Linux Professional Institute Certification Level 1 LPIC-1 LPIC-1 Questions 226–300 | Page 4/8

226

Multi-Selectmedium

Which THREE directories are commonly used for mounting removable media in Linux?

Select 3 answers

A./mnt

B./mount

C./cdrom

D./dev

E./media

AnswersA, C, E

A common general-purpose mount point, often used for temporary mounts.

Why this answer

A is correct because /mnt is a standard directory defined by the Filesystem Hierarchy Standard (FHS) for temporarily mounting filesystems, including removable media like USB drives or external hard disks. It provides a generic mount point that system administrators can use for manual mounts, though it is less commonly used for automatic mounting compared to /media.

Exam trap

Candidates may incorrectly assume that /dev (the device directory) is a mount point, or that /mount is a valid FHS directory. They might also overlook /cdrom as a common mount point for optical media, often symlinked to /media/cdrom. The correct mount point directories for removable media per FHS are /mnt (temporary manual mounts) and /media (automatic mounting), with /cdrom being a widely used legacy or symlink location.

Full explanation →

227

MCQhard

A system administrator is responsible for a production Debian 10 (buster) server that hosts a critical web application. The application requires the package 'libssl1.1' version 1.1.1 or higher, but the official Debian 10 repository only provides version 1.1.0. The administrator has already attempted to install the newer version from Debian 11 (bullseye) sources, but this caused dependency conflicts with the existing libc6 version. The server cannot be upgraded to Debian 11 due to application compatibility. The administrator needs to resolve this situation without breaking the existing system or introducing unofficial packages. Which of the following is the most appropriate course of action?

A.Add the Debian Backports repository for buster and install libssl1.1 from there.

B.Upgrade the entire system to Debian 11 using a rolling upgrade.

C.Use dpkg --force-depends to force the installation of libssl1.1 from Debian 11.

D.Download the libssl1.1 source package from Debian 11 and compile it on the buster system with custom flags.

AnswerA

Backports are specifically designed to provide newer versions of packages that are compatible with the stable release. This is the recommended way to get updated software without upgrading the entire distribution.

Why this answer

Debian Backports provides newer versions of select packages (like libssl1.1) that are recompiled against the stable release's libraries (e.g., libc6 from buster), avoiding dependency conflicts. This allows the administrator to obtain libssl1.1 version 1.1.1 or higher without upgrading the entire system or introducing unofficial packages, maintaining system stability and security.

Exam trap

The trap here is that candidates may think compiling from source (Option D) is a safe workaround, but they overlook that the compiled binary will still depend on the older libc6 and may introduce subtle runtime issues, while the backports repository is the official, supported method for this exact scenario.

How to eliminate wrong answers

Option B is wrong because upgrading the entire system to Debian 11 would break application compatibility, as stated in the scenario, and is not a targeted fix for the libssl1.1 requirement. Option C is wrong because using dpkg --force-depends bypasses dependency checks, which can lead to a broken system with unresolved dependencies, runtime crashes, and security vulnerabilities. Option D is wrong because compiling libssl1.1 from Debian 11 source on buster would still link against the older libc6, potentially causing the same dependency conflicts and introducing untested binaries that may not integrate properly with the package manager.

Full explanation →

228

MCQmedium

A Linux administrator is managing a server that uses RPM-based package management. They need to find which installed package provides the '/etc/ssh/sshd_config' file. Which command should they use?

A.rpm -qi /etc/ssh/sshd_config

B.rpm -qf /etc/ssh/sshd_config

C.rpm -ql /etc/ssh/sshd_config

D.rpm -qa | grep sshd_config

AnswerB

Queries the package that owns the file.

Why this answer

The correct command is `rpm -qf /etc/ssh/sshd_config`. The `-q` flag queries the RPM database, and `-f` (or `--file`) tells RPM to find which installed package owns the specified file. This is the standard way to map a file back to its originating package in RPM-based systems.

Exam trap

The trap here is that candidates confuse the purpose of RPM query options: `-qi` (package info), `-ql` (file list), and `-qf` (file ownership), and often pick `-ql` thinking it lists files, but fail to realize it requires a package name, not a file path.

How to eliminate wrong answers

Option A is wrong because `rpm -qi` queries package information (like description, version, and architecture) from the RPM database, but it requires a package name as an argument, not a file path; using a file path with `-qi` will fail or produce irrelevant output. Option C is wrong because `rpm -ql` lists all files owned by a specified package; it expects a package name, not a file path, so it cannot be used to find which package owns a given file. Option D is wrong because `rpm -qa | grep sshd_config` lists all installed packages and pipes the output to grep, which would only match if a package name literally contains 'sshd_config' (which is unlikely); it does not query the RPM database's file-to-package mapping and will not reliably find the package that owns the file.

Full explanation →

229

MCQmedium

A system administrator notices that the system clock is consistently 5 minutes ahead of the actual time. The NTP service is enabled and running. Which command should the administrator run to force an immediate time synchronization?

A.ntpq -p

B.ntpdate pool.ntp.org

C.systemctl restart ntpd

D.timedatectl set-time ...

AnswerB

ntpdate performs immediate synchronization.

Why this answer

`ntpdate` is a legacy command that forces an immediate, one-time synchronization of the system clock with an NTP server (e.g., pool.ntp.org). Even though NTP is running, it may take several polling intervals (typically 64–1024 seconds) to correct a large offset; `ntpdate` bypasses this gradual adjustment and sets the clock instantly.

Exam trap

The trap here is that candidates assume restarting the NTP service (Option C) will immediately correct the time, but in reality, ntpd only adjusts gradually over several poll intervals unless the offset exceeds a panic threshold (default 1000 seconds) or the `-g` flag is used.

How to eliminate wrong answers

Option A is wrong because `ntpq -p` only queries and displays the current NTP peer status (e.g., reachability, delay, offset) — it does not perform any synchronization. Option C is wrong because `systemctl restart ntpd` restarts the NTP daemon but does not force an immediate sync; the daemon will still follow its normal polling cycle and gradual slew algorithm. Option D is wrong because `timedatectl set-time ...` manually sets the time without consulting an NTP server, which would conflict with the running NTP service and likely be overridden at the next NTP update.

Full explanation →

230

Multi-Selecteasy

Which TWO commands can be used to view the contents of a compressed file named archive.tar.gz without extracting it to disk?

Select 2 answers

A.gzip -d archive.tar.gz

B.bunzip2 -c archive.tar.gz | tar -t

C.tar -tzf archive.tar.gz

D.gunzip -l archive.tar.gz

E.zcat archive.tar.gz | tar -t

AnswersC, E

Correct: tar -t lists table of contents; -z handles gzip; -f specifies file.

Why this answer

The `tar -tzf` command lists the contents of a tar archive compressed with gzip without extracting it. The `-t` flag tells tar to list the table of contents, `-z` handles the gzip decompression on the fly, and `-f` specifies the archive file. This is the standard, single-command method for viewing the contents of a `.tar.gz` file without writing any files to disk.

Exam trap

The trap here is that candidates often confuse `gunzip -l` (which shows compression metadata) with listing the actual file contents, or they mistakenly apply bzip2 tools to gzip archives, forgetting that each compression format requires its own specific decompression utility.

Full explanation →

231

MCQhard

A script uses 'set -e' and then executes 'grep pattern file'. If the pattern is not found, the script exits. Which of the following modifications would prevent the script from exiting while still allowing detection of the pattern's absence?

A.grep -q pattern file || true

B.set +e; grep pattern file; exit_code=$?; set -e

C.grep pattern file; exit_code=$?

D.grep pattern file | head -1

AnswerB

Temporarily disables exit-on-error, captures exit code, then re-enables.

Why this answer

It temporarily disables 'set -e' with 'set +e', runs the grep command, captures its exit code in a variable, then re-enables 'set -e'. This allows the script to continue executing after a non-zero exit from grep, while still preserving the exit code for later conditional checks. The other options either fail to preserve the exit code or do not prevent the script from exiting under 'set -e'.

Exam trap

The trap here is that candidates often think '|| true' or piping to another command will both prevent exit and preserve the exit code, but they fail to realize that these constructs either discard the exit code or do not reliably prevent exit under all shell configurations.

How to eliminate wrong answers

Option A is wrong because 'grep -q pattern file || true' prevents the script from exiting (due to the '|| true' ensuring a zero exit status), but it does not capture the exit code of grep, so the absence of the pattern cannot be detected later. Option C is wrong because simply running 'grep pattern file; exit_code=$?' without first disabling 'set -e' will cause the script to exit immediately if grep returns non-zero, so the exit code is never captured. Option D is wrong because 'grep pattern file | head -1' uses a pipe, and under 'set -e' the script will exit if grep fails (since the pipe's exit status is the exit status of the last command, which is head, but the shell's 'set -e' behavior can still cause exit if grep fails in some shells; more importantly, the exit code of grep is lost because only the exit code of the pipeline is available, and head typically succeeds even if grep fails).

Full explanation →

232

MCQhard

After running 'ip route show default', a system administrator sees no output. Users on that system can only communicate with hosts on the local subnet. What is the most likely cause?

A.DNS is misconfigured

B.A firewall is blocking all traffic

C.The network interface is down

D.The default gateway is missing

AnswerD

Without a default route, traffic cannot reach external networks.

Why this answer

The `ip route show default` command displays the default gateway entry in the routing table. An empty output indicates that no default route is configured. Without a default gateway, the system cannot route packets to destinations outside its local subnet, which explains why users can only communicate with hosts on the local subnet.

Exam trap

The trap here is that candidates may confuse DNS resolution with routing, assuming that name resolution failure is the root cause, when in fact the absence of a default gateway directly prevents any off-subnet IP communication regardless of DNS status.

How to eliminate wrong answers

Option A is wrong because DNS misconfiguration would affect name resolution, not basic IP connectivity; the system could still reach external IP addresses if a default gateway existed. Option B is wrong because a firewall blocking all traffic would prevent all communication, including local subnet traffic, which is not the case here. Option C is wrong because if the network interface were down, the system would have no network connectivity at all, not just limited to the local subnet.

Full explanation →

233

MCQeasy

Which file defines the APT software repositories used by a Debian-based system?

A./etc/apt/preferences

B./etc/apt/sources.list.d/

C./etc/apt/sources.list

D./etc/apt/apt.conf

AnswerC

This is the main repository definition file.

Why this answer

`/etc/apt/sources.list` is the primary configuration file that defines the APT software repositories (e.g., Debian mirrors, Ubuntu archives) used by a Debian-based system. APT reads this file to fetch package indexes and install packages from the specified URIs, distributions, and components.

Exam trap

The trap here is that candidates confuse `/etc/apt/sources.list` with `/etc/apt/sources.list.d/`, thinking the directory is the primary definition file, but the exam expects the traditional main file as the correct answer.

How to eliminate wrong answers

Option A is wrong because `/etc/apt/preferences` controls the priority (pin) of packages from different repositories, not the repository definitions themselves. Option B is wrong because `/etc/apt/sources.list.d/` is a directory containing additional repository definition files (with `.list` extension), but the primary file is `/etc/apt/sources.list`; the question asks for the file that defines repositories, and while files in this directory also define repositories, the canonical answer is the main file. Option D is wrong because `/etc/apt/apt.conf` is the main configuration file for APT's behavior (e.g., proxy settings, caching options), not for repository definitions.

Full explanation →

234

MCQmedium

An administrator runs 'lsmod' and sees a module with a usage count of 1. What does this indicate?

A.The module is loaded but not used by any process

B.The module is being used by one other module

C.One process is holding a reference to the module

D.The module has one dependency

AnswerC

The usage count indicates the number of active references.

Why this answer

The usage count in lsmod indicates how many processes or kernel subsystems currently hold a reference to the module. A count of 1 means exactly one process has opened the module (e.g., via a file descriptor or ioctl) or the module is in use by a single kernel component. This is the standard interpretation per the Linux kernel module loader (kmod) and is reflected in the /proc/modules file.

Exam trap

The trap here is that candidates confuse the usage count with the number of dependent modules or think it counts processes that have loaded the module, when in fact it counts active references (e.g., open file handles, mounted filesystems, or kernel subsystems) that prevent the module from being unloaded.

How to eliminate wrong answers

Option A is wrong because a usage count of 0 means the module is loaded but not used by any process; a count of 1 indicates active use. Option B is wrong because the usage count does not track inter-module dependencies; dependencies are shown separately in the 'Used by' column of lsmod, and a module used by another module would show that other module's name, not a numeric count. Option D is wrong because the usage count is unrelated to the number of dependencies; dependencies are listed in the 'Depends' column of lsmod, and a module can have many dependencies while still having a usage count of 1.

Full explanation →

235

MCQeasy

A system administrator wants to list all files in a directory that have been modified in the last 24 hours. Which command would be most appropriate?

A.ls -l --time=mod

B.find . -mmin 1440

C.ls -lt

D.find . -mtime -1

AnswerD

-mtime -1 finds files modified less than 1 day ago, which is the last 24 hours.

Why this answer

The `find` command with `-mtime -1` searches for files whose modification time is less than 1 day ago (i.e., within the last 24 hours). The minus sign before the number means 'less than' that many days, so `-mtime -1` matches files modified in the last 24 hours. This is the standard, precise way to list files by modification time in a directory tree.

Exam trap

The trap here is that candidates confuse `-mtime` with `-mmin` and forget that the minus sign in `-mtime -1` is required to mean 'less than', or they mistakenly think `ls -lt` filters by time when it only sorts.

How to eliminate wrong answers

Option A is wrong because `ls -l --time=mod` lists files with their modification time displayed, but it does not filter files by age; it shows all files in the directory. Option B is wrong because `find . -mmin 1440` uses minutes (1440 minutes = 24 hours), but the syntax `-mmin` expects an integer without a sign; `-mmin 1440` matches files modified exactly 1440 minutes ago, not within the last 24 hours (the correct syntax would be `-mmin -1440`). Option C is wrong because `ls -lt` lists files sorted by modification time (newest first), but it does not filter; it shows all files in the directory, regardless of age.

Full explanation →

236

Multi-Selecthard

Which THREE conditions will cause the fsck command to automatically run on the root filesystem during boot? (Choose three.)

Select 3 answers

A.The 'fsck.mode=force' kernel parameter was specified.

B.The system was not shut down properly.

C.The root filesystem's superblock indicates an unclean unmount.

D.The root filesystem is read-only.

E.The filesystem has been mounted more than the configured maximum mount count.

AnswersB, C, E

Improper shutdown sets a dirty flag.

Why this answer

When the system was not shut down properly (e.g., due to a power failure or crash), the root filesystem is marked as 'dirty' in its superblock. During the next boot, fsck detects this condition and automatically runs a filesystem check on the root partition to ensure consistency before mounting it.

Exam trap

The trap here is that candidates may think 'read-only' (Option D) implies a filesystem check is needed, but fsck only triggers based on superblock flags and mount counts, not the current mount mode.

Full explanation →

237

MCQmedium

A script running as a daemon should perform clean-up operations when it receives SIGTERM. Which command inside the script sets up this behavior?

A.trap cleanup TERM

B.trap 'cleanup' SIGTERM

C.trap 'cleanup' EXIT

D.trap "cleanup" 9

AnswerB

Sets a trap for SIGTERM to run the cleanup function.

Why this answer

The `trap` command in Bash allows a script to catch signals and execute specified commands. The syntax `trap 'cleanup' SIGTERM` registers the `cleanup` function or command to run when the SIGTERM signal (signal 15) is received, which is the standard signal sent by `systemctl stop` or `kill` to request graceful termination of a daemon. This ensures the daemon performs clean-up operations before exiting.

Exam trap

The trap here is that candidates confuse signal names with signal numbers or mix up SIGTERM (15, catchable) with SIGKILL (9, uncatchable), or they incorrectly assume the EXIT pseudo-signal is equivalent to SIGTERM, when in fact EXIT triggers on any script termination, not specifically on a SIGTERM request.

How to eliminate wrong answers

Option A is wrong because `trap cleanup TERM` omits the quotes around the command string; while it may work in some shells if `cleanup` is a simple command, the correct syntax for a function or multi-word command requires quotes to prevent immediate expansion or misinterpretation. Option C is wrong because `trap 'cleanup' EXIT` catches the EXIT pseudo-signal, which triggers when the script exits for any reason (including normal exit or SIGINT), not specifically for SIGTERM, so it does not set up behavior for the SIGTERM signal itself. Option D is wrong because `trap "cleanup" 9` uses signal number 9, which is SIGKILL; SIGKILL cannot be caught, ignored, or trapped by a script, making this command invalid and the clean-up code will never execute.

Full explanation →

238

MCQmedium

A server has a partition /dev/sda2 that is almost full. The admin suspects a large file has been deleted but is still held open by a process. Which command can identify such a file?

A.du -sh /

B.find / -size +100M

C.lsof | grep deleted

D.df -h

AnswerC

Shows open files marked as deleted.

Why this answer

The `lsof` command lists open files and their associated processes. When a file is deleted but still held open by a process, `lsof` shows the filename with a '(deleted)' marker in its output. Piping through `grep deleted` filters for exactly those entries, allowing the admin to identify the file and the process keeping it alive, which is the precise scenario described.

Exam trap

The trap here is that candidates often choose `df -h` or `du` because they show disk usage, but they fail to realize that deleted-but-open files are invisible to those tools, while `lsof` directly reveals the hidden space consumption.

How to eliminate wrong answers

Option A is wrong because `du -sh /` calculates disk usage of the entire root filesystem but does not show which files are deleted and still open; it only reports current space consumption. Option B is wrong because `find / -size +100M` locates files larger than 100 MB on disk, but it cannot detect files that have been unlinked (deleted) from the directory tree, as those files no longer have a directory entry to find. Option D is wrong because `df -h` shows overall filesystem disk usage and free space, but it provides no information about individual files or processes holding deleted files open.

Full explanation →

239

MCQhard

A Linux system has a software RAID1 array /dev/md0 consisting of /dev/sda1 and /dev/sdb1. After replacing a failed disk, the administrator runs 'mdadm --manage /dev/md0 --add /dev/sdc1', but the array remains degraded. Which command should be used to check the status of the array?

A.mdadm --examine /dev/sdc1

B.mdadm --version

C.mdadm --detail /dev/md0

D.mdadm --query /dev/md0

AnswerC

Correct: shows detailed array status.

Why this answer

The `mdadm --detail /dev/md0` command displays the current state of the RAID array, including its status (e.g., degraded, active), the number of active and failed devices, and the sync/resync progress. Since the array remains degraded after adding a new disk, this command will show whether the new disk has been properly integrated or if there is an underlying issue, such as a missing or failed component.

Exam trap

The trap here is that candidates often confuse `--examine` (which inspects a disk's superblock) with `--detail` (which shows the array's overall state), leading them to choose Option A when they need to check the array's degraded status rather than a single disk's metadata.

How to eliminate wrong answers

Option A is wrong because `mdadm --examine /dev/sdc1` reads the superblock on a specific disk to show its metadata and RAID membership, but it does not report the overall array status or whether the array is still degraded. Option B is wrong because `mdadm --version` only prints the version of the mdadm utility and provides no information about the array's state. Option D is wrong because `mdadm --query /dev/md0` gives a brief summary (e.g., 'is not an md array' or a one-line status) but lacks the detailed device-by-device status and resync progress needed to diagnose why the array remains degraded.

Full explanation →

240

MCQmedium

Given a file with lines like 'John:23:Engineer', which awk command prints only the name and department (first and third fields) separated by a space?

A.awk -F: '{print $1,$3}' file

B.awk -F: '{print $1,$2}' file

C.awk -F: '{print $1 $3}' file

D.awk -F: '{print $1 $2}' file

AnswerA

Comma in print outputs space separator.

Why this answer

The `-F:` flag sets the field separator to colon, and `{print $1,$3}` prints the first and third fields separated by the default output field separator (a space). This matches the requirement to output the name and department from lines like 'John:23:Engineer'.

Exam trap

The trap here is that candidates often confuse the comma (which inserts the OFS) with concatenation (no comma), leading them to pick options like C or D that produce no space between fields, or they misidentify the field numbers and select B instead of A.

How to eliminate wrong answers

Option B is wrong because `{print $1,$2}` prints the first and second fields (name and age), not the name and department. Option C is wrong because `{print $1 $3}` concatenates the first and third fields with no separator, producing output like 'JohnEngineer' instead of 'John Engineer'. Option D is wrong because `{print $1 $2}` concatenates the first and second fields with no separator, outputting 'John23' instead of the required name and department.

Full explanation →

241

Multi-Selecteasy

Which THREE package management tools are native to Debian-based Linux distributions? (Choose exactly three.)

Select 3 answers

A.dpkg

B.rpm

C.yum

D.apt

E.apt-get

AnswersA, D, E

Low-level package manager for Debian.

Why this answer

dpkg is the core low-level package manager for Debian-based distributions, handling the installation, removal, and querying of .deb packages directly. It does not resolve dependencies automatically, making it the foundational tool upon which higher-level tools like APT are built.

Exam trap

The trap here is that candidates often confuse high-level package managers across distributions, mistakenly thinking that tools like yum or rpm are universal, when in fact they are specific to Red Hat-based systems, while Debian-based systems exclusively use dpkg and APT-family tools.

Full explanation →

242

MCQeasy

You are a junior system administrator tasked with adding a new 500GB HDD to a Debian 11 server that will be used for backup storage. The server currently has a 120GB SSD with two partitions: sda1 (boot) and sda2 (root). You have physically installed the HDD and it is recognized as /dev/sdb. You need to partition the disk with a single partition covering the entire disk, format it as ext4, and ensure it is automatically mounted at /backup at boot time. Which sequence of commands should you execute to accomplish this?

A.sudo parted /dev/sdb mklabel gpt && sudo parted /dev/sdb mkpart primary ext4 0% 100% && sudo mkfs.ext4 /dev/sdb1 && echo '/dev/sdb1 /backup ext4 defaults 0 2' | sudo tee -a /etc/fstab && sudo mount -a

B.sudo mkfs.ext4 /dev/sdb1 && echo '/dev/sdb1 /backup ext4 defaults 0 2' | sudo tee -a /etc/fstab && sudo mount -a

C.sudo mkfs.ext4 /dev/sdb && echo '/dev/sdb /backup ext4 defaults 0 2' | sudo tee -a /etc/fstab && sudo mount -a

D.sudo fdisk /dev/sdb (create partition) && sudo mkswap /dev/sdb1 && echo '/dev/sdb1 /backup ext4 defaults 0 2' | sudo tee -a /etc/fstab && sudo mount -a

AnswerA

Properly creates GPT partition table, single partition, formats as ext4, adds fstab entry, and mounts.

Why this answer

It first creates a GPT partition table on /dev/sdb with parted, then creates a single primary partition spanning the entire disk, formats that partition (not the raw disk) as ext4, adds an fstab entry for automatic mounting at /backup, and finally mounts all filesystems. This sequence ensures the disk is properly partitioned, formatted, and configured for persistent boot-time mounting.

Exam trap

The trap here is that candidates may try to format the raw disk device (e.g., /dev/sdb) instead of a partition (e.g., /dev/sdb1), or skip the partitioning step entirely, leading to an unbootable or improperly configured filesystem.

How to eliminate wrong answers

Option B is wrong because it attempts to run mkfs.ext4 directly on /dev/sdb1 without first creating a partition table or partition on /dev/sdb, so /dev/sdb1 does not exist and the command will fail. Option C is wrong because it formats the raw disk device /dev/sdb with ext4 instead of a partition, which is not a standard practice and will prevent proper partitioning; also, the fstab entry references /dev/sdb, which is the whole disk, not a filesystem. Option D is wrong because it uses mkswap to create a swap filesystem on /dev/sdb1, but the requirement is to format it as ext4 for backup storage, not swap.

Full explanation →

243

Multi-Selectmedium

Which THREE of the following are valid systemd targets?

Select 3 answers

A.poweroff.target

B.rescue.target

C.reboot.target

D.halt.target

E.shutdown.target

AnswersA, C, D

Poweroff.target is a standard systemd target that shuts down and powers off the system. It is correct.

Why this answer

The correct answers are poweroff.target (A), reboot.target (C), and halt.target (D). These are standard systemd targets: poweroff.target initiates a clean shutdown and power-off, reboot.target triggers a reboot, and halt.target halts the system without powering off. While rescue.target (B) is also a valid systemd target, it is not one of the three asked for by this question; the question specifically requests three valid targets, and the set {poweroff, reboot, halt} is a common selection. shutdown.target (E) is not a standard systemd target; the equivalent is poweroff.target.

Exam trap

Candidates may assume that halt.target is not a valid target because it is less commonly used, but it is valid. Alternatively, they may include rescue.target instead of halt.target because rescue is also valid, but the question expects three specific targets.

Full explanation →

244

MCQeasy

During boot, the kernel must mount the root filesystem. Which of the following is responsible for providing the kernel with the location of the root filesystem?

A.udev

B.initramfs

C.init

D.boot loader

AnswerD

The boot loader passes root= parameter to the kernel.

Why this answer

The boot loader (e.g., GRUB) is responsible for loading the kernel into memory and passing it the location of the root filesystem via kernel command-line parameters such as `root=`. Without this parameter, the kernel would not know which block device or partition to mount as `/`. The boot loader reads configuration files (e.g., `grub.cfg`) that specify this parameter, making it the direct provider of the root filesystem location.

Exam trap

The trap here is that candidates often confuse initramfs as the provider of the root filesystem location, when in fact initramfs is a tool that uses the location provided by the boot loader to mount the real root filesystem.

How to eliminate wrong answers

Option A is wrong because udev is a device manager that runs in userspace after the root filesystem is mounted; it handles device node creation and hotplug events, not kernel boot parameters. Option B is wrong because initramfs is a temporary root filesystem loaded by the boot loader that contains tools and drivers to mount the real root filesystem, but it does not itself provide the location; it relies on the `root=` parameter passed by the boot loader. Option C is wrong because init is the first userspace process (PID 1) started after the root filesystem is mounted; it manages services and system initialization, not the kernel's boot-time root filesystem location.

Full explanation →

245

MCQmedium

A system administrator needs to ensure that a bash script continues executing even if any command in the script fails. Which of the following should be used at the beginning of the script?

A.set +e

B.trap 'echo error' ERR

C.unset -e

D.set -e

E.# set +e

AnswerA

Disables exit on error, allowing the script to continue.

Why this answer

`set +e` disables the 'exit on error' behavior in a bash script, allowing the script to continue executing even if a command returns a non-zero exit status. By default, bash scripts do not exit on error, but if `set -e` is used elsewhere, `set +e` explicitly turns that off to ensure the script continues despite failures.

Exam trap

The trap here is that candidates often confuse `set +e` with `set -e`, or think that a comment like `# set +e` would have any effect, when in fact the `+` sign disables the option and the `-` sign enables it.

How to eliminate wrong answers

Option B is wrong because `trap 'echo error' ERR` sets a trap that executes a command when a command fails, but it does not prevent the script from exiting; the script will still exit after the trap runs unless `set +e` is also used. Option C is wrong because `unset -e` is not a valid bash command; `unset` is used to unset variables or functions, not shell options. Option D is wrong because `set -e` enables 'exit on error', which causes the script to terminate immediately when any command fails, which is the opposite of what is needed.

Option E is wrong because `# set +e` is a comment and has no effect on shell behavior; the `#` makes it a comment line.

Full explanation →

246

MCQmedium

A Red Hat system administrator suspects that the files belonging to the 'openssh-server' package have been modified since installation. Which command verifies the integrity of the installed package files?

A.rpm -K openssh-server

B.rpm -qa | grep openssh

C.rpm -q openssh-server

D.rpm -V openssh-server

AnswerD

Verifies installed files against package database.

Why this answer

The `rpm -V` (verify) command checks the integrity of installed package files by comparing their current attributes (size, MD5 checksum, permissions, etc.) against the original metadata stored in the RPM database. This directly answers the question of whether files belonging to the 'openssh-server' package have been modified since installation.

Exam trap

The trap here is confusing `rpm -K` (key/signature verification of a package file) with `rpm -V` (verification of installed files against the database), as both involve 'verification' but serve entirely different purposes.

How to eliminate wrong answers

Option A is wrong because `rpm -K` verifies the cryptographic signature of an RPM package file (e.g., GPG key), not the integrity of already installed files. Option B is wrong because `rpm -qa | grep openssh` simply lists all installed packages whose names contain 'openssh', performing no integrity check. Option C is wrong because `rpm -q openssh-server` only queries whether the package is installed and displays its version/release, without verifying file integrity.

Full explanation →

247

MCQeasy

The /proc filesystem is described as a virtual filesystem. Which statement best describes its purpose?

A.It contains configuration files for system services.

B.It provides an interface to kernel data structures and processes.

C.It holds binary executables for system administration.

D.It stores temporary files that survive reboots.

AnswerB

/proc is a pseudo-filesystem for kernel and process info.

Why this answer

The /proc filesystem is a virtual filesystem that does not contain actual files on disk but instead provides a runtime interface to kernel data structures, including process information, system memory, CPU details, and hardware configuration. This allows users and system tools (like ps, top, and free) to read kernel state in real time without needing direct kernel memory access.

Exam trap

The trap here is that candidates confuse /proc with a real filesystem for storing configuration or executables, when in fact it is a virtual interface to kernel data structures that contains no persistent files.

How to eliminate wrong answers

Option A is wrong because configuration files for system services are stored in /etc, not in /proc, which is a virtual filesystem with no persistent configuration data. Option C is wrong because binary executables for system administration reside in directories like /bin, /sbin, /usr/bin, or /usr/sbin, while /proc contains no executable binaries. Option D is wrong because temporary files that survive reboots are typically stored in /var/tmp, whereas /proc is a volatile, kernel-generated filesystem that is recreated fresh on every boot and does not persist any data.

Full explanation →

248

MCQeasy

A technician is troubleshooting network connectivity. The server's IP is 192.168.1.10/24, and the gateway is 192.168.1.1. The server can ping the gateway but cannot ping 8.8.8.8. Which command is most appropriate to check if the default route is configured?

A.route -n

B.ifconfig eth0

C.ping 192.168.1.1

D.arp -n

AnswerA

Shows routing table.

Why this answer

The `route -n` command displays the kernel IP routing table without resolving hostnames, showing the default route (destination 0.0.0.0) and its gateway. Since the server can ping the gateway but not 8.8.8.8, the issue is likely a missing or incorrect default route, which `route -n` directly reveals.

Exam trap

The trap here is that candidates assume a successful ping to the gateway implies a default route exists, but the gateway being reachable does not mean the server has a route to forward traffic beyond the local subnet.

How to eliminate wrong answers

Option B is wrong because `ifconfig eth0` only shows the IP address, netmask, and MAC of the interface, not the routing table or default gateway. Option C is wrong because `ping 192.168.1.1` was already performed successfully (as stated in the scenario) and only verifies local gateway reachability, not the existence of a default route. Option D is wrong because `arp -n` displays the ARP cache (IP-to-MAC mappings) for local network hosts, which is irrelevant to checking the default route configuration.

Full explanation →

249

MCQhard

A system administrator notices that the NTP service on a Linux server is not synchronizing time with external NTP servers. The administrator runs 'ntpq -p' and sees that all servers listed have a 'reach' value of 0. Which of the following is the most likely cause?

A.The system timezone is incorrectly set.

B.The NTP service is configured to use the local clock.

C.A firewall is blocking UDP port 123.

D.The NTP server is using a different NTP version.

AnswerC

Reach 0 indicates no response, common when firewall blocks NTP.

Why this answer

The `reach` value of 0 in `ntpq -p` output indicates that the NTP client has received no responses from any of the configured servers. Since NTP uses UDP port 123 for communication, a firewall blocking this port would prevent the client from sending or receiving NTP packets, resulting in zero reachability. This is the most common cause when all servers show a reach of 0.

Exam trap

The trap here is that candidates may confuse a reach value of 0 with a stratum value of 16 or a synchronization failure due to timezone misconfiguration, but the reach value specifically indicates network-level communication failure, not configuration or version issues.

How to eliminate wrong answers

Option A is wrong because the system timezone setting affects the display of local time, not the synchronization process with NTP servers; NTP works with UTC internally. Option B is wrong because if the NTP service were configured to use the local clock, the `ntpq -p` output would typically show a server entry like `LOCAL(0)` with a reach value greater than 0, not all servers at 0. Option D is wrong because NTP is backward compatible; different NTP versions (v3, v4) can interoperate, and version mismatch would not cause a reach value of 0 for all servers.

Full explanation →

250

MCQeasy

A Linux administrator wants to update the local package index from all configured repositories on an Ubuntu system. Which command accomplishes this?

A.dpkg --configure -a

B.apt upgrade

C.apt-get install

D.apt update

AnswerD

This updates the package index.

Why this answer

The `apt update` command (equivalent to `apt-get update`) refreshes the local package index by downloading the latest package lists from all repositories defined in `/etc/apt/sources.list` and `/etc/apt/sources.list.d/`. This is the prerequisite step before any installation or upgrade, ensuring the system knows about the newest available versions and dependencies.

Exam trap

The trap here is confusing `apt update` (which updates the package index) with `apt upgrade` (which upgrades installed packages), a common mix-up that leads candidates to choose the upgrade command instead of the index refresh command.

How to eliminate wrong answers

Option A is wrong because `dpkg --configure -a` is used to finish configuring any packages that were left in an unconfigured state after a partial installation, not to update the package index. Option B is wrong because `apt upgrade` actually installs newer versions of already-installed packages based on the current local index, but it does not refresh that index itself. Option C is wrong because `apt-get install` is used to install or upgrade specific packages, and it does not update the package lists from repositories.

Full explanation →

251

MCQhard

Refer to the exhibit. The administrator expects logs to be sent to a remote syslog server at 192.168.1.100 on UDP port 514. However, no logs are being received at the remote server. Which is the most likely issue?

A.The remote syslog server's firewall is blocking incoming UDP port 514.

B.The local7 rule overrides the remote rule.

C.The wildcard *.* does not include kernel messages.

D.The syntax should use @@ for UDP.

AnswerA

Most common issue: remote server not reachable or no listener.

Why this answer

The most likely issue is that the remote syslog server's firewall is blocking incoming UDP port 514. Syslog uses UDP port 514 by default, and if the remote server's firewall is not configured to allow this traffic, the logs will never reach it. This is a common misconfiguration when setting up centralized logging.

Exam trap

The trap here is that candidates may focus on the syslog configuration syntax (e.g., @ vs @@) or the wildcard behavior, but the most common real-world issue is firewall blocking, which is a fundamental networking concept that LPIC-1 tests.

How to eliminate wrong answers

Option B is wrong because the local7 rule does not override the remote rule; syslog.conf rules are processed sequentially, and the remote rule is separate and independent. Option C is wrong because the wildcard *.* includes all facilities and priorities, including kernel messages, so kernel messages are covered. Option D is wrong because the syntax for UDP is a single @ (for TCP it is @@); using @@ would attempt TCP, which is not the protocol specified in the question.

Full explanation →

252

Multi-Selecthard

Which THREE commands can be used to display the UUID of a filesystem on a Linux system without superuser privileges? (Choose three.)

Select 3 answers

A.file -s /dev/sda1

B.blkid

C.dumpe2fs -h

D.findfs UUID=...

E.lsblk -f

AnswersA, B, E

file -s reads filesystem superblock and can display UUID for some filesystems; works without root if device permissions allow.

Why this answer

The `file -s /dev/sda1` command reads the superblock of the specified block device and displays filesystem type information, which typically includes the UUID for filesystems like ext4, XFS, or Btrfs. This works without superuser privileges because it only performs a read-only inspection of the device file's metadata, not requiring any write access or privileged system calls.

Exam trap

The trap here is that candidates often assume `dumpe2fs -h` works without root because it only reads metadata, but Linux requires root for direct block device access unless the device file has world-readable permissions (which is rare), while `blkid` and `lsblk -f` leverage cached data to bypass this restriction.

Full explanation →

253

MCQmedium

A system administrator needs to install a package 'foo' which depends on library 'libbar.so.2' that is not currently installed. The administrator runs `apt-get install foo` and receives an error about unmet dependencies. Which of the following is the most appropriate next step?

A.Run `apt-get install -f` to fix broken dependencies.

B.Use `dpkg --force-depends -i foo.deb` to force installation.

C.Run `apt-get update` and retry the installation.

D.Manually download `libbar.so.2` and install it using `dpkg -i`.

AnswerA

This command attempts to correct unmet dependencies.

Why this answer

`apt-get install -f` (or `apt --fix-broken install`) attempts to correct a system with broken dependencies by installing missing packages or removing conflicting ones. In this scenario, the unmet dependency is `libbar.so.2`, and running this command will automatically resolve the dependency chain by installing the required library package, assuming it is available in the configured repositories.

Exam trap

The trap here is that candidates often confuse `apt-get update` (which only refreshes package lists) with `apt-get install -f` (which actually repairs broken dependencies), leading them to choose option C as a first troubleshooting step when the real issue is a missing dependency, not an outdated index.

How to eliminate wrong answers

Option B is wrong because `dpkg --force-depends -i foo.deb` bypasses dependency checks entirely, which can leave the system in a broken state where `foo` is installed but `libbar.so.2` is missing, potentially causing runtime failures and making future package management difficult. Option C is wrong because `apt-get update` only refreshes the local package index from repositories; it does not install missing dependencies or fix broken packages, so retrying the installation would still fail if the dependency is not already resolved. Option D is wrong because manually downloading a shared library file (`.so`) and installing it with `dpkg -i` is not a standard package management workflow; `dpkg` expects `.deb` packages, not raw library files, and this approach would not properly register the library with the package manager, leading to unresolved dependencies and potential system instability.

Full explanation →

254

MCQmedium

On a Linux server using systemd and Postfix for email service, an administrator needs to diagnose a delivery failure for a local user. Which command should be used to view the most recent mail-related system journal entries?

A.tail -f /var/log/maillog

B.systemctl status postfix

C.less /var/log/syslog

D.journalctl -u postfix

AnswerD

This command retrieves all journal messages for the postfix unit, ideal for troubleshooting.

Why this answer

`journalctl -u postfix` queries the systemd journal for all log entries associated with the `postfix` unit. Since the server uses systemd, Postfix logs are captured by journald rather than written to traditional files like `/var/log/maillog`. This command shows the most recent mail-related entries, including delivery failures, in reverse chronological order.

Exam trap

The trap here is that candidates accustomed to traditional syslog-based logging (e.g., `/var/log/maillog`) may overlook that systemd-based distributions use journald as the primary log collector, making `journalctl -u postfix` the correct command instead of reading static log files.

How to eliminate wrong answers

Option A is wrong because `tail -f /var/log/maillog` assumes Postfix logs are written to a traditional syslog file, but on a systemd-based server, Postfix logs are managed by journald and may not be present in `/var/log/maillog` unless explicitly configured. Option B is wrong because `systemctl status postfix` shows the current service state, recent process logs, and unit status, but it does not display the full journal of mail delivery events; it only shows a limited snippet of the service's stdout/stderr. Option C is wrong because `less /var/log/syslog` targets a general system log file that may contain mail entries but is not specific to Postfix, and on many modern distributions, syslog is replaced by journald or the file may not exist.

Full explanation →

255

Multi-Selecteasy

Which TWO commands can be used to obtain information about the CPU architecture of a Linux system?

Select 2 answers

A.uname -m

B.lscpu

C.dmidecode -t processor

D.cat /proc/cpuinfo

E.lspci

AnswersB, D

Displays CPU architecture details including cores, threads, model name, etc.

Why this answer

B is correct because `lscpu` is a dedicated command that reads and aggregates CPU architecture information from `/sys` and `/proc/cpuinfo`, presenting it in a clean, human-readable format. It provides details such as CPU model, cores, threads, architecture type, and cache sizes, making it a standard tool for CPU architecture queries on Linux.

Exam trap

The trap here is that candidates often pick `uname -m` (option A) thinking it provides full CPU architecture details, but it only outputs a single string like 'x86_64', whereas the question asks for 'information about the CPU architecture' in a broader sense, which `lscpu` and `/proc/cpuinfo` satisfy.

Full explanation →

256

Multi-Selectmedium

Which TWO commands can be used to display the contents of a compressed file without decompressing it to disk? (Choose two.)

Select 2 answers

A.zcat file.gz

B.gzip -d file.gz

C.tar -xzf file.tar.gz

D.bzcat file.bz2

E.uncompress file.Z

AnswersA, D

Equivalent to gunzip -c; outputs to stdout.

Why this answer

A is correct because `zcat` reads a gzip-compressed file and writes its decompressed content to standard output without saving the decompressed data to disk. This allows you to view the contents of `file.gz` directly in the terminal or pipe it to other commands.

Exam trap

The trap here is that candidates confuse commands that decompress to stdout (like `zcat` and `bzcat`) with commands that decompress to disk (like `gzip -d` or `uncompress`), or they mistakenly think `tar -xzf` only displays the archive contents when it actually extracts them.

Full explanation →

257

MCQhard

Refer to the exhibit. An administrator runs 'ntpq -p' and sees the output shown. What is the most likely cause of the '16' stratum and '0.000' delay/offset?

A.The NTP service is not running.

B.The firewall is blocking UDP port 123.

C.The NTP daemon has recently started and has not yet synchronized.

D.The restrict lines are blocking all NTP queries.

AnswerC

The 'iburst' option causes rapid initial polls, but it still takes a few minutes for synchronization. The 0 reach and stratum 16 indicate no synchronization yet.

Why this answer

The '16' stratum and '0.000' delay/offset values in the 'ntpq -p' output indicate that the NTP daemon has not yet synchronized with any time source. When ntpd starts, it initially sets the stratum to 16 (unsynchronized) and shows zero values for delay and offset until it completes the synchronization process. This is a normal transient state that resolves once the daemon successfully contacts and synchronizes with an NTP server.

Exam trap

The trap here is that candidates often assume a stratum of 16 and zero delay/offset indicate a firewall or service failure, but the correct interpretation is that the NTP daemon has just started and has not yet synchronized, which is a normal temporary state.

How to eliminate wrong answers

Option A is wrong because if the NTP service were not running, the 'ntpq -p' command would typically return an error or show no output, not display a stratum of 16 with zero delay/offset. Option B is wrong because a firewall blocking UDP port 123 would prevent any NTP communication, resulting in no reachable servers or persistent '16' stratum, but the zero delay/offset specifically indicates the daemon has not yet attempted or completed synchronization, not that packets are being dropped. Option D is wrong because restrict lines blocking all NTP queries would cause the daemon to fail to contact servers, leading to a persistent unsynchronized state, but the zero delay/offset is a characteristic of a freshly started daemon that has not yet attempted synchronization, not a permanent restriction issue.

Full explanation →

258

MCQmedium

Refer to the exhibit. What will be the output when this script is executed?

A.a b\nd e

B.a b c\nd e f

C.a b

D.The script will error because of incorrect read syntax.

AnswerB

Correct. Because `b` and `e` capture the remaining words from their respective lines, the output includes 'b c' and 'e f'.

Why this answer

The script reads two lines from standard input. The first `read a b` reads the first line 'a b c'. Since there are three words but only two variables, the last variable `b` captures the remainder of the line, so a='a' and b='b c'.

The second `read d e` reads the second line 'd e f', so d='d' and e='e f'. The `echo -e` command outputs the values with an escaped newline (`\n`) between them, producing two lines: 'a b c' and 'd e f', represented as 'a b c\nd e f'.

Exam trap

The trap is that `read` assigns the remainder of the line to the last variable when there are more words than variables. Candidates often think each variable gets exactly one word, but actually the last variable absorbs all remaining words.

How to eliminate wrong answers

Option B is wrong because it assumes `read` splits each line into three variables, but `read` assigns the remainder of the line to the last variable, so `b` gets 'b c' and `e` gets 'e f', not 'b' and 'e' alone. Option C is wrong because it only shows the first line, ignoring the second `read` that processes the second line. Option D is wrong because the `read` syntax is correct; `read` with multiple variables splits on whitespace and does not error when there are fewer variables than fields.

Full explanation →

259

MCQhard

A script produces both standard output and error messages. An administrator wants to save the output to 'out.log' and the error messages to 'err.log', but also wants to see both on the terminal. Which command achieves this?

A../script.sh 2>&1 | tee out.log 2>&1 | tee err.log

B../script.sh > >(tee out.log) 2> >(tee err.log)

C../script.sh > out.log 2> err.log

D../script.sh 2>&1 | tee out.log

AnswerB

Uses process substitution to duplicate stdout to terminal and out.log, and stderr to terminal and err.log.

Why this answer

Uses process substitution to redirect stdout and stderr into separate tee commands, which both write to files and pass the streams through to the terminal. The syntax `> >(tee out.log)` redirects stdout to a tee process that writes to out.log and also echoes to the terminal, while `2> >(tee err.log)` does the same for stderr. This ensures both streams are saved to separate files and displayed on the terminal simultaneously.

Exam trap

The trap here is that candidates often confuse `2>&1` (which merges stderr into stdout) with separate stream handling, leading them to pick options that either lose terminal output or fail to keep stdout and stderr in distinct files.

How to eliminate wrong answers

Option A is wrong because it redirects stderr to stdout with `2>&1`, then pipes both to `tee out.log`, but the subsequent `2>&1 | tee err.log` is applied to the output of the first tee, not to the original script's stderr; this mixes streams and does not separate stdout and stderr into distinct files. Option C is wrong because `./script.sh > out.log 2> err.log` sends stdout to out.log and stderr to err.log, but neither stream appears on the terminal — the administrator wants to see both on the terminal. Option D is wrong because `2>&1 | tee out.log` merges stderr into stdout and sends the combined stream to tee, which writes to out.log and the terminal, but stderr is not saved separately to err.log.

Full explanation →

260

MCQhard

After creating a new user with 'useradd john', the user 'john' cannot log in. What is the most likely cause?

A.The home directory does not exist

B.No password has been set for the user

C.The user's shell is not set

D.The user is not in the sudoers file

AnswerB

The 'useradd' command creates the account but does not assign a password; the account is locked initially.

Why this answer

The `useradd` command creates a new user account but does not set a password. Without a password, the system's authentication mechanism (typically PAM) will deny login attempts, as there is no valid password hash in `/etc/shadow`. The user must have a password assigned via `passwd john` before they can authenticate.

Exam trap

The trap here is that candidates assume `useradd` fully provisions an account, overlooking that password assignment is a separate mandatory step, and they may confuse login failure with missing home directory or shell issues.

How to eliminate wrong answers

Option A is wrong because `useradd` by default creates the home directory from `/etc/default/useradd` or `/etc/login.defs` unless explicitly overridden with `-M`; if it did not exist, the user would still be able to log in (though they might get a warning or land in `/`). Option C is wrong because `useradd` assigns a default shell (usually `/bin/sh` or `/bin/bash`) from `/etc/default/useradd`; if the shell is missing or invalid, login might fail, but the default is always set. Option D is wrong because membership in the sudoers file is irrelevant to basic login capability; sudo access is a privilege escalation mechanism, not a prerequisite for authentication.

Full explanation →

261

Multi-Selecteasy

Which TWO options in /etc/fstab affect whether a filesystem is mounted at boot? (Choose two.)

Select 2 answers

A.user

B.defaults

C.auto

D.ro

E.noauto

AnswersC, E

auto tells mount -a (boot) to mount the filesystem.

Why this answer

The 'auto' option (C) explicitly tells the system to mount the filesystem automatically at boot time via `mount -a` (as run by systemd or init scripts). Conversely, 'noauto' (E) prevents automatic mounting at boot, requiring manual intervention. Both directly control boot-time behavior in /etc/fstab.

Exam trap

The trap here is that candidates often confuse 'auto' with 'defaults' or think 'ro' affects boot mounting, when in fact only 'auto' and 'noauto' directly control automatic mounting at boot.

Full explanation →

262

MCQhard

A disk is partitioned with GPT. The administrator wants to see the partition type GUIDs and partition UUIDs. Which command is most appropriate?

A.blkid /dev/sda

B.lsblk -f /dev/sda

C.fdisk -l /dev/sda

D.gdisk -l /dev/sda

AnswerD

Correct: gdisk -l displays GPT partition details including UUIDs.

Why this answer

`gdisk -l /dev/sda` is the GPT-specific partitioning tool that displays partition type GUIDs (e.g., EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 for Microsoft basic data) and partition unique GUIDs (UUIDs) for each partition on a GPT disk. Unlike MBR tools, GPT stores these 128-bit identifiers in the partition table headers, and `gdisk` is designed to read and present them directly.

Exam trap

The trap here is that candidates confuse filesystem UUIDs (shown by `blkid` and `lsblk -f`) with partition table GUIDs (type and partition UUIDs), and assume `fdisk -l` is sufficient for GPT details, but `fdisk` omits the GUIDs that `gdisk` specifically exposes.

How to eliminate wrong answers

Option A is wrong because `blkid /dev/sda` shows filesystem UUIDs and type labels (e.g., ext4, swap) from the block device's superblock, not the partition table's type GUIDs or partition UUIDs stored in the GPT header. Option B is wrong because `lsblk -f /dev/sda` also displays filesystem information (UUID, label, FSTYPE) from the filesystem metadata, not the GPT partition type GUIDs or partition UUIDs. Option C is wrong because `fdisk -l /dev/sda` is designed for MBR (DOS) partition tables and, while it can read GPT disks, it does not display partition type GUIDs or partition UUIDs; it shows only partition numbers, start/end sectors, size, and a generic type code (e.g., 'Microsoft basic data') without the GUIDs.

Full explanation →

263

MCQhard

A Linux system fails to boot with the error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

A.The root filesystem has a corrupted superblock

B.The initrd file is missing or corrupted

C.The kernel lacks the necessary driver for the storage controller

D.The bootloader configuration points to the wrong partition

AnswerC

Kernel cannot access the root device due to missing storage driver.

Why this answer

The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot find or access the root filesystem. This typically occurs when the kernel lacks the necessary driver (module) for the storage controller (e.g., SATA, SCSI, NVMe) that the root device is connected to. Without the driver, the kernel cannot communicate with the storage hardware, resulting in the unknown-block(0,0) identifier.

Exam trap

The trap here is that candidates often confuse the 'unknown-block(0,0)' error with a bootloader misconfiguration (Option D) or a corrupted filesystem (Option A), but the key is that the error specifically indicates the kernel cannot identify the block device at all, not that it found the wrong device or that the filesystem is unreadable.

How to eliminate wrong answers

Option A is wrong because a corrupted superblock would produce a different error, such as 'mount: /dev/sda1: can't read superblock' or a filesystem-specific error during mount, not the 'unknown-block(0,0)' kernel panic. Option B is wrong because a missing or corrupted initrd would typically cause a kernel panic with an error like 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' only if the initrd contains the necessary storage driver; however, the initrd itself is not the root filesystem, and its absence usually leads to a 'No init found' or 'Failed to execute /init' panic, not the specific block device error. Option D is wrong because a bootloader configuration pointing to the wrong partition would result in a different error, such as 'rootfs not found' or a kernel panic with a specific device identifier (e.g., unknown-block(8,1)), not the generic unknown-block(0,0) which indicates the device node itself is unrecognized by the kernel.

Full explanation →

264

MCQeasy

A system administrator wants to ensure that the filesystem on /dev/sdb1 is checked for errors every 30 mounts. Which command accomplishes this?

A.fsck -c 30 /dev/sdb1

B.e2fsck -c 30 /dev/sdb1

C.tune2fs -c 30 /dev/sdb1

D.mount -o errors=remount-ro

AnswerC

Sets the mount count threshold to 30.

Why this answer

The `tune2fs` command is used to adjust tunable filesystem parameters on ext2/ext3/ext4 filesystems. The `-c` option sets the maximum mount count between filesystem checks; `tune2fs -c 30 /dev/sdb1` configures the filesystem to trigger an `fsck` check every 30 mounts. This is the correct tool for modifying this persistent setting.

Exam trap

The trap here is confusing the `-c` option of `tune2fs` (set mount count) with the `-c` option of `e2fsck` (bad-block check), leading candidates to mistakenly choose `e2fsck -c 30`.

How to eliminate wrong answers

Option A is wrong because `fsck` is a frontend that runs filesystem checks, not a tool to set mount-count parameters; `fsck -c 30` would attempt to check the filesystem and the `-c` option is not valid for setting mount intervals. Option B is wrong because `e2fsck` is the ext2/ext3/ext4 filesystem checker, and its `-c` option performs a bad-block scan, not a mount-count configuration. Option D is wrong because `mount -o errors=remount-ro` is a mount option that remounts the filesystem as read-only on error, but it does not schedule periodic checks based on mount count.

Full explanation →

265

Multi-Selecteasy

Which TWO of the following commands can be used to create a new filesystem on a partition?

Select 2 answers

A.fdisk

B.mkfs.ext4

C.parted

D.fsck

E.mkfs

AnswersB, E

mkfs.ext4 directly creates an ext4 filesystem.

Why this answer

B is correct because `mkfs.ext4` is a specific command that creates an ext4 filesystem on a partition. E is correct because `mkfs` is a generic front-end that can create various filesystem types (e.g., ext4, xfs, btrfs) based on the `-t` option or by invoking filesystem-specific wrappers like `mkfs.ext4`.

Exam trap

The trap here is that candidates confuse partition management tools (fdisk, parted) with filesystem creation tools (mkfs), or mistakenly think fsck can create a filesystem because it interacts with filesystem metadata.

Full explanation →

266

MCQmedium

A Linux system has two SATA disks: /dev/sda (250GB) and /dev/sdb (500GB). The administrator wants to create a logical volume group named 'vgdata' using partitions on both disks, then create a 600GB logical volume named 'lvdata' for a database. Which sequence of commands should be used?

A.pvcreate /dev/sdb1 /dev/sdc1; lvcreate -L 600G -n lvdata vgdata; vgcreate vgdata /dev/sdb1 /dev/sdc1

B.pvcreate /dev/sdb /dev/sdc; vgcreate vgdata /dev/sdb /dev/sdc; lvcreate -L 600G -n lvdata vgdata

C.pvcreate /dev/sda1 /dev/sdb1; vgcreate vgdata /dev/sda1 /dev/sdb1; lvcreate -L 600G -n lvdata vgdata

D.vgcreate vgdata /dev/sdb1 /dev/sdc1; pvcreate /dev/sdb1 /dev/sdc1; lvcreate -L 600G -n lvdata vgdata

AnswerC

Correct order: pvcreate, vgcreate, lvcreate.

Why this answer

It follows the proper LVM sequence: first create physical volumes (PVs) on partitions /dev/sda1 and /dev/sdb1 (the partitions on the two disks given in the scenario), then create the volume group 'vgdata' from those PVs using vgcreate, and finally create the logical volume 'lvdata' with a size of 600GB using lvcreate. This order ensures that the PVs exist before the VG is created, and the VG exists before the LV is created. Only option C uses the correct device names that match the system's disks (/dev/sda and /dev/sdb).

Exam trap

The trap is that candidates may confuse the order of LVM commands (pvcreate, vgcreate, lvcreate) or mistakenly use whole disks (e.g., /dev/sdb) instead of partitions (e.g., /dev/sdb1). Additionally, candidates must ensure the device names match the scenario: here the disks are /dev/sda and /dev/sdb, so partitions should be /dev/sda1 and /dev/sdb1, not /dev/sdc1.

How to eliminate wrong answers

Option A is wrong because it attempts to create a logical volume (lvcreate) before the volume group (vgcreate) exists, which will fail; also, it uses /dev/sdc1 instead of /dev/sdb1 for the second disk, but the question specifies /dev/sdb, not /dev/sdc. Option B is wrong because it uses whole disks (/dev/sdb and /dev/sdc) instead of partitions, which is possible but not the scenario described (the question says 'partitions on both disks'), and it also references /dev/sdc instead of /dev/sdb. Option D is wrong because it attempts to create the volume group (vgcreate) before creating the physical volumes (pvcreate), which will fail as the PVs must exist first.

Full explanation →

267

MCQhard

A systemd service unit file must be configured to automatically restart the service if it exits unexpectedly. Which directive should be used?

A.Type=forking

B.Restart=always

C.RemainAfterExit=yes

D.ExecStop=/bin/true

AnswerB

This directs systemd to restart the service automatically after it stops, regardless of exit status.

Why this answer

The `Restart=always` directive in a systemd service unit file instructs systemd to automatically restart the service regardless of the exit status, including unexpected crashes or terminations. This ensures high availability by restarting the process whenever it exits, unless explicitly stopped by systemctl. Other directives like `Type=forking` or `RemainAfterExit=yes` do not control restart behavior.

Exam trap

The trap here is that candidates confuse `Restart=always` with `Type=forking` or `RemainAfterExit=yes`, mistakenly thinking these directives handle automatic restarts, when in fact they address process forking or service state after exit.

How to eliminate wrong answers

Option A is wrong because `Type=forking` defines the service's startup behavior (expecting the process to fork and the parent to exit), not its restart policy. Option C is wrong because `RemainAfterExit=yes` tells systemd to consider the service as active even after the main process exits, but it does not trigger automatic restarts. Option D is wrong because `ExecStop=/bin/true` specifies a command to run when stopping the service, not a condition for automatic restart.

Full explanation →

268

Multi-Selecthard

Which THREE of the following statements are true about the /etc/shadow file?

Select 3 answers

A.It contains the encrypted passwords in the second field, replacing the 'x' in /etc/passwd

B.It can contain password expiration information

C.It is readable only by the root user

D.The second field contains the encrypted password

E.It is world-readable to allow any user to verify passwords

AnswersB, C, D

Fields like last change, min/max days, warning period are in shadow.

Why this answer

The /etc/shadow file stores password expiration information, such as the last password change date, minimum and maximum password age, warning period, and inactivity period. This data is used by the system to enforce password aging policies, making option B correct.

Exam trap

The trap here is that candidates often confuse the purpose of /etc/shadow with /etc/passwd, mistakenly thinking the second field of /etc/shadow contains a placeholder like 'x' instead of the actual encrypted password hash.

Full explanation →

269

MCQhard

A system has multiple CPUs but only one is being used. Which file under /sys/ can be checked to verify CPU online status?

A./sys/devices/system/cpu/online

B./proc/cpuinfo

C./sys/class/cpu

D./sys/devices/system/cpu/cpu0/online

AnswerD

Contains a 1 if online, 0 if offline for CPU0.

Why this answer

/sys/devices/system/cpu/cpu0/online is the sysfs file that directly shows the online status of CPU 0. Reading this file returns '1' if the CPU is online and '0' if it is offline, allowing per-CPU verification. The question specifies checking a file under /sys/, and this path is the standard sysfs interface for CPU hotplug status.

Exam trap

The trap here is that candidates confuse the summary file /sys/devices/system/cpu/online (which shows a range) with the per-CPU online file, or incorrectly assume /proc/cpuinfo is under /sys, leading them to choose Option A or B instead of the correct per-CPU path.

How to eliminate wrong answers

Option A is wrong because /sys/devices/system/cpu/online lists the ranges of CPUs that are currently online (e.g., '0-3'), but it does not provide per-CPU online status for a single CPU; it is a summary file, not a per-CPU check. Option B is wrong because /proc/cpuinfo is under /proc, not /sys, and while it shows CPU information, it does not reflect dynamic online/offline status via sysfs; it is a static snapshot of detected CPUs. Option C is wrong because /sys/class/cpu does not exist; the correct sysfs class for CPUs is /sys/devices/system/cpu, and /sys/class/ contains device classes like 'net' or 'block', not 'cpu'.

Full explanation →

270

MCQmedium

A shell script uses the variable expansion ${var:-default} to set a default value for an environment variable. The script prints unexpected output when the variable is set to an empty string. Which expansion should be used to ensure the default is only used when the variable is unset, not when it is empty?

A.${var:-default}

B.${var-default}

C.${var:?default}

D.${var:=default}

AnswerB

Only applies when var is unset.

Why this answer

The expansion `${var-default}` uses the default value only when the variable is unset (i.e., does not exist at all). In contrast, `${var:-default}` also substitutes the default when the variable is set but empty, which causes the unexpected output described in the question. The colon in the expansion is the critical difference: it adds the check for a null or empty string.

Exam trap

The trap here is that candidates often confuse the colon modifier, assuming `${var:-default}` and `${var-default}` behave identically, when in fact the colon adds the empty-string check that causes the unexpected behavior described in the question.

How to eliminate wrong answers

Option A is wrong because `${var:-default}` triggers the default when the variable is unset OR empty, which is exactly the behavior that produces the unexpected output when the variable is set to an empty string. Option C is wrong because `${var:?default}` causes the shell to exit with an error if the variable is unset or empty, rather than providing a default value. Option D is wrong because `${var:=default}` assigns the default value to the variable if it is unset or empty, modifying the variable itself, which is not the same as simply using a default without side effects.

Full explanation →

271

MCQeasy

A system administrator needs to install the latest version of a package named 'webapp' from a third-party repository that has been added to the system. Which command should be used to update the package list and install the package in one step?

A.apt-get update && apt-get install webapp

B.apt-get upgrade webapp

C.dpkg -i webapp.deb

D.apt-cache search webapp && apt-get install webapp

AnswerA

Updates package list and installs the package.

Why this answer

It first runs `apt-get update` to refresh the local package index from all configured repositories (including the third-party one), then uses `&&` to conditionally execute `apt-get install webapp` only if the update succeeds. This ensures the latest version available from the third-party repository is fetched and installed in a single command sequence.

Exam trap

The trap here is that candidates may think `apt-get upgrade` can install new packages, but it strictly upgrades existing packages and never installs new ones, while `apt-get install` alone does not refresh the package list, so the latest version from a newly added repository might not be available.

How to eliminate wrong answers

Option B is wrong because `apt-get upgrade` only upgrades already installed packages to their latest versions from the configured repositories; it does not install a new package that is not already present on the system. Option C is wrong because `dpkg -i webapp.deb` installs a local `.deb` file directly, bypassing repository metadata and dependency resolution, and it does not update the package list from a third-party repository. Option D is wrong because `apt-cache search webapp` only searches the local package cache for packages matching the name; it does not update the package list, and the `&&` would attempt `apt-get install webapp` even if the search fails or the cache is outdated.

Full explanation →

272

Multi-Selecthard

Which THREE signals are commonly used to terminate a process with the kill command?

Select 3 answers

A.SIGSTOP

B.SIGKILL

C.SIGINT

D.SIGHUP

E.SIGTERM

AnswersB, D, E

Forces immediate termination; cannot be caught or ignored.

Why this answer

SIGKILL (signal 9) is one of the three signals commonly used to terminate a process with the kill command because it forcefully kills the process without allowing it to clean up or ignore the signal. SIGTERM (signal 15) is the default signal sent by kill, requesting graceful termination. SIGHUP (signal 1) is traditionally used to hang up a terminal line but is also commonly used to reload configuration files or terminate processes in daemon management.

Exam trap

The trap here is that candidates often confuse SIGSTOP with SIGKILL or SIGTERM, or mistakenly include SIGINT as a common kill command signal, when in fact SIGINT is more associated with terminal interrupts rather than direct process termination via kill.

Full explanation →

273

MCQmedium

Refer to the exhibit. An administrator attempts to remount /mnt as read-only but receives the error shown. What is the most likely cause?

A.The /mnt directory is not a mount point

B.The /mnt directory is not empty

C.The /mnt directory does not exist

D.The filesystem is already mounted read-only

AnswerA

The error explicitly says 'mount point not mounted', meaning nothing is mounted there.

Why this answer

The error 'mount: /mnt is not a mount point' indicates that the administrator attempted to use the `remount` option on a directory that is not currently a mount point. The `mount -o remount` command only works on directories where a filesystem is already mounted; it modifies the mount options of an existing mount, not a regular directory. Since /mnt is not a mount point, the kernel rejects the operation with this specific error.

Exam trap

The trap here is that candidates confuse the `remount` option (which modifies an existing mount) with the `mount` command (which creates a new mount), leading them to think the error is about directory emptiness or existence rather than the mount point status.

How to eliminate wrong answers

Option B is wrong because a non-empty directory can still be a mount point; the error message specifically says 'not a mount point', not 'not empty'. Option C is wrong because if /mnt did not exist, the error would be 'mount: /mnt: No such file or directory', not 'not a mount point'. Option D is wrong because if the filesystem were already mounted read-only, the `remount` command would succeed (it would just be a no-op) or produce a different error like 'mount: /mnt: cannot remount ...' but not 'not a mount point'.

Full explanation →

274

MCQmedium

A system administrator needs to create a new Logical Volume (LV) in an existing LVM setup. Which sequence of commands is correct?

A.vgcreate, pvcreate, lvcreate

B.pvcreate, vgcreate, lvcreate

C.pvcreate, lvcreate, vgcreate

D.lvcreate, vgcreate, pvcreate

AnswerB

Correct order: PV first, then VG, then LV.

Why this answer

The correct sequence is pvcreate, vgcreate, lvcreate because in LVM, you must first initialize physical volumes (PVs) with pvcreate, then combine them into a volume group (VG) with vgcreate, and finally create the logical volume (LV) from the VG's free space with lvcreate. This order reflects the dependency chain: a VG requires PVs, and an LV requires a VG.

Exam trap

The trap here is that candidates may confuse the order of LVM setup steps, often thinking vgcreate comes first because it 'groups' volumes, but the physical volume initialization must always precede volume group creation.

How to eliminate wrong answers

Option A is wrong because vgcreate cannot run before pvcreate — a volume group requires initialized physical volumes (PVs) to exist. Option C is wrong because lvcreate cannot run before vgcreate — a logical volume must be created from an existing volume group. Option D is wrong because lvcreate, vgcreate, and pvcreate are all out of order; you cannot create a logical volume without a volume group, nor a volume group without physical volumes.

Full explanation →

275

MCQhard

You are a Linux administrator for a large e-commerce company. The company's application server runs Ubuntu 22.04 and uses a Btrfs filesystem for the /srv/app partition to take advantage of snapshots and compression. During a routine maintenance window, you create a snapshot of the /srv/app subvolume using 'btrfs subvolume snapshot /srv/app /srv/app_snapshot'. Later, you need to roll back to the snapshot because of a failed application update. You attempt to delete the original subvolume with 'btrfs subvolume delete /srv/app', but the command fails with the error: 'ERROR: cannot delete '/srv/app': Device or resource busy'. You check that no processes are using the directory with lsof, and it shows no open files. The /srv/app subvolume is the default subvolume and is mounted via fstab with the option 'subvol=/' (the root of the Btrfs filesystem). What is the most likely reason for the deletion failure, and how should you proceed?

A.The subvolume is read-only; change it to read-write with 'btrfs property set -f /srv/app ro false'.

B.You cannot delete the subvolume because it is the default subvolume; you must first delete the snapshot and then recreate the original.

C.The Btrfs kernel module has a readahead lock on the subvolume; wait for it to expire or reboot.

D.The subvolume is the default subvolume (ID 5) and cannot be deleted while it is the mounted root; use 'btrfs subvolume set-default <new_subvol_id> /srv/app', then unmount and remount with the new default subvolume, then delete the old subvolume.

AnswerD

The default subvolume is special and cannot be deleted while it is the mounted root. Changing the default allows deletion after remount.

Why this answer

The error occurs because the subvolume at /srv/app is the default subvolume (ID 5) of the Btrfs filesystem, and it is currently mounted as the root of the filesystem via the 'subvol=/' mount option. A default subvolume cannot be deleted while it is mounted because the kernel treats it as the top-level volume. To delete it, you must first set a different subvolume as the default using 'btrfs subvolume set-default', then unmount and remount the filesystem with the new default, after which the original subvolume can be safely deleted.

Exam trap

The trap here is that candidates assume the 'Device or resource busy' error always means a process is using the directory, but in Btrfs it can also indicate that the subvolume is the mounted default, which requires changing the default before deletion.

How to eliminate wrong answers

Option A is wrong because the error is not about read-only status; the subvolume is writable by default, and a read-only subvolume would produce a different error message. Option B is wrong because you can delete the default subvolume after changing the default to another subvolume; deleting the snapshot first is unnecessary and does not address the root cause. Option C is wrong because there is no such thing as a 'readahead lock' on a Btrfs subvolume; the error is due to the subvolume being the mounted default, not a kernel lock.

Full explanation →

276

MCQeasy

A Linux technician receives a report that a USB flash drive inserted into a system is not automatically detected. Which command should the technician use to verify if the device is recognized by the kernel?

A.fdisk -l

B.lsusb

C.blkid

D.dmesg | tail

AnswerD

dmesg output includes kernel messages; tail shows the latest entries, including USB detection.

Why this answer

The `dmesg | tail` command displays kernel ring buffer messages, which include real-time hardware detection events such as USB device insertion. When a USB flash drive is plugged in, the kernel logs messages about device recognition, driver binding, and assigned device nodes (e.g., /dev/sdb). This makes it the most direct way to verify if the kernel has detected the device.

Exam trap

The trap here is that candidates assume `lsusb` or `fdisk -l` are sufficient for kernel-level detection, but `lsusb` only confirms USB enumeration, not block device assignment, and `fdisk -l` requires prior kernel recognition.

How to eliminate wrong answers

Option A is wrong because `fdisk -l` lists partition tables on block devices that are already recognized by the kernel, but it does not show kernel detection events; if the device is not recognized, `fdisk -l` will not list it. Option B is wrong because `lsusb` only lists USB buses and devices at the USB protocol level, but it does not confirm whether the kernel has assigned a block device node or loaded the appropriate storage driver. Option C is wrong because `blkid` displays block device attributes (like UUID and filesystem type) for devices that are already present in the /dev directory; it cannot detect a device that the kernel has not yet recognized.

Full explanation →

277

MCQhard

When troubleshooting a problem with a Debian package installation, an administrator wants to see which version of a package would be installed from the configured repositories. Which command displays the candidate version?

A.dpkg -l package

B.apt-show-versions package

C.apt-get -s install package

D.apt-cache policy package

AnswerD

Shows candidate version and priority.

Why this answer

The `apt-cache policy package` command displays the package's priority, the installed version (if any), and the candidate version (the version that would be installed by default from the configured repositories). This makes it the correct tool for determining which version will be installed from the repositories.

Exam trap

The trap here is that candidates often confuse `apt-get -s install` (a simulation) with the dedicated `apt-cache policy` command for querying the candidate version, or they mistakenly think `dpkg -l` or `apt-show-versions` provide repository-level candidate information.

How to eliminate wrong answers

Option A is wrong because `dpkg -l package` lists the status and version of an installed package, but it does not query repositories or show the candidate version from repositories. Option B is wrong because `apt-show-versions package` shows available and installed versions, but it is not the standard command for displaying the candidate version; `apt-cache policy` is the authoritative tool. Option C is wrong because `apt-get -s install package` performs a dry-run simulation of installation, which can show what would be installed, but it is not the dedicated command for viewing the candidate version; `apt-cache policy` is more direct and standard for this purpose.

Full explanation →

278

MCQmedium

A Yellowdog Updater Modified (YUM) transaction that included several package installations and upgrades completed successfully, but a recent change caused a service to break. The administrator wants to revert the entire transaction using its transaction ID. Which command should be used?

A.yum history redo 123

B.yum remove <packages>

C.yum history rollback 123

D.yum history undo 123

AnswerD

Undoes transaction with ID 123.

Why this answer

`yum history undo 123` reverts the specific transaction identified by ID 123, reversing all changes (installs, upgrades, removals) made in that transaction while preserving the current state of other packages. This is the intended command for rolling back a single transaction without affecting subsequent transactions.

Exam trap

The trap here is confusing `undo` (revert a single transaction) with `rollback` (revert all transactions after a given point), leading candidates to choose option C when they only want to reverse one transaction.

How to eliminate wrong answers

Option A is wrong because `yum history redo 123` repeats the actions of transaction 123, which would reapply the same changes that broke the service, not revert them. Option B is wrong because `yum remove <packages>` manually removes specific packages without using the transaction ID, and it cannot revert the entire transaction's set of changes (including upgrades) in one step. Option C is wrong because `yum history rollback 123` reverts all transactions after ID 123, returning the system to the state at the end of transaction 123, which is too aggressive if only that transaction needs to be undone and later transactions should be preserved.

Full explanation →

279

Multi-Selecteasy

Which TWO commands can be used to display information about block devices such as disks and partitions? (Choose exactly two.)

Select 2 answers

A.blkid

B.lsblk

C.df

D.fdisk -l

E.mount

AnswersA, D

Correct. `blkid` queries block device attributes such as UUID, type, and label.

Why this answer

`blkid` retrieves attributes like UUID and filesystem type from block devices by reading their superblocks, making it ideal for identifying disks and partitions. `fdisk -l` lists partition tables, displaying detailed information about disk layouts and partitions. Both commands are directly focused on block device information. In contrast, `lsblk` lists all block devices in a tree, but it is more about displaying device hierarchy than partition-specific details. `df` shows filesystem disk usage of mounted filesystems, not raw device info. `mount` displays mounted filesystems, not block devices.

Exam trap

Candidates often assume `lsblk` is the best choice because it lists block devices, but for partition-specific details, `fdisk -l` is more appropriate. Similarly, `blkid` is often overlooked in favor of `mount` or `df`.

Full explanation →

280

MCQeasy

A system administrator needs to schedule a recurring maintenance task that runs every Monday at 3 AM. Which crontab entry is correct?

A.3 0 * * 1 /script.sh

B.0 3 * * 0 /script.sh

C.0 3 * * 7 /script.sh

D.0 3 * * 1 /script.sh

AnswerD

Correct: runs at 3:00 AM on Monday.

Why this answer

The crontab syntax is minute, hour, day of month, month, day of week. Setting minute=0, hour=3, day of week=1 runs the script at 3:00 AM every Monday (day 1 represents Monday in cron).

Exam trap

The trap here is confusing the day-of-week numbering (Monday=1 vs Sunday=0/7) and mixing minute and hour fields, leading candidates to select entries that run at the wrong time or on the wrong day.

How to eliminate wrong answers

Option A is wrong because it sets minute=3 and hour=0, which would run at 12:03 AM, not 3 AM. Option B is wrong because it sets day of week=0, which represents Sunday, not Monday. Option C is wrong because it sets day of week=7, which is not a valid day in standard cron (valid range is 0-6 or 1-7 depending on implementation, but 7 is ambiguous and not universally accepted; the correct Monday value is 1).

Full explanation →

281

MCQmedium

A zombie process appears in the process list. The parent process has PID 1234. Which command will most likely remove the zombie?

A.kill -9 1234

B.kill -9 <zombie_pid>

C.wait <zombie_pid>

D.reboot

AnswerA

Killing the parent process (PID 1234) causes the zombie to be adopted by init and then reaped.

Why this answer

A zombie process is a child process that has terminated but whose exit status has not been read by its parent. The zombie cannot be killed directly because it is already dead; it only remains in the process table until the parent calls wait(). Sending SIGKILL (kill -9) to the parent process (PID 1234) causes the parent to terminate, and the zombie child is then adopted by init (PID 1), which automatically reaps it by calling wait().

Exam trap

The trap here is that candidates mistakenly think they can kill the zombie itself with kill -9, not realizing that a zombie is already dead and the only way to remove it is to force its parent to reap it or terminate the parent.

How to eliminate wrong answers

Option B is wrong because kill -9 on the zombie PID has no effect; the zombie is already dead and cannot be signaled. Option C is wrong because wait is a system call used by the parent, not a command that can be run from the shell to reap a zombie belonging to another process. Option D is wrong because rebooting is an extreme and unnecessary measure; it would remove the zombie but also disrupt all running processes and is not the standard or recommended solution.

Full explanation →

282

MCQhard

Refer to the exhibit. The system administrator wants to ensure the /data filesystem is mounted only if it is available at boot time, and if not, the system should continue to boot without error. Which change should be made to the /etc/fstab entry for /data?

A.Change the mount point to /mnt/data

B.Change the filesystem type to auto

C.Add the 'noauto' option

D.Add the 'nofail' option and set the last field to 0

AnswerD

'nofail' allows boot to continue if the device is missing, and setting the pass number to 0 prevents fsck errors.

Why this answer

The 'nofail' mount option tells systemd that if the filesystem fails to mount at boot, the boot process should continue without error. Setting the last field (fs_passno) to 0 disables filesystem checks, which is appropriate for a non-critical filesystem that may not be present. This combination ensures the system boots normally even if /data is unavailable.

Exam trap

The trap here is that candidates often confuse 'noauto' (which prevents mounting at boot) with 'nofail' (which allows boot to continue if mount fails), or they overlook the need to set the fs_passno field to 0 to avoid fsck errors on a missing device.

How to eliminate wrong answers

Option A is wrong because changing the mount point to /mnt/data does not affect boot-time behavior; it only changes where the filesystem is mounted. Option B is wrong because setting the filesystem type to 'auto' tells the system to autodetect the type, but does not control whether a missing filesystem causes a boot failure. Option C is wrong because the 'noauto' option prevents the filesystem from being mounted at boot entirely, which is the opposite of what is desired — the administrator wants it mounted if available, not skipped unconditionally.

Full explanation →

283

MCQmedium

Refer to the exhibit. A system administrator notices that remote SSH connections are being blocked from all IP addresses except 10.0.0.5. Which configuration change would allow SSH from any IP?

A.Add a new rule to accept SSH from any source to the beginning of the chain.

B.Change the INPUT chain policy to ACCEPT.

C.Delete the first rule.

D.Move the second rule to be the first rule.

AnswerA

Correct: Adding an ACCEPT rule for SSH from any source before the DROP rule will allow all SSH traffic, as the packet will be accepted before reaching the DROP rule.

Why this answer

The exhibit shows an iptables INPUT chain with a first rule that accepts SSH from 10.0.0.5 and a second rule that drops all other SSH traffic. Because iptables processes rules in order, the first rule accepts SSH from 10.0.0.5, but all other SSH packets are matched by the second rule and dropped. Adding a new rule to accept SSH from any source at the beginning of the chain ensures that SSH packets from any IP are accepted before reaching the drop rule, allowing connections from any IP.

Exam trap

The trap is that candidates may think that because the second rule drops SSH, any new accept rule added later in the chain would override it. However, iptables processes rules in order, so a new accept rule must be placed before the drop rule to allow SSH from any IP.

How to eliminate wrong answers

Option B is wrong because changing the INPUT chain policy to ACCEPT would allow all traffic, not just SSH, which is overly permissive and not a targeted fix for SSH access. Option C is wrong because deleting the first rule would remove the drop rule entirely, but the question asks for a change to allow SSH from any IP while preserving the existing rules; deleting the first rule might also remove intended restrictions. Option D is wrong because moving the second rule (which accepts SSH only from 10.0.0.5) to the first position would still restrict SSH to only 10.0.0.5, not allow SSH from any IP.

Full explanation →

284

MCQmedium

A systems administrator is responsible for a Linux server that runs a custom application. The application writes logs to /var/log/app.log and rotates them using logrotate. Recently, the server ran out of disk space because log files were not being rotated. The administrator checks the logrotate configuration file /etc/logrotate.d/app and finds: /var/log/app.log { weekly rotate 4 compress missingok notifempty } The administrator manually runs 'logrotate -f /etc/logrotate.d/app' and the log rotates successfully. However, the next day, the log is not rotated again. The administrator checks the cron job for logrotate and finds that /etc/cron.daily/logrotate exists and runs logrotate /etc/logrotate.conf. The administrator checks /etc/logrotate.conf and sees that it includes /etc/logrotate.d/*. What is the most likely reason the log is not rotating automatically?

A.The 'weekly' directive schedules rotation once per week, so the log will not be rotated again until a full week has passed.

B.The 'notifempty' directive is misspelled; it should be 'notifempty'.

C.The /etc/logrotate.d/ directory is not included by logrotate.conf.

D.The 'missingok' directive prevents rotation if the log file is missing, but the file exists.

AnswerA

Although the word 'weekly' is not misspelled, this option points to the root cause: the 'weekly' frequency prevents daily rotation. The manual forced rotation works because -f forces rotation regardless of frequency.

Why this answer

The 'weekly' directive is correctly spelled and instructs logrotate to rotate the log once per week. The cron job runs daily, but logrotate will only rotate when the specified time interval (one week) has passed since the last rotation. The forced rotation with -f succeeded because -f overrides all conditions, including the time interval.

The other options are incorrect: 'notifempty' is spelled correctly, /etc/logrotate.d/ is included via /etc/logrotate.conf, and 'missingok' is not the issue because the log file exists.

Exam trap

The trap is that candidates focus on the misspelling of 'notifempty' (which is actually correct) and overlook the more fundamental issue that the 'weekly' directive only rotates logs once a week, causing the automatic daily check to skip rotation.

How to eliminate wrong answers

Option A is wrong because 'weekly' is correctly spelled and is a valid logrotate directive. Option B is wrong because the misspelling 'notifempty' is not recognized by logrotate, causing it to be ignored; the correct directive is 'notifempty'. Option C is wrong because the administrator confirmed that /etc/logrotate.conf includes /etc/logrotate.d/*, so the directory is included.

Option D is wrong because 'missingok' does not prevent rotation if the file exists; it only suppresses errors if the log file is missing.

Full explanation →

285

MCQhard

According to FHS, which directory should NOT be mounted on a networked filesystem (e.g., NFS) because it contains host-specific configuration files?

A./home

B./var

C./etc

D./opt

AnswerC

Correct: /etc must be local to each host due to unique configuration.

Why this answer

The Filesystem Hierarchy Standard (FHS) specifies that /etc contains host-specific configuration files that must be local to each machine. Mounting /etc over a network filesystem like NFS would cause all clients to share the same configuration, breaking system identity, network settings, and security policies. This violates the FHS requirement that /etc be a local filesystem.

Exam trap

The trap here is that candidates may think /var or /home are the correct answers because they contain user data or logs, but the FHS specifically singles out /etc as the directory that must remain local due to its host-specific configuration files.

How to eliminate wrong answers

Option A is wrong because /home is designed to be shared across networked systems via NFS, allowing user home directories to be accessed from any client. Option B is wrong because /var contains variable data such as logs and spools that can be shared or local, but it is not specifically prohibited from NFS mounting by the FHS. Option D is wrong because /opt is for add-on software packages and can be shared over NFS if the software is identical across hosts, though it is not host-specific like /etc.

Full explanation →

286

MCQhard

Refer to the exhibit. A Linux system fails to boot with a kernel panic. The dmesg output shows the disk is detected and partitions are recognized. Which of the following is the most likely cause of the kernel panic?

A.The root filesystem cannot be mounted because the root= kernel parameter points to a non-existent or incorrect device.

B.The kernel module for the SATA controller is missing from the initramfs.

C.The SATA controller is not supported by the kernel.

D.The disk has bad sectors causing read errors during boot.

AnswerA

The kernel detects the disk and partitions but then panics, likely because it cannot mount the root filesystem, often due to an incorrect root= parameter.

Why this answer

A is correct because the kernel panic occurs after the disk and partitions are detected, indicating the kernel can see the hardware but cannot mount the root filesystem. The most common cause is an incorrect or missing `root=` kernel parameter in the bootloader configuration (e.g., GRUB), which specifies the root device (e.g., `/dev/sda1` or `UUID=...`). If this parameter points to a non-existent or wrong partition, the kernel cannot pivot to the root filesystem, leading to a panic.

Exam trap

The trap here is that candidates see the disk is detected and assume hardware is fine, then incorrectly blame the SATA controller or initramfs, missing the subtle point that the kernel panic occurs specifically because the root filesystem cannot be mounted due to a misconfigured `root=` parameter.

How to eliminate wrong answers

Option B is wrong because if the SATA controller module were missing from the initramfs, the disk would not be detected at all, but the dmesg output shows the disk is detected and partitions are recognized. Option C is wrong because the SATA controller is clearly supported by the kernel, as the disk is detected and partitions are recognized, contradicting a lack of support. Option D is wrong because bad sectors causing read errors would typically produce I/O errors or filesystem corruption messages, not a kernel panic at the stage where the root filesystem cannot be mounted; the panic occurs before any filesystem read attempts.

Full explanation →

287

MCQmedium

Based on the dpkg -l output in the exhibit, what does the 'rc' status indicate for the apache2 package?

A.The package was removed but configuration files remain.

B.The package is unpacked but not configured.

C.The package is installed and configured.

D.The package is completely purged.

AnswerA

'rc' = removed, config files remain.

Why this answer

In dpkg, the 'rc' status means the package has been removed (the 'r' flag) but its configuration files remain on the system (the 'c' flag). This occurs when you use 'apt-get remove' or 'dpkg -r' without the --purge option, leaving behind files like /etc/apache2/*. The 'c' indicates that the package's conffiles (as listed in its control data) have not been deleted, allowing for potential reinstallation with previous settings preserved.

Exam trap

The trap here is that candidates confuse 'rc' with a fully removed or purged state, not realizing that the 'c' flag specifically means configuration files persist, which is a common oversight when interpreting dpkg status output.

How to eliminate wrong answers

Option B is wrong because 'unpacked but not configured' is represented by 'iU' (intended to be unpacked) or 'u' (unpacked) in dpkg status, not 'rc'. Option C is wrong because 'installed and configured' is shown as 'ii' (both flags set to 'i' for installed and configured), not 'rc'. Option D is wrong because 'completely purged' would show a blank status or 'pn' (purged and not installed), meaning no package files or configuration files remain; 'rc' explicitly indicates configuration files are still present.

Full explanation →

288

Matchingmedium

Match each Linux command to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Search text using patterns

Change file permissions

Report snapshot of current processes

Archive files

Stream editor for filtering and transforming text

Why these pairings

The correct matches are: cp for copying files, grep for searching text, and chmod for changing permissions. Common confusions include mixing these commands due to similar syntax or overlapping contexts.

Full explanation →

289

MCQhard

An ext4 filesystem is experiencing performance degradation due to very frequent small writes. Which tune2fs option can help by reserving a percentage of blocks for the root user to prevent fragmentation?

A.-i 0

B.-g root

C.-c 0

D.-m 0

AnswerB

The -g option sets the group that can use the reserved blocks. Specifying 'root' ensures that the reserved blocks are available to the root group, which can help prevent fragmentation by keeping free space contiguous for root's small writes.

Why this answer

The -g option in tune2fs sets the group that can use the reserved blocks. By specifying 'root', it assigns the reserved blocks to the root group, ensuring that the root user can access this reserved space. This helps prevent fragmentation by keeping free blocks available for root's small writes, rather than allowing the filesystem to become completely full.

Options A and C are unrelated to block reservation. Option D sets the reserved block percentage to 0, which does not reserve any blocks and can actually increase fragmentation.

Exam trap

The trap is that candidates often think -m 0 helps by removing reserved blocks, but the question specifically asks for an option that reserves a percentage. The correct answer is -g root, which works in conjunction with the default or set reserved blocks to ensure they are available for root.

How to eliminate wrong answers

Option A is wrong because `-i 0` disables the filesystem check interval (i.e., maximum time between checks), which does not affect block reservation or fragmentation from small writes. Option B is wrong because `-g root` is not a valid tune2fs option; the `-g` option is used to specify a group for reserved blocks, but it requires a group ID or name, and 'root' is not a valid group specification in this context. Option C is wrong because `-c 0` sets the maximum mount count between filesystem checks to 0, disabling checks based on mount count, which has no impact on block reservation or fragmentation.

Full explanation →

290

MCQeasy

Refer to the exhibit. What is the file permission in numeric mode for /etc/crontab?

A.644

B.600

C.444

D.755

AnswerA

rw-r--r-- corresponds to 644.

Why this answer

The /etc/crontab file is a system-wide configuration file for cron jobs. It must be readable by all users to allow cron to read the scheduled tasks, but only writable by root to prevent unauthorized modifications. The standard permission is 644 (owner read/write, group read, others read).

Exam trap

The trap here is that candidates often confuse the permissions for /etc/crontab with those for user crontab files (which are stored in /var/spool/cron/ and typically have 600 permissions) or mistakenly think that execute permission is needed for configuration files.

How to eliminate wrong answers

Option B (600) is wrong because it would make the file readable only by root, preventing the cron daemon from reading the file when it runs as a non-root user. Option C (444) is wrong because it removes write permission for the owner (root), making it impossible to edit the crontab file without changing permissions first. Option D (755) is wrong because it grants execute permission to all users, which is unnecessary and a security risk for a text configuration file.

Full explanation →

291

MCQhard

A system has multiple APT repositories configured. The administrator needs to ensure that for a specific package, the version from a particular repository is always preferred over others, regardless of version number. Which configuration would achieve this?

A.Editing /etc/apt/sources.list and setting the release in sources.list

B.Using apt-mark hold on the package after installing from desired repository

C.Creating a file in /etc/apt/preferences.d/ with a high Pin-Priority for that package and origin

D.Adding the repository and using apt-get install -t release package

AnswerC

APT pinning allows persistent preference.

Why this answer

APT's pinning mechanism, configured via files in /etc/apt/preferences.d/, allows an administrator to assign a high Pin-Priority to a specific package from a particular origin (repository). This ensures that version is always preferred during dependency resolution and upgrades, overriding the default version comparison logic.

Exam trap

The trap here is that candidates confuse apt-mark hold (which only freezes the installed version) with APT pinning (which controls version selection from repositories), leading them to choose option B instead of the correct pinning configuration.

How to eliminate wrong answers

Option A is wrong because editing /etc/apt/sources.list to set the release only controls which distribution release is used for all packages, not pinning a specific package from a specific repository. Option B is wrong because apt-mark hold prevents the package from being upgraded or changed, but it does not enforce a preference for a particular repository's version; it simply locks the current installed version. Option D is wrong because apt-get install -t release package temporarily targets a specific release for installation, but it does not create a persistent preference for that repository's version over others in future operations.

Full explanation →

292

MCQhard

A script uses a here-document to pass multi-line input to a command. Which here-document syntax will prevent variable expansion inside the document?

A.<< EOF

B.<<- EOF

C.<< "EOF"

D.<< 'EOF'

AnswerD

Quoting the delimiter prevents expansion.

Why this answer

Single-quoting the delimiter (e.g., `<< 'EOF'`) prevents the shell from performing variable expansion and command substitution within the here-document. The shell treats the quoted delimiter literally, so all content between the start and end markers is passed verbatim to the command.

Exam trap

The trap here is that candidates mistakenly think double quotes (`<< "EOF"`) also prevent expansion, but in fact double quotes are removed by the shell and do not inhibit expansion, while single quotes (`<< 'EOF'`) are the correct syntax to disable all expansions.

How to eliminate wrong answers

Option A is wrong because `<< EOF` (unquoted delimiter) allows variable expansion and command substitution inside the here-document. Option B is wrong because `<<- EOF` only strips leading tabs from the here-document content but still permits expansion. Option C is wrong because `<< "EOF"` is equivalent to `<< EOF` (double quotes are stripped by the shell), so expansion still occurs.

Full explanation →

293

MCQhard

Refer to the exhibit. The 'mount -a' command fails for the NFS mount. What is the most likely cause?

A.The local mount point /mnt/nfs does not exist.

B.The filesystem type 'nfs' is not supported by the kernel.

C.The NFS server is not exporting the directory or is unreachable.

D.The 'defaults' option is missing for the NFS entry.

AnswerC

The error 'can't read superblock' typically indicates a problem connecting to the NFS server or the export.

Why this answer

The 'mount -a' command reads /etc/fstab and attempts to mount all entries. For an NFS mount, the most common failure is that the NFS server is not exporting the specified directory or is unreachable, which causes the mount to fail with an error like 'mount.nfs: access denied by server while mounting' or 'mount.nfs: No route to host'. This is the correct answer because network-based filesystem mounts depend on server availability and export configuration.

Exam trap

LPI exams frequently test the distinction between local mount point existence and network service availability, tricking candidates into thinking a missing mount point is the cause when the real issue is server-side or network connectivity.

How to eliminate wrong answers

Option A is wrong because if the local mount point /mnt/nfs did not exist, the mount command would fail with a 'mount point does not exist' error, but the question states the failure is specifically for the NFS mount, implying other mounts succeed, and a missing mount point would affect any mount, not just NFS. Option B is wrong because if the kernel did not support the 'nfs' filesystem type, the mount would fail for all NFS mounts, but the question implies a specific NFS entry fails, and modern kernels typically include NFS support as a module or built-in; a missing kernel module would produce a 'mount: unknown filesystem type' error, which is not the most likely cause in a typical scenario. Option D is wrong because the 'defaults' option is not required for NFS mounts; it is a shorthand for a set of default mount options (like rw, suid, dev, exec, auto, nouser, async) but omitting it does not cause the mount to fail—the mount will still proceed with explicit options or defaults from the kernel.

Full explanation →

294

MCQhard

A system administrator wants to ensure that the syslog service starts automatically on boot and is running immediately without a reboot. Which command sequence should be used?

A.systemctl start syslog && systemctl enable syslog

B.systemctl start --enable syslog

C.systemctl enable syslog && systemctl start syslog

D.systemctl enable --now syslog

AnswerD

The --now flag enables and starts the service in one step.

Why this answer

`systemctl enable --now syslog` combines enabling the service to start automatically on boot and starting it immediately in a single command. The `--now` flag triggers an immediate start after enabling, fulfilling both requirements without needing a reboot.

Exam trap

The trap here is that candidates may think they need to use two separate commands (enable and start) in a specific order, but the `--now` flag is a single-command shortcut that systemd provides, and LPI often tests this to see if you know the combined option exists.

How to eliminate wrong answers

Option A is wrong because it starts the service before enabling it; while this works, it is less efficient than using `--now`, and the order is not the issue—the command sequence is valid but not the best practice. Option B is wrong because `systemctl start --enable` is not a valid syntax; `--enable` is not a flag for `start`, and this command would fail. Option C is wrong because it enables the service first and then starts it, which is functionally correct but less efficient than using `--now`; however, the question asks for the command sequence that should be used, and `systemctl enable --now` is the idiomatic, single-command solution.

Full explanation →

295

MCQmedium

Refer to the exhibit. What will be the default permissions of a newly created file using the touch command?

A.-rw-r--r--

B.-rw-rw-rw-

C.-rwxr-xr-x

D.-rw-rw-r--

AnswerA

Correct: 666 - 022 = 644, giving owner read/write, group read, others read.

Why this answer

The `touch` command creates a file with default permissions determined by the current umask value. On most Linux systems, the default umask is 0022, which subtracts write permissions for group and others from the base permissions of 0666 (rw-rw-rw-), resulting in 0644 (rw-r--r--). Thus, option A is correct.

Exam trap

The trap here is that candidates often confuse the base permissions (0666) with the final permissions, forgetting to apply the umask, or they mistakenly think touch sets execute bits like a directory creation would.

How to eliminate wrong answers

Option B is wrong because -rw-rw-rw- (0666) would require a umask of 0000, which is not the default; it represents the base permissions before umask is applied. Option C is wrong because -rwxr-xr-x (0755) is a typical permission set for directories or executable files, not for a new file created by touch, which never sets execute bits by default. Option D is wrong because -rw-rw-r-- (0664) would result from a umask of 0002, common in some environments but not the default umask of 0022 on most Linux distributions.

Full explanation →

296

MCQhard

A system administrator needs to perform incremental backups of a large directory /data. The backup strategy requires a full backup every Sunday and incremental backups on weekdays. Which tar command satisfies this requirement using the --listed-incremental option?

A.Full: tar -czvf /backup/full.tar.gz /data; Incremental: tar -czvf /backup/incr.tar.gz --after-date '1 day ago' /data

B.Full: tar -cvf /backup/full.tar /data; Incremental: tar -cvf /backup/incr.tar -N 'last Sunday' /data

C.Full: tar -cvf /backup/full.tar --newer /data; Incremental: tar -cvf /backup/incr.tar --newer /backup/full.tar /data

D.Full: tar -cvf /backup/full.tar -g /var/backup/snapshot /data; Incremental: tar -cvf /backup/incr.tar -g /var/backup/snapshot /data

AnswerD

This uses the same snapshot file to track changes; the first run creates a full backup snapshot, subsequent runs create incremental backups.

Why this answer

The `--listed-incremental` (or `-g`) option in tar creates and uses a snapshot file to track changes between backups. By specifying the same snapshot file for both the full and incremental backups, tar automatically records which files have changed since the last full backup, enabling proper incremental backups without relying on timestamps or file modification times.

Exam trap

The trap here is that candidates often confuse timestamp-based options like `--newer` or `-N` with the snapshot-based `--listed-incremental` mechanism, assuming any time-based filter can achieve incremental backups, but only `-g` provides the metadata tracking needed for proper incremental archives.

How to eliminate wrong answers

Option A is wrong because `--after-date` is not a valid tar option; the correct option for time-based filtering is `--newer` or `-N`, and using a relative time like '1 day ago' does not integrate with the `--listed-incremental` mechanism for reliable incremental backups. Option B is wrong because `-N 'last Sunday'` uses a timestamp-based filter that does not create a snapshot file, so subsequent incremental backups would not correctly track changes relative to the full backup; also, the full backup command lacks the `-g` option needed for incremental tracking. Option C is wrong because `--newer` compares file modification times against a file's timestamp, not against a snapshot; using `--newer /backup/full.tar` would include any file modified after the full archive was created, but it does not handle deletions or renames and is not the intended use of `--listed-incremental`.

Full explanation →

297

MCQmedium

An administrator needs to downgrade a package from version 2.0 to version 1.9. Which apt-get command can be used to perform this action?

A.`apt-get downgrade package=1.9`

B.`apt-get upgrade package=1.9`

C.`apt-get dist-upgrade package=1.9`

D.`apt-get install package=1.9`

AnswerD

Specifies the version to install, enabling downgrade.

Why this answer

The correct command is `apt-get install package=1.9` because in APT, the `install` command is used not only to install new packages but also to downgrade an existing package to a specific version by appending `=version` to the package name. This instructs APT to resolve dependencies and perform the downgrade, overriding the currently installed version.

Exam trap

The trap here is that candidates often assume a dedicated `downgrade` command exists (Option A) or confuse `upgrade`/`dist-upgrade` with the ability to specify a version, when in fact `apt-get install` is the universal command for installing, upgrading, or downgrading a package to a specific version.

How to eliminate wrong answers

Option A is wrong because `apt-get downgrade` is not a valid APT command; APT does not have a dedicated `downgrade` subcommand. Option B is wrong because `apt-get upgrade` only upgrades packages to the latest version available in the repository and does not accept a version specifier; it cannot be used to downgrade. Option C is wrong because `apt-get dist-upgrade` (now `full-upgrade`) handles dependency changes during major upgrades but does not accept a version specifier and is not intended for downgrading a single package to a specific version.

Full explanation →

298

MCQeasy

A small business runs a web application on a Linux server that uses Apache to serve dynamic content via PHP-FPM. The server currently uses the default Apache configuration, but the administrator wants to improve security by limiting access to the server's administrative interface (located at /admin) to only the local network (192.168.1.0/24). The administrative interface is accessed via a separate VirtualHost on port 443. The administrator has created a new VirtualHost configuration file for the admin site. However, after reloading Apache, users from outside the local network can still access the /admin page. The administrator has verified that the VirtualHost is being parsed and that mod_authz_core is enabled. Which of the following actions would most likely resolve the issue?

A.Add the following inside the <VirtualHost> block for the admin site: <Directory /var/www/admin> Require ip 192.168.1.0/24 </Directory>

B.Add the following to the server's iptables: iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j DROP

C.Add the following inside the <VirtualHost> block: <Location /admin> Require valid-user AuthType Basic AuthUserFile /etc/httpd/.htpasswd </Location>

D.Set the DocumentRoot of the default VirtualHost to /var/www/admin.

AnswerA

This restricts directory access to the local subnet.

Why this answer

The administrator needs to restrict access to the /admin path at the directory level using Apache's mod_authz_core. By placing a <Directory> block inside the VirtualHost that specifies the filesystem path to the admin files and using 'Require ip 192.168.1.0/24', Apache will enforce IP-based access control for that directory. Since the VirtualHost is already being parsed and mod_authz_core is enabled, this is the direct and proper way to limit access to the local network.

Exam trap

The trap here is that candidates often confuse network-layer filtering (iptables) with application-layer access control (Apache directives), or mistakenly think that authentication (Require valid-user) can replace IP-based restrictions, when in fact they serve different security purposes.

How to eliminate wrong answers

Option B is wrong because iptables rules would block all HTTPS traffic on port 443 from outside the local network, including the main web application, not just the /admin path; this is too broad and would break the primary service. Option C is wrong because it implements HTTP Basic authentication requiring a valid user and password, which does not restrict by IP address; users from outside the local network could still access /admin if they provide valid credentials. Option D is wrong because changing the DocumentRoot of the default VirtualHost to /var/www/admin would serve the admin interface as the default site, making it accessible to all, and does not apply any access restriction.

Full explanation →

299

Multi-Selecthard

Which THREE statements are true about the sed command?

Select 3 answers

A.sed 's/old/new/g' file.txt permanently changes the file.

B.sed -i 's/foo/bar/g' file.txt replaces all occurrences of foo with bar in the file.

C.sed uses extended regular expressions by default.

D.sed '/^#/d' file.txt deletes lines that start with #.

E.sed -n '3,5p' file.txt prints lines 3 to 5 of file.txt.

AnswersB, D, E

-i makes in-place changes.

Why this answer

The `-i` flag in sed enables in-place editing, directly modifying the file rather than just outputting changes to stdout. The substitution command `'s/foo/bar/g'` replaces all occurrences of `foo` with `bar` globally on each line, and with `-i`, the changes are written back to the file.

Exam trap

The trap here is that candidates often assume sed always modifies files in place, forgetting that without `-i`, sed only outputs to stdout, and that sed defaults to basic regular expressions, not extended ones.

Full explanation →

300

MCQmedium

A system administrator is configuring a Linux server to act as a router. The server has two network interfaces: eth0 (192.168.1.1/24) and eth1 (10.0.0.1/24). Which of the following commands enables IP forwarding on this server?

A.route add default gw 10.0.0.1

B.sysctl -w net.ipv4.ip_forward=1

C.echo 1 > /proc/sys/net/ipv4/ip_forward

D.sysctl -w net.ipv4.ip_forward=1

AnswerB, D

Correct. The sysctl command net.ipv4.ip_forward=1 enables IP forwarding.

Why this answer

Both options B and D contain the exact same command 'sysctl -w net.ipv4.ip_forward=1' which enables IP forwarding. Therefore, both B and D are correct. Option A is incorrect because it sets a default gateway instead of enabling forwarding.

Option C is also a valid method (echoing 1 to /proc/sys/net/ipv4/ip_forward), but it is not listed as correct because the question likely expects the sysctl method.

Exam trap

The trap here is that both options B and D are identical commands. Candidates may think one is a distractor, but since they are exactly the same, both are correct. Also, candidates may confuse setting a default gateway (option A) with enabling IP forwarding, or think that writing to /proc (option C) is equivalent, but the key insight is that the sysctl command is the standard way.

How to eliminate wrong answers

Option A is wrong because `route add default gw 10.0.0.1` sets a default gateway for outbound traffic, not IP forwarding; it does not enable the kernel to forward packets between interfaces. Option B is wrong because `sysctl -w net.ipv4.ip_forward=1` is syntactically identical to Option D but is listed as a separate option; however, in the context of this question, Option B is actually the same command and would also be correct, but the question designates Option D as the correct answer, so Option B is considered a duplicate and not the intended choice. Option C is wrong because `echo 1 > /proc/sys/net/ipv4/ip_forward` is a valid method to enable IP forwarding, but it requires root privileges and the path is case-sensitive; the correct path is `/proc/sys/net/ipv4/ip_forward` (lowercase), and while it works, it is less preferred than `sysctl` because it does not persist across reboots and is not the standard LPIC-1 recommended command.

Full explanation →

Linux Professional Institute Certification Level 1 LPIC-1 (LPIC-1) — Questions 226–300