicitly configured; the question indicates sda3 is correct, so sda1 is not the root. Option C is wrong because sda2 is a partition, but it is often used for swap or extended partitions, and the correct answer is sda3, meaning sda2 does not contain the root filesystem in this scenario.

Full explanation →

214

MCQmedium

An administrator is migrating a legacy service from a SysV init system to a systemd unit. The service is a long-running daemon that forks once. The admin writes a unit file of Type=forking, sets PIDFile correctly, and enables the service. On the next reboot, the service starts but systemd reports that the service entered 'failed' state shortly after start, even though the process is running. The log shows: 'PID file /var/run/myservice.pid not readable (yet?) after start.' What is the most likely cause? Options: A) The service does not write its PID file quickly enough, B) The PIDFile path is wrong, C) The unit file should use Type=simple instead, D) The service needs a TimeoutStartSec increase.

A.The PIDFile path is wrong

B.The service does not write its PID file quickly enough

C.The service needs a TimeoutStartSec increase

D.The unit file should use Type=simple instead

AnswerB

Systemd expects the PID file shortly after the forking process exits; a delay causes failure.

Why this answer

The error message 'PID file /var/run/myservice.pid not readable (yet?) after start' indicates that systemd started the service and is waiting for the PID file to appear, but the file was not created within the default timeout (5 seconds for Type=forking). Since the service forks once, systemd expects the parent to exit and the child to write its PID to the file. If the daemon takes longer than TimeoutStartSec to write the PID file, systemd marks the unit as failed even though the process is still running.

Option B, "The service does not write its PID file quickly enough," correctly identifies this timing issue. Option A, "The PIDFile path is wrong," is incorrect because the log message explicitly says the PID file is not readable *yet*, implying the path is correct but the file has not been written. Option C, "The service needs a TimeoutStartSec increase," is incorrect because TimeoutStartSec is not about the PID file creation; it's about the time systemd waits for the start operation to complete.

Option D, "The unit file should use Type=simple instead," is incorrect because Type=simple would not wait for a PID file at all, but the service is designed to fork (which Type=simple cannot handle properly), and the error indicates systemd is expecting a PID file.

Exam trap

The trap here is that candidates often assume a 'failed' state means the process crashed, when in fact systemd's failure can be due to a timing mismatch between the daemon's startup behavior and the default timeout for PID file creation.

How to eliminate wrong answers

Option A is wrong because the PIDFile path is correctly set and the error message confirms systemd is looking for it at the right location; a wrong path would produce a different error like 'PID file not found' or 'does not exist'. Option C is wrong because increasing TimeoutStartSec would only extend the wait period, but the core issue is that the PID file is not being written quickly enough relative to the default timeout; however, the question asks for the 'most likely cause', and the log message directly points to the file not being readable yet, not a timeout expiration. Option D is wrong because using Type=simple would make systemd assume the main process is the one started by ExecStart, which would not match the forking behavior and could cause systemd to lose track of the daemon, leading to incorrect state tracking or inability to stop the service properly.

Full explanation →

215

MCQmedium

Refer to the exhibit. What can be concluded about the cron daemon based on this systemctl output?

A.It is stopped.

B.It is enabled but not currently running.

C.It has failed recently.

D.It is running and will start automatically at system boot.

AnswerD

The output shows 'active (running)' and 'enabled', meaning it is currently running and configured to start at boot.

Why this answer

The systemctl output shows 'Loaded: loaded' and 'Active: active (running)' for the cron daemon, which indicates it is currently running. Additionally, the 'enabled' status in the 'Loaded' line means the service is configured to start automatically at system boot. Therefore, option D is correct.

Exam trap

The trap here is that candidates may confuse 'enabled' (start at boot) with 'active' (currently running), leading them to select option B when the service is actually running, or they may misinterpret the absence of explicit 'failed' text as meaning the service is stopped.

How to eliminate wrong answers

Option A is wrong because 'Active: active (running)' explicitly shows the cron daemon is running, not stopped. Option B is wrong because while the service is enabled, it is also currently running, not just enabled but not running. Option C is wrong because there is no indication of a failure; the status shows 'active (running)' with no mention of 'failed' or recent crash logs in the output.

Full explanation →

216

Multi-Selecteasy

Which TWO of the following are valid ways to capture the output of a command into a variable in Bash?

Select 2 answers

A.var=`command`

B.var={command}

C.var=$(command)

D.var|command

E.var=command

AnswersA, C

Backticks are an older syntax for command substitution, but still valid.

Why this answer

Both var=`command` (backticks) and var=$(command) (dollar-parentheses) are valid command substitution syntaxes in Bash. While backticks are older and can cause issues with nesting, they are still valid and widely used. Option B uses braces, which is not a valid syntax.

Option D uses a pipe, which is for chaining commands, not variable assignment. Option E assigns the literal string 'command' to the variable, not the output of the command. Therefore, A and C are the correct choices.

Exam trap

LPI often tests the distinction between command substitution syntax and other shell constructs like brace expansion or simple assignment, leading candidates to confuse var=$(command) with var={command} or var=command.

Full explanation →

217

MCQeasy

Which directory contains the kernel modules for the currently running kernel?

A./boot

B./etc/modprobe.d

C./usr/src

D./lib/modules/$(uname -r)

AnswerD

Standard location for kernel modules.

Why this answer

The kernel modules for the currently running kernel are stored in /lib/modules/$(uname -r). The uname -r command returns the exact kernel release version, and the corresponding directory contains all loadable kernel modules (.ko files) compiled for that specific kernel. This is the standard location used by the kernel and tools like modprobe and insmod to locate and load modules.

Exam trap

The trap here is that candidates confuse the location of kernel modules with the kernel image itself (/boot) or with configuration files (/etc/modprobe.d), failing to recognize that modules are version-specific and stored under /lib/modules.

How to eliminate wrong answers

Option A is wrong because /boot contains the kernel image (vmlinuz), initramfs, and bootloader configuration files, not the kernel modules. Option B is wrong because /etc/modprobe.d contains configuration files for modprobe (e.g., aliases, blacklists, options), not the actual module binaries. Option C is wrong because /usr/src typically contains kernel source code or headers, not compiled modules; modules are built from source but stored separately in /lib/modules.

Full explanation →

218

MCQmedium

A system administrator needs to ensure a custom script runs every time the system boots. Where should the script be placed for execution during the boot process on a standard Linux system?

A./etc/cron.d/

B./etc/init.d/

C./etc/cron.hourly/

D./etc/rc.local

AnswerD

This file is executed at the end of the boot process and is suitable for custom startup scripts.

Why this answer

/etc/rc.local is a legacy system initialization script that is executed at the end of the boot process on many Linux distributions using SysV init or systemd (with a compatibility unit). Placing a custom script inside /etc/rc.local ensures it runs once per boot, after all other init scripts have completed, making it a straightforward method for executing custom commands or scripts at system startup.

Exam trap

The trap here is that candidates often confuse cron directories (like /etc/cron.d/ or /etc/cron.hourly/) with boot-time execution, because both involve running scripts, but cron is strictly time-based and unrelated to the boot sequence.

How to eliminate wrong answers

Option A is wrong because /etc/cron.d/ is used for cron job scheduling, not for boot-time execution; cron jobs run at specified times or intervals, not during system boot. Option B is wrong because /etc/init.d/ contains SysV init scripts that are managed by the init system (e.g., via update-rc.d or systemctl), and simply placing a script there does not automatically register it for execution at boot; it must be properly linked or enabled. Option C is wrong because /etc/cron.hourly/ is a directory for cron jobs that run every hour, not at boot time; it is part of the cron system, not the boot process.

Full explanation →

219

MCQhard

An administrator needs to ensure that a specific kernel module is loaded automatically at boot. Which file should be used to permanently load the module?

A./etc/modprobe.d/modules.conf

B./etc/sysconfig/modules

C./etc/modules

D./etc/conf.modules

AnswerC

Modules listed in /etc/modules are loaded at boot.

Why this answer

On modern Linux systems using a standard init system, the file /etc/modules (or /etc/modules-load.d/*.conf on systemd-based distributions) is read at boot to load specified kernel modules automatically. This file lists module names one per line, and the kernel's module loading mechanism processes it early in the boot sequence to ensure the module is available before services that depend on it start.

Exam trap

The trap here is that candidates confuse the configuration file for module options (/etc/modprobe.d/*.conf) with the file that lists modules to load at boot (/etc/modules), or they mistakenly recall the obsolete /etc/conf.modules from older Linux distributions.

How to eliminate wrong answers

Option A is wrong because /etc/modprobe.d/modules.conf is not a standard file; the correct directory is /etc/modprobe.d/ where files like *.conf are used for modprobe configuration (e.g., aliases, options, blacklists), not for specifying modules to load at boot. Option B is wrong because /etc/sysconfig/modules is not a standard path; on Red Hat-based systems, /etc/sysconfig/modules/ is a directory for custom module-loading scripts, but the primary mechanism for permanent module loading is /etc/modules or /etc/modules-load.d/. Option D is wrong because /etc/conf.modules is an obsolete file from older kernel versions (pre-2.6) and is not used by modern modprobe or systemd; it has been replaced by /etc/modprobe.d/ and /etc/modules.

Full explanation →

220

MCQeasy

A technician needs to output only the kernel release number. Which command should be used?

A.cat /proc/version

B.uname -r

C.dmesg | head -1

D.lsmod

AnswerB

uname -r outputs the exact kernel release number.

Why this answer

The `uname -r` command specifically prints the kernel release number (e.g., '5.10.0-28-amd64') by querying the `utsname` system call. This is the standard, portable way to retrieve only the kernel release string without additional system information.

Exam trap

The trap here is that candidates confuse `/proc/version` (which shows the full version string) with a command that outputs only the release number, or they assume `dmesg` output is consistent across all systems.

How to eliminate wrong answers

Option A is wrong because `cat /proc/version` outputs the full version string including the kernel release, compiler version, and build timestamp, not just the release number. Option C is wrong because `dmesg | head -1` shows the first line of the kernel ring buffer, which typically includes the kernel version and build info but is not guaranteed to be just the release number and may vary by system or boot. Option D is wrong because `lsmod` lists loaded kernel modules, not the kernel release number.

Full explanation →

221

MCQhard

A user can successfully ping a web server but cannot access the website via a browser. Which is the most likely cause?

A.Incorrect subnet mask

B.Web service (e.g., Apache) not running

C.Firewall blocking HTTP ports

D.DNS resolution failure

AnswerB

If the web service is down, ping will still work because the network layer is functional, but HTTP requests will fail.

Why this answer

B is correct because the user can successfully ping the web server, confirming that the server is reachable at the network layer (ICMP). However, the inability to access the website via a browser indicates that the application layer service handling HTTP/HTTPS requests is not running. If the web service (e.g., Apache, Nginx) is stopped or crashed, the server will not respond to TCP port 80 or 443, even though basic connectivity exists.

Exam trap

The trap here is that candidates often assume a successful ping implies full application-layer functionality, but LPIC-1 tests the understanding that ICMP and TCP are separate protocols, and a web service must be explicitly running to serve HTTP content.

How to eliminate wrong answers

Option A is wrong because an incorrect subnet mask would prevent the user from reaching the server at all, making ping fail; since ping succeeds, the subnet mask is correctly configured. Option C is wrong because a firewall blocking HTTP ports would typically block the browser request but not necessarily ICMP echo requests, but the question states ping succeeds, so a firewall blocking only HTTP could be possible; however, the most likely cause is the web service not running, as firewalls are often configured to allow ICMP and HTTP separately, and a stopped service is a more common issue. Option D is wrong because DNS resolution failure would prevent the browser from resolving the domain name to an IP address, but the user can ping the server, which implies they are using an IP address or DNS is working; if DNS were failing, ping would also fail unless using an IP directly.

Full explanation →

222

MCQmedium

A system administrator notices that the system's syslog messages are not being written to /var/log/messages. The rsyslog service is running. The administrator wants to check the configuration syntax of rsyslog. Which command should be used?

A.rsyslogd -d

B.rsyslogd -f

C.rsyslogd -N

D.rsyslogd -v

AnswerC

-N performs a syntax check on the configuration file.

Why this answer

The correct command is `rsyslogd -N` because the `-N` option performs a configuration syntax check without starting or restarting the rsyslog daemon. This allows the administrator to validate the rsyslog configuration file for errors before applying changes, ensuring that syslog messages will be written correctly to /var/log/messages.

Exam trap

The trap here is that candidates may confuse `-N` with `-d` (debug mode) or `-f` (config file path), assuming that running the daemon with a verbose flag or specifying a file will reveal syntax errors, whereas only `-N` performs a dedicated syntax check without executing the daemon.

How to eliminate wrong answers

Option A is wrong because `rsyslogd -d` runs rsyslogd in debug mode, which outputs verbose debugging information to the terminal but does not specifically check configuration syntax. Option B is wrong because `rsyslogd -f` specifies an alternative configuration file to use, not a syntax check; it would load and use that file, potentially causing issues if the syntax is invalid. Option D is wrong because `rsyslogd -v` displays the version information of rsyslogd and does not perform any configuration validation.

Full explanation →

223

MCQmedium

A server with a udev rule fails to consistently assign a persistent network interface name. What is the most likely cause?

A.The rule uses an incorrect operator.

B.The BIOS device name is configured incorrectly.

C.The kernel module for the NIC is not loaded.

D.The network interface's MAC address is not unique or changes.

AnswerD

If the MAC address changes, a rule matching by MAC will fail.

Why this answer

Persistent network interface names in Linux rely on udev rules that match attributes like MAC address. If the MAC address is not unique (e.g., due to a virtual machine or cloned NIC) or changes (e.g., after hardware replacement or driver update), the rule will fail to consistently identify the interface, causing the name assignment to be unpredictable.

Exam trap

The trap here is that candidates assume udev rules always work if the syntax is correct, overlooking that dynamic or non-unique MAC addresses undermine the stability of the matching attribute.

How to eliminate wrong answers

Option A is wrong because an incorrect operator (e.g., using '==' instead of '!=') would cause a syntax error or mis-match, but the question describes inconsistent assignment, not a complete failure; the rule still runs but the matching attribute is unreliable. Option B is wrong because BIOS device names (like 'eno1') are a naming scheme, not a cause of udev rule failure; incorrect BIOS configuration might affect the name format but does not prevent consistent assignment if the rule uses a stable attribute. Option C is wrong because if the kernel module for the NIC were not loaded, the interface would not appear at all, leading to a persistent failure rather than inconsistent naming.

Full explanation →

224

MCQmedium

Refer to the exhibit. A user tries to write to /mnt/usb/myfile.txt as a non-root user and receives a permission denied error. What is the most likely reason?

A.The filesystem is mounted read-only

B.The vfat filesystem does not support Unix permissions, and the mount options (fmask/dmask) restrict write access to root only

C.The filesystem is mounted with the 'noexec' option, preventing write

D.The file's permissions are 644, so the user does not have write access

AnswerB

Correct. The vfat filesystem does not store Unix permissions; the fmask and dmask options control the permissions shown. With fmask=0022, files get 755 permissions, but the owner is root (default unless uid/gid options are used). So only root can write.

Why this answer

The vfat filesystem does not store Unix-style permissions; instead, it relies on mount options like fmask and dmask to set the effective permissions for all files and directories. If these masks are set to restrict write access to root only (e.g., fmask=0133), non-root users will receive a 'permission denied' error even if the filesystem is mounted read-write. This is a common cause of write failures on USB drives formatted with FAT/VFAT.

Exam trap

The trap here is that candidates assume the 'permission denied' error must be due to file permissions (option D) or a read-only mount (option A), but they overlook that vfat does not store Unix permissions and that mount masks are the actual controlling mechanism.

How to eliminate wrong answers

Option A is wrong because the error would occur regardless of user identity if the filesystem were truly read-only; the question specifies the user is non-root, and a read-only mount would block root as well, which is not the scenario. Option C is wrong because the 'noexec' mount option prevents execution of binaries, not write operations; it has no effect on writing to files. Option D is wrong because on a vfat filesystem, the file's permissions (e.g., 644) are not stored on disk; they are synthesized at mount time via fmask/dmask, so the actual permissions seen by the user depend on those mount options, not on a stored mode.

Full explanation →

225

MCQeasy

An administrator needs to identify the device file for the first SATA SSD in a server. Which device file should they use?

A./dev/hda

B./dev/sdb

C./dev/nvme0n1

D./dev/sda

AnswerD

Correct: SATA SSDs are typically /dev/sda (first disk).

Why this answer

The first SATA SSD in a Linux system is typically assigned the device file /dev/sda. SATA drives use the SCSI subsystem via the libata driver, which names them /dev/sdX, with 'a' representing the first detected drive. This is the standard naming convention for SATA SSDs in modern Linux kernels.

Exam trap

The trap here is that candidates often confuse SATA with PATA (IDE) and choose /dev/hda, or mistakenly think SATA SSDs use NVMe naming like /dev/nvme0n1, not realizing that SATA drives are mapped to the SCSI subsystem as /dev/sdX.

How to eliminate wrong answers

Option A is wrong because /dev/hda is used for PATA (IDE) drives, not SATA SSDs; SATA drives are handled by the SCSI subsystem and named /dev/sdX. Option B is wrong because /dev/sdb would be the second SATA drive (or second SCSI device), not the first. Option C is wrong because /dev/nvme0n1 is used for NVMe SSDs, which connect via PCIe and use a different naming scheme (nvme0n1 for the first namespace of the first NVMe controller), not for SATA SSDs.

Full explanation →

Linux Professional Institute Certification Level 1 LPIC-1 (LPIC-1) — Questions 151–225