Linux Professional Institute Certification Level 1 LPIC-1 LPIC-1 Questions 376–450 | Page 6/8

376

MCQhard

After a failed package upgrade, a Debian system shows 'unmet dependencies' when trying to install any new software. What is the most appropriate command to fix this condition?

A.Edit /var/lib/dpkg/status manually

B.apt-get install -f

C.dpkg --purge $(dpkg -l | grep ^iU | awk '{print $2}')

D.dpkg --force-depends -i *.deb

AnswerB

The -f flag fixes broken dependencies.

Why this answer

The 'apt-get install -f' command (option B) is the correct fix because it invokes the '--fix-broken' option, which automatically resolves unmet dependencies by either installing missing packages or removing partially installed ones. This is the standard Debian/APT tool for repairing a broken package state after a failed upgrade, as it reads the dpkg database and corrects inconsistencies without manual intervention.

Exam trap

The trap here is that candidates may think manually editing the dpkg database (option A) is a quick fix, but LPIC-1 tests the understanding that APT's built-in repair mechanism is the correct and safe approach, not low-level manual manipulation.

How to eliminate wrong answers

Option A is wrong because manually editing /var/lib/dpkg/status is dangerous and error-prone; it can corrupt the package database and lead to system instability, and it bypasses APT's dependency resolution logic. Option C is wrong because 'dpkg --purge' with a grep for 'iU' (unpacked but not configured) would remove all packages in that state, which is too aggressive and may delete critical system packages that only need reconfiguration, not removal. Option D is wrong because 'dpkg --force-depends -i *.deb' forces installation of all .deb files in the current directory while ignoring dependency checks, which does not fix the underlying broken state and can introduce further inconsistencies.

Full explanation →

377

Drag & Dropmedium

Arrange the steps to create a LVM logical volume and mount it.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for creating an LVM logical volume and mounting it is: first create physical volumes (PVs) using pvcreate, then create a volume group (VG) with vgcreate, then create a logical volume (LV) with lvcreate, and finally format the LV with a filesystem (e.g., mkfs) and mount it. This ensures that each step builds on the previous one.

Full explanation →

378

MCQhard

Refer to the exhibit. The remount command fails. What is the most likely cause?

A.The filesystem type is wrong.

B.The fstab entry lacks the 'noauto' option but the device is not currently mounted.

C.The filesystem is not mounted.

D.The mount point /data does not exist.

AnswerC

The filesystem is not mounted, and 'mount -o remount' requires the filesystem to be already mounted. This is the most likely cause of the failure.

Why this answer

The remount command fails because the filesystem is not mounted. 'mount -o remount' only works on filesystems that are already mounted. The lack of the 'noauto' option in the fstab entry is irrelevant; it only affects automatic mounting at boot and does not influence whether a remount can be performed on an unmounted filesystem. Candidates may incorrectly believe that the missing 'noauto' is the cause, but the real issue is that the filesystem needs to be mounted first.

Exam trap

The trap is that candidates may focus on the missing 'noauto' option and think it is the cause of the failure. In reality, the remount command requires the filesystem to be already mounted; the 'noauto' option is irrelevant to the remount operation's success.

How to eliminate wrong answers

Option A is wrong because the filesystem type is typically specified in the fstab entry and, if incorrect, would cause a different error (e.g., 'wrong fs type') rather than a remount failure due to an unmounted device. Option C is wrong because the filesystem is not mounted, which is the direct cause of the remount failure, but this is a symptom, not the root cause described in the fstab entry's missing 'noauto' option. Option D is wrong because if the mount point /data did not exist, the mount command would fail with a 'mount point does not exist' error, not a remount-specific failure.

Full explanation →

379

MCQeasy

Refer to the exhibit. How many physical disks are present in the system?

A.3

B.2

C.4

D.1

AnswerB

Correct: Two disks: sda and sdb.

Why this answer

The output shows two SCSI disks: /dev/sda and /dev/sdb. Each device file represents a physical disk, so there are exactly two physical disks present. The partitions (sda1, sda2, sdb1) are subdivisions of those disks and do not count as separate physical disks.

Exam trap

The trap here is that candidates often count partition entries (e.g., sda1, sda2, sdb1) as separate physical disks, leading them to overcount the actual number of drives.

How to eliminate wrong answers

Option A is wrong because it likely counts partitions (sda1, sda2, sdb1) as separate disks, but partitions are logical divisions, not physical disks. Option C is wrong because it may misinterpret the number of device files or include non-disk devices (e.g., /dev/sr0 for optical drive) as physical disks. Option D is wrong because it ignores the second disk /dev/sdb, possibly assuming all partitions belong to a single disk.

Full explanation →

380

MCQeasy

To enable disk quotas for user quotas on a filesystem, which line should be added to /etc/fstab's mount options?

A.grpquota

B.userquota

C.quota

D.usrquota

AnswerD

Adding 'usrquota' to the mount options in /etc/fstab enables user quotas on the filesystem.

Why this answer

The 'usrquota' mount option is the standard Linux kernel parameter used to enable user disk quotas on a filesystem. When added to the fourth field of an /etc/fstab entry, it instructs the kernel to track per-user disk usage, allowing the quota system (via quotacheck, edquota, etc.) to enforce limits.

Exam trap

The trap here is that candidates confuse 'usrquota' with the generic term 'quota' or the incorrect 'userquota', assuming any word containing 'quota' will work, but the Linux kernel strictly requires the exact 'usrquota' string for user quotas.

How to eliminate wrong answers

Option A is wrong because 'grpquota' is the mount option for enabling group quotas, not user quotas. Option B is wrong because 'userquota' is not a valid Linux mount option; the correct syntax uses 'usrquota' for users and 'grpquota' for groups. Option C is wrong because 'quota' alone is not a valid mount option in /etc/fstab; the kernel requires the specific 'usrquota' or 'grpquota' strings to activate quota tracking.

Full explanation →

381

MCQeasy

A small office has a network printer with IP 192.168.1.100. The printer is shared via CUPS. A user reports that they cannot print a document from their workstation. The printer appears in the list of available printers, but when they try to print, the job hangs in the queue with status 'processing'. The administrator suspects the printer may be offline or the CUPS service is not running. Which command should the administrator run first to gather diagnostic information about the printer and its queue?

A.ping 192.168.1.100

B.lpstat -t

C.lpadmin -p printer -E

D.systemctl restart cups

AnswerB

lpstat -t shows printer status, queue, and error information for diagnosis.

Why this answer

The `lpstat -t` command shows the complete status of the CUPS print system, including all printers, their queues, and whether they are accepting jobs. Since the job is stuck with 'processing' status, this command will reveal if the printer is idle, disabled, or unreachable, and whether the queue is enabled or paused. It is the first diagnostic step before testing network connectivity or restarting services.

Exam trap

The trap here is that candidates assume a network connectivity test (ping) is the logical first step, but the question specifically asks for diagnostic information about the printer and its queue, which requires CUPS-specific status reporting, not just ICMP reachability.

How to eliminate wrong answers

Option A is wrong because `ping` only tests basic network layer connectivity to 192.168.1.100, but does not provide any information about the CUPS printer queue status, job state, or whether the printer is accepting jobs. Option C is wrong because `lpadmin -p printer -E` enables the printer and sets it as the default, but it does not display diagnostic information; it modifies configuration and could disrupt an existing setup. Option D is wrong because `systemctl restart cups` restarts the CUPS service, which is a troubleshooting action that should only be taken after gathering diagnostic data; it may clear the queue and lose job information without identifying the root cause.

Full explanation →

382

Multi-Selectmedium

Which TWO characteristics describe the difference between 'apt-get' and 'aptitude'? (Choose two.)

Select 2 answers

A.Aptitude offers a text-based interactive interface (TUI).

B.Aptitude provides a more sophisticated dependency resolution and can mark packages as automatically installed.

C.Apt-get uses a different package format than aptitude.

D.Apt-get can only be used from the command line, while aptitude only has a text-based interface.

E.Aptitude is an older tool and no longer maintained.

AnswersA, B

You can run aptitude without arguments to enter TUI.

Why this answer

Aptitude includes a text-based interactive interface (TUI) that allows users to browse, search, and manage packages in a menu-driven environment, whereas apt-get is strictly command-line only. This TUI provides features like visual dependency trees and interactive conflict resolution, making aptitude more user-friendly for interactive package management.

Exam trap

The trap here is that candidates often assume apt-get and aptitude are interchangeable or that aptitude is obsolete, but the exam tests the specific technical distinction that aptitude has a TUI and superior dependency resolution, while both use the same package format.

Full explanation →

383

Multi-Selecthard

Which THREE steps are necessary to configure a static IP address using ifcfg files on a RHEL-based system? (Choose THREE.)

Select 3 answers

A.Edit /etc/sysconfig/network-scripts/ifcfg-eth0

B.Set ONBOOT=yes

C.Run 'systemctl restart network'

D.Run 'ip addr add 192.168.1.10/24 dev eth0'

E.Set BOOTPROTO=static

AnswersA, B, E

Correct: the ifcfg file must be edited.

Why this answer

On RHEL-based systems, persistent network interface configuration is stored in files named `/etc/sysconfig/network-scripts/ifcfg-<interface>`. Editing this file allows you to define static IP parameters that survive reboots. This is the standard method for configuring static IP addresses using ifcfg files.

Exam trap

The trap here is that candidates often confuse runtime commands (like `ip addr add`) with persistent configuration steps, or they mistakenly think restarting the network service is a configuration step rather than an activation step.

Full explanation →

384

MCQhard

A server in a corporate network uses systemd-resolved for DNS. Internal hostnames (e.g., server.example.lan) fail to resolve, but external names (e.g., google.com) work. The /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf. The administrator checks the systemd-resolved configuration and finds that the internal DNS server is listed globally, but the network interface has no specific DNS set. Which command should be used to assign the internal DNS server to the interface and fix resolution?

A.Add the internal hostnames to /etc/hosts.

B.Run 'resolvectl dns eth0 10.0.0.1' to set the DNS server for the interface.

C.Restart systemd-resolved service.

D.Edit /etc/resolv.conf and add the internal DNS server.

AnswerB

This sets the per-link DNS, allowing systemd-resolved to use the internal server for that interface.

Why this answer

`resolvectl dns eth0 10.0.0.1` assigns the internal DNS server specifically to the network interface (eth0), overriding the global setting for that interface. In systemd-resolved, per-interface DNS settings take precedence over global DNS servers, so this command ensures that internal hostnames are resolved by the internal DNS server while external names continue to work via the global configuration.

Exam trap

The trap here is that candidates assume editing /etc/resolv.conf or restarting the service will fix the issue, but they fail to recognize that systemd-resolved requires explicit per-interface DNS assignment via `resolvectl` to override the global setting for a specific network interface.

How to eliminate wrong answers

Option A is wrong because adding hostnames to /etc/hosts is a static workaround that does not fix the underlying DNS resolution issue for dynamic internal hostnames; it is not a scalable solution and does not leverage the DNS server. Option C is wrong because restarting systemd-resolved does not change the configuration; it only reloads the existing settings, which still lack a per-interface DNS server for eth0. Option D is wrong because /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf, which is managed by systemd-resolved; manually editing it would be overwritten by systemd-resolved and is not the correct way to configure per-interface DNS in systemd-resolved.

Full explanation →

385

Multi-Selecthard

Which three commands are commonly used to display information about running processes?

Select 3 answers

A.top

B.pkill

C.kill

D.htop

E.ps

AnswersA, D, E

Realtime process viewer.

Why this answer

The `top` command (option A) is a standard Linux utility that provides a real-time, dynamic view of running processes, including CPU and memory usage, and is commonly used for process monitoring. It is a core tool for displaying process information, making it correct for this question.

Exam trap

The trap here is that candidates may confuse commands that manipulate processes (like `kill` and `pkill`) with commands that display process information, leading them to incorrectly select those options.

Full explanation →

386

Drag & Dropmedium

Order the steps to mount an NFS share from a remote server.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

NFS mounting requires the client package, a local directory, and the mount command with server and export path.

Full explanation →

387

MCQeasy

A user submitted a print job to a CUPS printer but used the wrong options. Which command should the administrator use to cancel the job?

A.lpstat

B.cancel

C.lprm

D.lpadmin

AnswerB

The cancel command is part of CUPS and cancels print jobs.

Why this answer

The `cancel` command is the correct CUPS utility to terminate a print job that has already been submitted. It accepts either a job ID (e.g., `cancel 123`) or a printer name (e.g., `cancel printer-name`) to cancel the currently active job on that printer. This command directly communicates with the CUPS daemon to remove the job from the queue.

Exam trap

The trap here is that candidates familiar with legacy BSD/LPD printing systems may instinctively choose `lprm`, but CUPS uses the `cancel` command as its standard job cancellation tool, and `lprm` is not the correct CUPS command.

How to eliminate wrong answers

Option A is wrong because `lpstat` is used to display the status of printers and print jobs, not to cancel them. Option C is wrong because `lprm` is the BSD/LPD print system command for removing jobs; CUPS does not use `lprm` natively (though it may be aliased for compatibility, the standard CUPS command is `cancel`). Option D is wrong because `lpadmin` is used for printer configuration and administration (adding, removing, or setting default printers), not for canceling individual print jobs.

Full explanation →

388

MCQhard

A developer wants to change the ownership of all files in a directory tree to the user 'www-data' and group 'www-data', but only files that are currently owned by user 'nobody'. Which command accomplishes this?

A.chown --from=nobody www-data:www-data /path

B.find /path -user nobody -exec chown www-data:www-data {} \;

C.chown -R --from=nobody www-data:www-data /path

D.chown -R www-data:www-data /path

AnswerC

Correctly uses recursive mode and the --from option to limit changes to files owned by nobody.

Why this answer

The `chown -R --from=nobody www-data:www-data /path` command recursively changes ownership of files and directories only if they are currently owned by the user 'nobody'. The `--from` option specifies the current owner (and optionally group) to match before applying the change, and `-R` ensures recursion into subdirectories. This exactly meets the requirement to change ownership only for files owned by 'nobody'.

Exam trap

The trap here is that candidates often forget the `-R` flag for recursion or overlook the `--from` option, leading them to choose a brute-force approach like `chown -R` (option D) that changes all files regardless of current ownership, or a more complex `find`-based solution (option B) that works but is not the most direct command tested.

How to eliminate wrong answers

Option A is wrong because it lacks the `-R` flag, so it only changes ownership of the top-level directory `/path` itself, not files within the directory tree. Option B is wrong because while it uses `find` to locate files owned by 'nobody' and executes `chown`, it does not use the `--from` option and would change ownership of all files found, but the command is syntactically correct; however, it is less efficient and not the single command the question expects, and the question asks for 'which command accomplishes this' with the implication of a direct `chown` approach. Option D is wrong because it changes ownership of all files in the directory tree to 'www-data:www-data' regardless of the current owner, not only those owned by 'nobody'.

Full explanation →

389

MCQeasy

Which systemd target corresponds to the traditional runlevel 3?

A.multi-user.target

B.graphical.target

C.emergency.target

D.rescue.target

AnswerA

Multi-user.target is the standard text mode, equivalent to runlevel 3.

Why this answer

In systemd, the 'multi-user.target' corresponds to the traditional SysV runlevel 3, which provides a multi-user, non-graphical environment with networking enabled. This target is the default for headless servers and is equivalent to the old /etc/inittab runlevel 3.

Exam trap

The trap here is that candidates often confuse 'rescue.target' with runlevel 3, when in fact rescue.target is the systemd equivalent of single-user mode (runlevel 1), while multi-user.target is the correct match for runlevel 3.

How to eliminate wrong answers

Option B (graphical.target) is wrong because it corresponds to runlevel 5, which adds a display manager (e.g., GDM, LightDM) on top of multi-user.target, not runlevel 3. Option C (emergency.target) is wrong because it is the most minimal target, starting only a single root shell on the console without networking or multi-user support, analogous to runlevel 1 or S. Option D (rescue.target) is wrong because it corresponds to runlevel 1 (single-user mode), pulling in basic system services but not a full multi-user environment.

Full explanation →

390

MCQmedium

A system administrator wants to disable the graphical target and boot to the text mode multi-user.target permanently. Which command should they run?

A.systemctl enable multi-user.target

B.systemctl isolate multi-user.target

C.systemctl set-default multi-user.target

D.systemctl default multi-user.target

AnswerC

This sets the default target for future boots.

Why this answer

`systemctl set-default multi-user.target` permanently changes the default systemd target to multi-user.target, ensuring the system boots into text mode (runlevel 3 equivalent) on every subsequent boot. This persists across reboots, unlike temporary switches.

Exam trap

The trap here is confusing runtime isolation (`isolate`) with persistent default setting (`set-default`), leading candidates to choose option B for a permanent change when it only affects the current session.

How to eliminate wrong answers

Option A is wrong because `systemctl enable multi-user.target` enables the target as a unit but does not set it as the default boot target; it only ensures the target is started if something requires it, not that the system boots into it. Option B is wrong because `systemctl isolate multi-user.target` immediately switches the current running target to multi-user.target but does not persist across reboots; it is a runtime change only. Option D is wrong because `systemctl default multi-user.target` is not a valid systemctl command; the correct syntax for resetting to the compiled-in default is `systemctl default` without arguments, and it does not accept a target name.

Full explanation →

391

MCQmedium

A Linux system fails to boot with the error: 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. What is the most likely cause?

A.Missing root filesystem

B.Corrupt kernel image

C.Damaged bootloader

D.Missing or incorrect initrd

AnswerD

Initrd contains drivers needed to mount root filesystem.

Why this answer

The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or access the root filesystem during boot. The most common cause is a missing or incorrect initrd (initial RAM disk) that contains the necessary drivers (e.g., for SCSI, SATA, or filesystem modules) to mount the root partition. Without a proper initrd, the kernel lacks the modules to access the storage device, resulting in this panic.

Exam trap

The LPIC-1 exam often tests the distinction between a missing root filesystem and a missing initrd, trapping candidates who assume the error means the root partition itself is absent, when in fact the kernel cannot access it due to missing drivers in the initrd.

How to eliminate wrong answers

Option A is wrong because a missing root filesystem would typically produce a different error, such as 'No such device' or 'fsck' failures, not a kernel panic referencing 'unknown-block(0,0)', which specifically points to the kernel's inability to find the block device. Option B is wrong because a corrupt kernel image usually causes a panic earlier in the boot process (e.g., 'Kernel panic: Attempted to kill init!' or a crash during decompression), not a VFS mount failure with a block device number. Option C is wrong because a damaged bootloader (e.g., GRUB) would prevent the kernel from being loaded at all, resulting in a blank screen or 'No bootable device' error, not a kernel panic after the kernel has started executing.

Full explanation →

392

Multi-Selectmedium

Which TWO commands can be used to sort the output of ps -ef by the resident set size (RSS) in descending order?

Select 1 answer

A.ps -ef | sort -k5,5 -rn

B.ps --sort=-rss

C.ps -ef | sort -k3 -rn

D.ps --sort=rss

E.ps -ef | sort -k5 -rn

AnswersB

Correct. `--sort=-rss` sorts by RSS in descending order natively.

Why this answer

Only option B is correct. `ps --sort=-rss` uses the native sorting feature of `ps`, which directly sorts by RSS in descending order (using the minus sign prefix for reverse). Options A and E are incorrect because `ps -ef` does not output RSS; its fields are UID, PID, PPID, C, STIME, TTY, TIME, CMD, so sorting by the 5th field (STIME) does not sort by RSS. Option C sorts by the 3rd field (PPID), not RSS.

Option D sorts by RSS but in ascending order.

Exam trap

The trap here is that candidates often confuse the field number for RSS in `ps -ef` output (it is the 5th field, not the 3rd) and may overlook that `--sort=rss` defaults to ascending order, requiring a minus sign for descending.

Full explanation →

393

MCQhard

An administrator needs to display the current and previous runlevels of a Linux system. Which command provides this information?

A.who -r

B.runlevel

C.telinit 1

D.init 0

AnswerB

Outputs previous and current runlevel.

Why this answer

The `runlevel` command displays both the previous and current runlevels of a Linux system. It outputs two characters: the first indicates the previous runlevel (or 'N' if the runlevel has not changed since boot), and the second indicates the current runlevel. This is the standard tool for querying runlevel information on SysV init systems.

Exam trap

The trap here is that candidates confuse `who -r` with `runlevel` because both display the current runlevel, but `who -r` omits the previous runlevel, which is the key piece of information the question explicitly asks for.

How to eliminate wrong answers

Option A is wrong because `who -r` shows the current runlevel and the time of the last runlevel change, but it does not display the previous runlevel. Option C is wrong because `telinit 1` is used to change the runlevel to single-user mode (runlevel 1), not to display current or previous runlevels. Option D is wrong because `init 0` is used to shut down the system (runlevel 0), not to query runlevel information.

Full explanation →

394

MCQmedium

Refer to the exhibit. Based on the mount options shown, which filesystem is most likely to store filenames with mixed case and support long filenames?

A./dev/sdc1

B./dev/sda2

C./dev/sda1

D./dev/sdb1

E.tmpfs

AnswerA

Correct. The mount options utf8 and codepage=437 are characteristic of VFAT/FAT32 filesystems, which support mixed-case and long filenames via VFAT extensions.

Why this answer

The mount options shown for /dev/sdc1 include 'utf8' and 'codepage=437', which are characteristic of VFAT (or FAT32) filesystems. VFAT supports mixed-case filenames (though it is case-insensitive) and long filenames via the VFAT extension, which stores up to 255 UTF-16 characters. The other filesystems are either ext4 (which also supports mixed case and long names but does not use codepage/utf8 options) or tmpfs (which is RAM-based and not typically mounted with such options).

Exam trap

LPI often tests the misconception that ext4 filesystems require codepage or utf8 mount options for long filenames, when in fact those options are specific to FAT/VFAT filesystems that need explicit character set handling for backward compatibility with short 8.3 names.

How to eliminate wrong answers

Option B (/dev/sda2) is wrong because it is mounted as ext4 (type ext4) and does not use codepage or utf8 mount options; ext4 supports long filenames and mixed case natively but the given options are specific to FAT/VFAT. Option C (/dev/sda1) is wrong because it is mounted as ext4 (type ext4) and lacks the codepage/utf8 options that indicate a FAT-based filesystem. Option D (/dev/sdb1) is wrong because it is mounted as ext4 (type ext4) and does not have the codepage or utf8 mount options; ext4 handles filenames differently and does not require these options.

Option E (tmpfs) is wrong because tmpfs is a RAM-based filesystem that does not use codepage or utf8 mount options; it supports long filenames and mixed case but is not the filesystem most likely to store filenames with those specific mount options.

Full explanation →

395

Matchingmedium

Match each Linux directory to its standard purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

System configuration files

Variable data (logs, databases)

User-installed software and libraries

Temporary files (often cleared on reboot)

Virtual file system for process and kernel info

Why these pairings

Correct matches: /bin holds essential binaries, /etc stores system configuration, /var contains variable data. Common confusions arise from swapping purposes: /bin is not for variable data, /etc is not for temporary files, and /var does not hold binaries.

Full explanation →

396

MCQhard

A system has a software RAID1 array (/dev/md0) with two disks: /dev/sda and /dev/sdb. Disk /dev/sda fails. Which command sequence will replace the failed disk with a new /dev/sdc without stopping the array?

A.mdadm --stop /dev/md0; replace disk; mdadm --assemble /dev/md0 /dev/sdb /dev/sdc

B.mdadm --manage /dev/md0 --fail /dev/sda --remove /dev/sda && mdadm --manage /dev/md0 --add /dev/sdc

C.Shutdown system, physically replace disk, reboot

D.dd if=/dev/sdb of=/dev/sdc bs=64K

AnswerB

Correct sequence: fail, remove, then add new disk.

Why this answer

Mdadm's --manage mode allows hot-replacement of a failed disk in a RAID1 array without stopping it. The --fail flag marks /dev/sda as faulty, --remove detaches it, and --add incorporates the new /dev/sdc, triggering an automatic rebuild of the mirror.

Exam trap

The trap here is that candidates assume a failed disk requires array shutdown or physical replacement before software reconfiguration, but mdadm's --manage subcommand allows all steps (fail, remove, add) while the array remains active.

How to eliminate wrong answers

Option A is wrong because stopping the array with --stop is unnecessary and disruptive; RAID1 supports online replacement, and reassembling requires all members, risking data loss if the array is degraded. Option C is wrong because shutting down the system is not required; hot-swap capable hardware and mdadm's online management allow disk replacement without downtime. Option D is wrong because dd directly copies /dev/sdb to /dev/sdc, which overwrites the new disk's partition table and metadata, and does not integrate the disk into the RAID array; mdadm --add must be used to incorporate the new disk.

Full explanation →

397

Multi-Selectmedium

A system administrator needs to install a new kernel on a Debian-based system. Which TWO commands can be used to achieve this? (Choose TWO.)

Select 2 answers

A.apt-cache search linux-image-5.10.0-20-amd64

B.apt-get update

C.apt-get install linux-image-5.10.0-20-amd64

D.make install

E.dpkg -i linux-image-5.10.0-20-amd64.deb

AnswersC, E

apt-get install installs packages from repositories, including kernel images.

Why this answer

`apt-get install` is the standard command for installing a specific kernel package from the configured repositories on Debian-based systems. The package name `linux-image-5.10.0-20-amd64` corresponds to a precompiled kernel image that APT will download and install, automatically handling dependencies and updating the bootloader configuration.

Exam trap

The trap here is that candidates confuse package management commands (like `apt-cache search` or `apt-get update`) with installation commands, or assume that `make install` is a valid method for installing a precompiled kernel package.

Full explanation →

398

MCQmedium

A system administrator needs to ensure that the httpd service starts automatically when the system enters the multi-user.target. Which command should be used?

A.systemctl add-wants multi-user.target httpd.service

B.systemctl enable httpd

C.systemctl start httpd

D.systemctl set-default multi-user.target

AnswerB

Enables the service to start automatically on boot for the current default target.

Why this answer

The `systemctl enable httpd` command creates the necessary symlinks in the systemd unit configuration to ensure the httpd service starts automatically when the system enters the multi-user.target. This is the correct method to enable a service to start at boot in a systemd-based Linux system.

Exam trap

The trap here is confusing `systemctl start` (which only runs the service now) with `systemctl enable` (which configures it to start at boot), leading candidates to pick option C.

How to eliminate wrong answers

Option A is wrong because `systemctl add-wants` is not a valid systemd command; the correct command to add a dependency is `systemctl add-wants` (with a hyphen) but it is rarely used directly, and it does not enable the service for automatic start at boot. Option C is wrong because `systemctl start httpd` only starts the service immediately in the current session, but does not configure it to start automatically on subsequent boots. Option D is wrong because `systemctl set-default multi-user.target` sets the default target for the system (e.g., booting into multi-user mode), but does not enable any specific service to start automatically.

Full explanation →

399

MCQmedium

Based on the /etc/fstab entry, which filesystem will be checked by fsck at boot time?

A.All filesystems except NFS

B./, /boot, and /mnt/data

C./, /boot, and swap

D./ and /boot only

AnswerD

Correct: pass numbers 1 and 2.

Why this answer

The /etc/fstab entry shows that only the root filesystem (/) and /boot have a non-zero value in the pass field (the sixth field). The fsck command at boot time checks filesystems with a pass number greater than 0, and the order is determined by the pass number (root typically 1, /boot 2). Since /mnt/data and swap have a pass value of 0, they are skipped.

Exam trap

Candidates often confuse the dump field (5th column) with the pass field (6th column). fsck at boot only uses the pass field; filesystems with pass=0 (like swap and /mnt/data) are not checked, regardless of the dump field. The order of checking is determined by the pass number (root typically 1, then others with higher numbers).

How to eliminate wrong answers

Option A is wrong because not all filesystems are checked; only those with a non-zero dump field are checked, and NFS filesystems are never checked by fsck regardless of the dump field. Option B is wrong because /mnt/data has a dump value of 0, so it is not checked by fsck at boot time. Option C is wrong because swap filesystems are never checked by fsck; they have a dump value of 0 and a pass number of 0, meaning they are skipped.

Full explanation →

400

MCQhard

Refer to the exhibit. Which of the following is true about SSH access to this server?

A.User 'charlie' is denied access regardless of authentication method.

B.User 'alice' can authenticate using a password.

C.Password authentication is disabled for all users.

D.Root can log in with a password.

AnswerA

DenyUsers charlie explicitly denies access to user charlie.

Why this answer

The exhibit shows an SSH configuration with a `DenyUsers charlie` directive, which explicitly blocks user 'charlie' from any SSH access regardless of the authentication method (password, public key, etc.). This directive takes precedence over any other authentication settings, making option A correct.

Exam trap

The trap here is that candidates assume `PasswordAuthentication no` blocks all access, but `DenyUsers` is a separate, pre-authentication block that overrides other settings for specific users.

How to eliminate wrong answers

Option B is wrong because the configuration includes `PasswordAuthentication no`, which disables password-based login for all users, including 'alice'. Option C is wrong because while password authentication is disabled, other methods like public key authentication may still be allowed, so it is not disabled for all users in the sense of total SSH access. Option D is wrong because `PermitRootLogin no` explicitly prevents root from logging in via SSH, regardless of authentication method.

Full explanation →

401

MCQmedium

A sysadmin notices that after modifying iptables rules, the SSH service is unreachable from a specific subnet (192.168.1.0/24). Which command should be used to view the current rules with line numbers for easier identification?

A.iptables -L

B.iptables -L --line-numbers

C.iptables -t raw -L

D.iptables -t nat -L

AnswerB

Shows rules with line numbers for easier editing.

Why this answer

The `iptables -L --line-numbers` command displays all current iptables rules in the default filter table with line numbers prepended to each rule. This allows the sysadmin to easily identify and reference specific rules (e.g., for deletion or insertion) when troubleshooting why SSH traffic from 192.168.1.0/24 is being dropped or rejected.

Exam trap

The trap here is that candidates may choose `iptables -L` (Option A) because it shows rules, but they overlook the `--line-numbers` flag, which is critical for efficient rule management and is a common LPIC-1 exam detail.

How to eliminate wrong answers

Option A is wrong because `iptables -L` lists rules without line numbers, making it harder to pinpoint the exact rule affecting SSH traffic. Option C is wrong because `iptables -t raw -L` shows rules in the raw table, which is used for connection tracking exemptions (e.g., NOTRACK), not for filtering SSH traffic. Option D is wrong because `iptables -t nat -L` shows rules in the NAT table, which handles address translation (SNAT/DNAT) and does not affect packet filtering decisions for SSH reachability.

Full explanation →

402

Multi-Selecthard

Which THREE of the following directories are part of the FHS and must be present on a standard Linux system? (Choose three.)

Select 3 answers

A./var

B./etc

C./lost+found

D./bin

E./home

AnswersA, B, D

/var is required for variable data.

Why this answer

/var is required by the FHS to store variable data such as logs (/var/log), mail spools, and print queues. It must exist on a standard Linux system because many core services depend on it for runtime data that changes in size and content.

Exam trap

The trap here is that /lost+found appears essential because it is commonly seen on ext filesystems, but it is not part of the FHS mandatory list, and /home is often assumed required due to its ubiquity, yet the FHS does not mandate it for a standard Linux system.

Full explanation →

403

MCQeasy

An organization wants to implement a centralized logging solution for multiple Linux servers. Which service should run on the central server to receive syslog messages?

A.journald

B.syslogd

C.rsyslogd

D.syslog-ng

AnswerC

Standard syslog daemon used for receiving remote logs.

Why this answer

rsyslogd is the correct choice because it is the modern, enhanced syslog daemon that supports reliable TCP-based logging, advanced filtering, and centralized log collection. It is the default syslog daemon on most major Linux distributions and is designed to receive syslog messages from remote servers over the network, making it ideal for a centralized logging solution.

Exam trap

The trap here is that candidates may confuse journald (which is the local log collector in systemd) with a network syslog receiver, or assume that any syslog daemon (like syslogd or syslog-ng) is equally correct, but rsyslogd is the standard, modern, and most commonly tested solution for centralized logging in LPIC-1.

How to eliminate wrong answers

Option A is wrong because journald is the systemd journal daemon that collects and stores binary log data locally; it does not natively act as a network syslog receiver without additional configuration or a forwarding agent. Option B is wrong because syslogd is the original, legacy syslog daemon that lacks support for TCP, advanced filtering, and reliable message delivery, making it unsuitable for modern centralized logging. Option D is wrong because syslog-ng is a valid alternative syslog daemon that can receive remote messages, but it is not the standard or default choice on most Linux distributions, and the question asks which service should run on the central server—rsyslogd is the most common and expected answer in an LPIC-1 context.

Full explanation →

404

MCQmedium

An administrator needs to mount a USB drive with the ext4 filesystem automatically at boot. The drive has a filesystem label 'DATA'. Which entry in /etc/fstab will mount it at /mnt/data with noatime and default mount options?

A./dev/sdb1 /mnt/data ext4 noatime,defaults 0 0

B.LABEL=DATA /mnt/data ext4 noatime,defaults 0 0

C.LABEL=DATA /mnt/data ext4 defaults 0 0

D.UUID=DATA /mnt/data ext4 noatime,defaults 0 0

AnswerB

Correct use of label and options.

Why this answer

It uses the filesystem label 'DATA' to identify the USB drive, which is more reliable than a device name like /dev/sdb1 that can change between boots. The mount options 'noatime,defaults' are specified in the correct order, with 'defaults' providing standard mount options (rw, suid, dev, exec, auto, nouser, async) and 'noatime' disabling access time updates to reduce writes. The entry also includes the proper ext4 filesystem type and the mount point /mnt/data.

Exam trap

The trap here is that candidates often default to using /dev/sdX device names (option A) out of habit, forgetting that device names are dynamic and unreliable for persistent mounts, while also overlooking that 'defaults' must be explicitly included when other options like 'noatime' are specified.

How to eliminate wrong answers

Option A is wrong because it uses the device path /dev/sdb1, which is not guaranteed to be consistent across reboots (e.g., if another USB drive is plugged in, the device name may change), making it unsuitable for automatic boot mounting. Option C is wrong because it omits the 'noatime' mount option, which the question explicitly requires for the mount. Option D is wrong because 'UUID=DATA' is invalid syntax; UUIDs are hexadecimal strings (e.g., UUID=1234-5678), not arbitrary labels, and the correct identifier for a filesystem label is 'LABEL=DATA'.

Full explanation →

405

MCQmedium

A web server running on this host is not accessible from clients. Based on the exhibit, what is the most likely reason?

A.The FORWARD chain policy is DROP.

B.The OUTPUT chain policy is ACCEPT.

C.Incoming HTTP traffic is blocked by a DROP rule on port 80.

D.SSH traffic is blocked.

AnswerC

The rule explicitly drops TCP port 80.

Why this answer

The exhibit shows a firewall rule set where the INPUT chain has a DROP rule for destination port 80 (HTTP). Since incoming HTTP traffic from clients must traverse the INPUT chain to reach the local web server process, this DROP rule explicitly blocks all inbound HTTP requests, making the web server inaccessible. The FORWARD chain is irrelevant because traffic destined for the local host uses the INPUT chain, not FORWARD.

Exam trap

The trap here is that candidates often confuse the FORWARD chain with the INPUT chain, assuming that blocking traffic to a local service requires a FORWARD rule, when in fact the INPUT chain governs packets destined for the host itself.

How to eliminate wrong answers

Option A is wrong because the FORWARD chain policy only affects traffic routed through the host (e.g., acting as a router), not traffic destined for the local host; the web server is local, so FORWARD is not involved. Option B is wrong because the OUTPUT chain policy being ACCEPT controls outbound traffic from the local host, not inbound HTTP requests from clients; it has no effect on incoming connections. Option D is wrong because SSH traffic (port 22) is not mentioned in the exhibit as being blocked; the issue is specifically HTTP on port 80, and SSH is irrelevant to web server accessibility.

Full explanation →

406

MCQmedium

A system administrator notices that the server's clock is consistently off by several minutes. Which service should be used to synchronize the time with an external time source?

A.ntpd

B.timed

C.chronyd

D.systemd-timesyncd

AnswerA

ntpd is the standard NTP daemon for time synchronization.

Why this answer

The Network Time Protocol (NTP) daemon (ntpd) is the traditional and widely used service for synchronizing a server's clock with an external time source. It continuously adjusts the system time by communicating with NTP servers, compensating for clock drift and network delays to maintain accurate time. This makes ntpd the correct choice for resolving a consistent clock offset of several minutes.

Exam trap

The trap here is that candidates may confuse chronyd (a modern alternative) with ntpd, but LPIC-1 traditionally expects ntpd as the standard answer for time synchronization, even though chronyd is also correct in practice—the exam tests knowledge of the classic service name.

How to eliminate wrong answers

Option B (timed) is wrong because 'timed' is not a standard Linux time synchronization service; it is a legacy BSD tool for time synchronization and is not used in modern Linux distributions. Option C (chronyd) is wrong because although chronyd is a valid NTP client and server (part of the chrony suite) and can synchronize time, it is not the service named in the question's context—the question specifically asks for the service that should be used, and ntpd is the classic, expected answer for LPIC-1. Option D (systemd-timesyncd) is wrong because it is a lightweight SNTP client that only performs periodic time corrections and lacks the full NTP protocol capabilities (e.g., it cannot act as a time server or handle large clock offsets as effectively as ntpd), making it unsuitable for consistently correcting a several-minute offset.

Full explanation →

407

Multi-Selectmedium

Which TWO of the following are required for a bash script to be executed by the shell (assuming the script is in the current directory)?

Select 2 answers

A.The script must have a shebang (#!) as the first line.

B.The script must not contain any comments.

C.The script must have a .sh extension.

D.The script must be in the PATH environment variable.

E.The script must have execute permission.

AnswersA, E

Required to specify interpreter.

Why this answer

The shebang (#!) as the first line of a bash script tells the kernel which interpreter to use (e.g., #!/bin/bash). Without it, the shell may attempt to execute the script using the default shell (often /bin/sh), which can lead to syntax errors or unexpected behavior. The shebang is essential for explicitly specifying the interpreter, especially when the script uses bash-specific features.

Exam trap

LPI often tests the misconception that a .sh extension is required for shell scripts, but Linux/Unix systems determine executability via the shebang and execute permission, not file extensions.

Full explanation →

408

Multi-Selecteasy

Which TWO of the following are valid methods to change the default runlevel on a SysV init-based system?

Select 2 answers

A.Use the 'runlevel' command to set the default runlevel.

B.Edit /etc/inittab to set the initdefault line.

C.Pass the desired runlevel as a kernel parameter at boot time.

D.Use 'systemctl set-default' to set the default runlevel.

E.Use the 'telinit' command to change the default runlevel.

AnswersB, C

The initdefault line in /etc/inittab defines the default runlevel.

Why this answer

In SysV init-based systems, the default runlevel is defined in the /etc/inittab file by the 'initdefault' line, which specifies the runlevel the system should enter after boot. Editing this line is the standard method to permanently change the default runlevel. Option B correctly identifies this mechanism.

Exam trap

The trap here is that candidates confuse the 'runlevel' command (which only displays) with a command that can set the default, or they mistakenly apply systemd commands like 'systemctl set-default' to SysV init systems.

Full explanation →

409

MCQeasy

Refer to the exhibit. What is the current state of the SSH service?

A.It is active and running

B.It is inactive

C.It is disabled

D.It has failed

AnswerA

Correct: clearly states 'active (running)'.

Why this answer

The exhibit shows the output of `systemctl status sshd`, which displays the service state as 'active (running)' in the green text. This indicates that the SSH daemon (sshd) is currently loaded and executing, providing secure shell access to the system. The 'active (running)' state is the normal operational state for a service that has been started and is functioning correctly.

Exam trap

LPI often tests the distinction between a service's current runtime state (active/inactive) and its boot-time enablement (enabled/disabled), causing candidates to confuse 'disabled' with 'inactive' when the question explicitly asks for the current state.

How to eliminate wrong answers

Option B is wrong because 'inactive' would show as 'inactive (dead)' in the systemctl status output, meaning the service is not currently running, but the exhibit clearly shows 'active (running)'. Option C is wrong because 'disabled' refers to the service's startup configuration (whether it starts automatically at boot), not its current runtime state; the exhibit shows the service is enabled for startup, but the question asks about the current state. Option D is wrong because 'failed' would display as 'failed' with a red indicator, indicating the service exited with an error or crashed, which is not shown in the exhibit.

Full explanation →

410

Matchingmedium

Match each ACL term to its meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Permissions for a specific user

Permissions for a specific group

Maximum permissions for named users and groups

Permissions for everyone else

Inherited ACL for new files/directories

Why these pairings

The correct matches: Access ACL applies to files and directories; Default ACL applies to new objects; Mask limits permissions for named users/groups. Common confusions include applying ACLs only to directories or misinterpreting mask as owner permissions.

Full explanation →

411

MCQeasy

A user reports that they cannot connect to a remote server using SSH. The administrator checks the SSH server status and it is running. Which of the following is the most likely cause?

A.A firewall is blocking port 22.

B.The client's subnet mask is incorrect.

C.The client cannot resolve the server's hostname.

D.The SSH server is using UDP instead of TCP.

AnswerA

Firewall blocking SSH port is a common issue.

Why this answer

SSH operates over TCP port 22 by default. If the SSH server is running but the client cannot connect, a firewall blocking port 22 is the most likely cause because it would prevent the TCP handshake from completing, even though the SSH daemon (sshd) is active and listening.

Exam trap

The trap here is that candidates may assume a running SSH server guarantees connectivity, overlooking that a firewall can block the port even when the service is active, or they may confuse SSH's TCP usage with UDP-based protocols like DNS.

How to eliminate wrong answers

Option B is wrong because an incorrect subnet mask would prevent the client from reaching any host outside its local subnet, but the question specifies a remote server, so routing or gateway issues would be more relevant; a subnet mask error alone would not selectively block SSH while allowing other traffic. Option C is wrong because if the client cannot resolve the server's hostname, the user would likely receive a 'Name or service not known' error, not a connection failure to a running SSH server; the administrator could test with the server's IP address to isolate DNS issues. Option D is wrong because SSH uses TCP (Transmission Control Protocol) for reliable, connection-oriented communication, not UDP; UDP is used by protocols like DNS or DHCP, and SSH has no UDP mode.

Full explanation →

412

MCQhard

A sysadmin wants to prevent an APT package from being upgraded automatically but still allow it to be upgraded manually if needed. Which configuration method best achieves this?

A.Set the package version to a non-existent version in /etc/apt/preferences

B.Use 'apt-mark hold <package>'

C.Add the package to /etc/apt/preferences with Pin-Priority: 1000

D.Remove the package from sources.list

AnswerB

This marks the package as held, preventing automatic upgrades.

Why this answer

The `apt-mark hold <package>` command marks a package as held back, preventing it from being automatically upgraded during `apt upgrade` or `apt dist-upgrade`, while still allowing manual upgrades via `apt install <package>` or `apt-mark unhold`. This directly meets the requirement of blocking automatic upgrades but permitting manual intervention.

Exam trap

The trap here is that candidates confuse `apt-mark hold` with pinning in `/etc/apt/preferences`, assuming a high Pin-Priority (like 1000) prevents upgrades, when in fact it only sets preference order and does not block automatic upgrades.

How to eliminate wrong answers

Option A is wrong because setting a package version to a non-existent version in `/etc/apt/preferences` does not prevent upgrades; APT will simply ignore the invalid version and may still upgrade the package to the next available version. Option C is wrong because a Pin-Priority of 1000 in `/etc/apt/preferences` forces the package to be installed from a specific release, but it does not prevent automatic upgrades—it actually encourages them by making that version the preferred candidate. Option D is wrong because removing the package from `sources.list` would remove the repository entirely, preventing both automatic and manual upgrades of that package (and all other packages from that repository), which is too broad and does not target a single package.

Full explanation →

413

MCQeasy

Refer to the exhibit. The system administrator sees that /var/log is 93% full and the syslog file is nearly 2 GB. What is the most appropriate immediate action to free up disk space without losing any critical log data?

A.Run 'logrotate -f /etc/logrotate.conf' to force log rotation.

B.Increase the size of the /var/log partition using lvextend.

C.Delete /var/log/syslog and restart the syslog daemon.

D.Move /var/log/syslog to /tmp and create a symbolic link.

AnswerA

logrotate will compress and rotate the file, freeing space while keeping old logs.

Why this answer

'logrotate -f' forces an immediate rotation of all log files as defined in /etc/logrotate.conf, which compresses or archives the current syslog file (e.g., syslog becomes syslog.1) and creates a fresh empty log file. This frees disk space without deleting any data, as the rotated logs remain on disk until the configured retention policy removes them. It is the standard, safe immediate action for a nearly full /var/log partition.

Exam trap

LPI often tests the misconception that deleting or moving log files is acceptable, when in fact the correct immediate action is to use logrotate -f to safely rotate logs without data loss.

How to eliminate wrong answers

Option B is wrong because increasing the partition size with lvextend does not free up existing disk space; it only adds more capacity, which does not address the immediate 93% full condition and may not be possible without available free space in the volume group. Option C is wrong because deleting /var/log/syslog and restarting the syslog daemon permanently loses all current log data, which violates the requirement to not lose any critical log data. Option D is wrong because moving the syslog file to /tmp and creating a symbolic link does not free up space on /var/log (the file still occupies space elsewhere), and /tmp is often a tmpfs filesystem that may lose data on reboot, risking log loss.

Full explanation →

414

MCQmedium

An administrator needs to mount an ISO file located at /tmp/data.iso to /mnt/iso for read-only access. Which command should be used?

A.mount /tmp/data.iso /mnt/iso

B.mount -t iso9660 -o loop /tmp/data.iso /mnt/iso

C.mount -o loop,ro /tmp/data.iso /mnt/iso

D.mount -o ro,loop /mnt/iso /tmp/data.iso

AnswerC

Correctly uses loop device and read-only option.

Why this answer

It uses the `-o loop,ro` options to mount the ISO file as a loop device with read-only access. The `loop` option is required to mount a file as a block device, and `ro` ensures the filesystem is mounted read-only, which is appropriate for an ISO image (typically an iso9660 filesystem).

Exam trap

The trap here is that candidates often forget the `loop` option when mounting a file, or they incorrectly specify the filesystem type with `-t iso9660` thinking it is required, while the kernel can auto-detect it, and they may also reverse the source and mount point arguments.

How to eliminate wrong answers

Option A is wrong because it does not specify the `loop` option, so the mount command will attempt to mount the file as a block device directly, which will fail since `/tmp/data.iso` is a regular file, not a block device. Option B is wrong because it explicitly specifies `-t iso9660`, which is unnecessary and may cause the mount to fail if the ISO uses a different filesystem (e.g., UDF) or if the kernel's iso9660 module is not loaded; the `-o loop` option alone is sufficient for the kernel to auto-detect the filesystem type. Option D is wrong because it swaps the source and target arguments: the source (the ISO file) must come first, and the mount point second; additionally, it places `/mnt/iso` as the source, which is incorrect.

Full explanation →

415

MCQmedium

To add a kernel parameter temporarily to the kernel command line at boot, what key should be pressed in the GRUB menu?

A.e

B.b

C.r

D.c

AnswerA

Press 'e' to edit the selected boot entry.

Why this answer

Pressing 'e' in the GRUB menu enters the edit mode for the selected boot entry, allowing you to temporarily modify kernel parameters on the command line (e.g., adding 'single' for single-user mode or 'nomodeset' for graphics issues). These changes apply only to the current boot and are not saved to the GRUB configuration file.

Exam trap

The trap here is that candidates confuse the 'e' (edit) key with 'c' (command line) or 'b' (boot), assuming they can add parameters via the GRUB shell or by simply booting, but only 'e' provides direct access to modify the kernel command line for a single boot.

How to eliminate wrong answers

Option B is wrong because pressing 'b' in GRUB Legacy boots the selected entry immediately without any editing capability; it does not allow adding kernel parameters. Option C is wrong because pressing 'r' is not a standard GRUB key; it has no function in the GRUB menu for editing kernel parameters. Option D is wrong because pressing 'c' opens the GRUB command-line interface (a shell-like environment), not an editor for the kernel command line of a specific boot entry.

Full explanation →

416

MCQeasy

Which command schedules a job to run once at 2:30 PM today?

A.crontab -e

B.batch

C.at 14.30

D.at 14:30

AnswerD

The 'at' command with a time in 24-hour format schedules a one-time job at that time.

Why this answer

The `at` command schedules a one-time job for a specified time. The correct syntax uses a colon (:) to separate hours and minutes, as in `at 14:30`, which schedules the job for 2:30 PM today. Option D is correct because it follows the standard `at` time format.

Exam trap

The trap here is that candidates may confuse the `at` time separator (colon) with the period used in some other contexts, or mistakenly think `crontab` can schedule one-time jobs, leading them to choose option A or C.

How to eliminate wrong answers

Option A is wrong because `crontab -e` edits the user's cron table for recurring jobs (e.g., daily, weekly), not for one-time execution. Option B is wrong because `batch` schedules jobs to run when system load levels permit, not at a specific time. Option C is wrong because `at 14.30` uses a period (.) instead of a colon (:), which is not a valid time separator for the `at` command; the correct syntax requires a colon.

Full explanation →

417

MCQhard

A dependency analysis shows that removing package 'libfoo' will also remove 'appA' and 'appB' because they depend on libfoo. The administrator wants to remove libfoo but keep appA and appB. What is the best approach?

A.Force removal of libfoo using `dpkg --force-depends`.

B.Recompile appA and appB without the dependency on libfoo.

C.Check if a compatible alternative package exists and install it, then remove libfoo.

D.Use `apt-get remove libfoo --no-dep`

AnswerC

Allows removal while preserving dependent applications.

Why this answer

The best approach is to find a compatible alternative package that provides the same functionality as libfoo and can satisfy the dependencies of appA and appB, then install it before removing libfoo. The other options are flawed: `--no-dep` option does not exist, recompiling both applications is time-consuming and risky, and force removal would break the dependent applications.

Full explanation →

418

Multi-Selecteasy

Which TWO of the following are Debian package management tools?

Select 2 answers

A.yum

B.dpkg

C.rpm

D.apt

E.zypper

AnswersB, D

dpkg is the low-level package manager for Debian-based systems.

Why this answer

B is correct because dpkg is the core low-level package manager for Debian-based systems, handling installation, removal, and querying of .deb packages directly. D is correct because apt (Advanced Package Tool) is the high-level package management tool that resolves dependencies and retrieves packages from repositories, built on top of dpkg.

Exam trap

The trap here is that candidates often confuse package managers by distribution family (e.g., thinking yum or rpm could be Debian tools because they are also 'package managers'), but LPIC-1 tests the specific association of dpkg and apt with Debian-based systems versus rpm-based tools like yum, rpm, and zypper.

Full explanation →

419

MCQeasy

A user reports that a file cannot be saved due to 'No space left on device'. Which command should the administrator use to verify disk usage?

A.du -sh /

B.fdisk -l

C.df -i

D.df -h

AnswerD

Correct: shows disk space usage.

Why this answer

The 'df -h' command displays disk space usage in human-readable format (e.g., GB, MB) for all mounted filesystems. When a user encounters 'No space left on device', the most direct verification is to check available disk space with 'df -h', which shows used and available blocks. Option D is correct because it specifically addresses the space shortage indicated by the error.

Exam trap

The trap here is that candidates may confuse 'df -h' (disk free, human-readable) with 'du -sh' (disk usage summary) or 'df -i' (inode usage), not recognizing that the error message directly points to block space exhaustion, which 'df -h' is designed to check.

How to eliminate wrong answers

Option A is wrong because 'du -sh /' summarizes disk usage of the root directory, not the available space on the filesystem; it can be slow and does not show free space. Option B is wrong because 'fdisk -l' lists partition tables and disk geometry, not filesystem-level usage or free space. Option C is wrong because 'df -i' shows inode usage, not block space; the error 'No space left on device' typically refers to block space exhaustion, though inode exhaustion can produce a similar message, but the question asks to verify disk usage, not inode usage.

Full explanation →

420

MCQhard

Based on the exhibit, the 'custom' repository shows 0 packages. What is the most likely cause?

A.The repository is disabled because 'enabled=1' is missing

B.The $releasever or $basearch variables are not expanding correctly, leading to an invalid URL

C.The GPG key is missing, causing yum to ignore the repository

D.The repository metadata is corrupt and needs to be regenerated

AnswerB

Variables may not be set or the repository doesn't exist for that release.

Why this answer

The 'custom' repository shows 0 packages because the $releasever or $basearch variables are not expanding correctly, resulting in an invalid or unreachable repository URL. Yum uses these variables to dynamically construct the baseurl, and if they are undefined or incorrect (e.g., due to a missing or misconfigured /etc/yum/vars/ directory or incorrect release version), the repository metadata cannot be downloaded, so yum reports 0 packages available.

Exam trap

The trap here is that candidates often assume 'enabled=1' is mandatory or that GPG key issues cause repositories to be ignored, but the real culprit is variable expansion failure, which silently yields an empty package list without error messages.

How to eliminate wrong answers

Option A is wrong because 'enabled=1' is not required; the default value for 'enabled' is 1 (enabled) if the directive is omitted, so missing it does not disable the repository. Option C is wrong because a missing GPG key would cause yum to warn or fail on package installation, not ignore the repository entirely or show 0 packages; yum still fetches metadata and lists packages even without a GPG key. Option D is wrong because corrupt repository metadata would typically cause a checksum error or a failure to parse the metadata, not a clean display of 0 packages; yum would report an error rather than silently showing zero packages.

Full explanation →

421

MCQeasy

A user downloaded a Debian package file named 'software.deb'. Which command should be used to install it?

A.rpm -ivh software.deb

B.apt install software.deb

C.apt-get install software.deb

D.dpkg -i software.deb

AnswerD

dpkg -i installs a .deb package locally.

Why this answer

The correct command is `dpkg -i software.deb` because `dpkg` is the low-level package manager for Debian-based systems that directly installs `.deb` files. The `-i` flag tells `dpkg` to install the specified package file from the local filesystem, which is exactly what is needed when you have a downloaded `.deb` file.

Exam trap

The trap here is that candidates confuse `apt`/`apt-get` (which manage packages from repositories) with `dpkg` (which handles local `.deb` files), leading them to incorrectly assume `apt install` can accept a filename directly.

How to eliminate wrong answers

Option A is wrong because `rpm` is the package manager for Red Hat-based systems (e.g., Fedora, CentOS) and cannot install Debian `.deb` packages; it expects `.rpm` files. Option B is wrong because `apt install` expects a package name from a configured repository, not a local `.deb` filename; it will fail with an 'unable to locate package' error. Option C is wrong because `apt-get install` also expects a repository package name, not a local file path; it does not accept `.deb` filenames directly.

Full explanation →

422

MCQhard

Refer to the exhibit. An administrator is trying to install Google Chrome but receives a GPG error. Which command should be run to add the repository's GPG key?

A.`wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -`

B.`gpg --import https://dl.google.com/linux/linux_signing_key.pub`

C.`apt-key adv --keyserver keyserver.ubuntu.com --recv-keys <keyid>`

D.`dpkg --add-key google`

AnswerA

Downloads and adds the key to apt's keyring.

Why this answer

It downloads the Google Linux signing key from the official URL and pipes it directly into `apt-key add`, which imports the key into APT's trusted keyring. This resolves the GPG error by allowing APT to verify the authenticity of packages from the Google Chrome repository.

Exam trap

The trap here is that candidates may confuse `gpg --import` (which affects the user's personal GPG keyring) with `apt-key add` (which affects the system-wide APT trusted keyring), or assume that any keyserver-based retrieval will work for all repositories.

How to eliminate wrong answers

Option B is wrong because `gpg --import` is used to import keys into the local GPG keyring, not into APT's trusted keyring; APT requires keys to be added via `apt-key` or placed in `/etc/apt/trusted.gpg.d/`. Option C is wrong because it assumes the key is available on a keyserver, but Google's signing key is not published on the Ubuntu keyserver; the command would fail to retrieve the key. Option D is wrong because `dpkg --add-key` is not a valid dpkg command; dpkg does not manage GPG keys for APT repositories.

Full explanation →

423

MCQhard

A Debian system has a broken package that was partially installed. Which command will attempt to fix dependencies and configure all unpacked but not configured packages?

A.dpkg -i --force-depends

B.apt-get autoremove

C.apt-get clean

D.dpkg --configure -a

AnswerD

This configures all unpacked packages, fixing incomplete installations.

Why this answer

The command `dpkg --configure -a` is the correct choice because it configures all unpacked but not yet configured packages, and also attempts to fix dependency issues by re-running the configuration scripts. This is the standard way to recover from a partially installed package on Debian systems, as it ensures all packages in the 'unpacked' or 'half-configured' state are fully processed.

Exam trap

The trap here is that candidates confuse `dpkg --configure -a` with `apt-get install -f` (which fixes broken dependencies by installing missing packages), but the question specifically asks for configuring unpacked packages, not just fixing dependencies.

How to eliminate wrong answers

Option A is wrong because `dpkg -i --force-depends` forces installation of a package even if dependencies are unmet, which can break the system further and does not specifically target unpacked but not configured packages. Option B is wrong because `apt-get autoremove` removes packages that were automatically installed as dependencies and are no longer needed, not fixing partially installed packages. Option C is wrong because `apt-get clean` clears the local repository of retrieved package files (.deb) from the cache, which has no effect on package configuration or dependency resolution.

Full explanation →

424

MCQmedium

A developer is troubleshooting a shell script that uses the variable $HOME but it outputs nothing when the script runs. The script is executed with ./script.sh from an interactive shell. What is the most likely cause?

A.The script is run with sh instead of bash

B.The script is run with sudo

C.The HOME variable is not exported

D.The user has no home directory

AnswerD

If the user has no home directory, the HOME variable may not be set or may be empty, leading to no output when referenced in a script. This is the most likely cause among the options.

Why this answer

In an interactive shell, the HOME variable is typically exported by the login process and inherited by child processes. The most likely cause for $HOME being empty is that the user has no home directory defined in the password database (or the directory doesn't exist), which can cause the variable to be empty or unset in some configurations. Options A and B would not cause $HOME to be empty; using sh instead of bash or running with sudo would still provide a HOME value (possibly different) or set it to root's home.

Exam trap

Candidates often mistakenly think HOME must be exported, but in interactive shells it is already exported. The real pitfall is that a missing home directory entry can leave HOME unset.

How to eliminate wrong answers

Option A is wrong because running with sh instead of bash does not affect the HOME variable; HOME is a standard environment variable set by the system regardless of the shell. Option B is wrong because running with sudo does not clear HOME by default; sudo preserves the HOME variable unless explicitly configured with env_reset or the -H flag. Option D is wrong because if the user had no home directory, the HOME variable would still be set to the default (e.g., /) or the system would assign a fallback; the variable would not be empty.

Full explanation →

425

MCQeasy

A user reports that they cannot access the company's web server. The administrator confirms the server is running and network connectivity is fine. Which command should be used to verify that the HTTP service is listening on the correct port?

A.ping 127.0.0.1

B.netstat -rn

C.iperf3 -c localhost

D.ss -tlnp

AnswerD

Shows listening TCP sockets with port and process.

Why this answer

`ss -tlnp`, is correct because it lists TCP listening sockets with their port numbers and associated processes. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` displays numeric addresses and ports (avoiding DNS lookups), and `-p` reveals the process ID/name. This directly verifies whether the HTTP service (typically port 80 or 443) is actively listening on the expected interface.

Exam trap

The trap here is that candidates may confuse general network connectivity tools (ping, iperf3) or routing commands (netstat -rn) with service-specific port listening checks, failing to recognize that only `ss` (or `netstat -tlnp`) directly confirms the HTTP daemon is bound to the correct port.

How to eliminate wrong answers

Option A is wrong because `ping 127.0.0.1` tests only local loopback connectivity and does not check whether a specific service (like HTTP) is listening on a port. Option B is wrong because `netstat -rn` displays the routing table, not listening sockets or service ports. Option C is wrong because `iperf3 -c localhost` is a network throughput testing tool that measures bandwidth between client and server, not a command to verify whether a specific service is listening on a port.

Full explanation →

426

MCQeasy

A user frequently runs 'ls -la' and wants to create an alias 'll' for this command. Which command adds this alias persistently?

A.export ll='ls -la'

B.echo "alias ll='ls -la'" >> ~/.bashrc

C.alias ll='ls -la'

D.alias ll='ls -la' && echo "alias ll='ls -la'" >> ~/.bashrc

AnswerD

Creates the alias immediately and persists it to ~/.bashrc.

Why this answer

It first creates the alias in the current shell session with the `alias` command, then appends the same alias definition to `~/.bashrc` to make it persistent across new shell sessions. The `&&` ensures the second command runs only if the first succeeds, and `~/.bashrc` is the standard file for user-specific Bash aliases that are sourced on interactive shell startup.

Exam trap

The trap here is that candidates often think the `alias` command alone (Option C) is sufficient for persistence, or they confuse `export` with alias creation (Option A), not realizing that `alias` is a shell built-in that only affects the current session and must be added to a startup file to survive reboots.

How to eliminate wrong answers

Option A is wrong because `export` is used to set environment variables, not shell aliases; `export ll='ls -la'` would create an environment variable named `ll` with the value `ls -la`, which is not an alias and will not be expanded by the shell. Option B is wrong because while it correctly appends the alias definition to `~/.bashrc` for persistence, it does not create the alias in the current shell session; the user would need to source the file or run the alias command separately to use `ll` immediately. Option C is wrong because the `alias` command alone creates the alias only for the current shell session; it does not persist across logouts or new terminal windows.

Full explanation →

427

MCQmedium

A system administrator needs to see the boot messages recorded by systemd-journald from the current boot. Which command is most appropriate?

A.journalctl -b

B.dmesg

C.tail -n 50 /var/log/syslog

D.cat /var/log/messages

AnswerA

Correctly shows all log entries from the current boot, including boot-time messages.

Why this answer

The `journalctl -b` command is the most appropriate because it specifically queries the systemd journal for messages from the current boot. Systemd-journald is the default logging daemon on modern Linux distributions, and `journalctl -b` filters the binary journal to show only entries with a boot ID matching the current boot, which includes kernel messages, service logs, and boot-time events.

Exam trap

The trap here is that candidates often confuse `dmesg` (which shows kernel messages) with the full boot log, or assume traditional syslog files like `/var/log/messages` are still the primary source on systemd-based systems, leading them to overlook the journal-specific `journalctl -b` command.

How to eliminate wrong answers

Option B is wrong because `dmesg` shows only kernel ring buffer messages, not the full set of boot messages recorded by systemd-journald (e.g., service startup logs). Option C is wrong because `tail -n 50 /var/log/syslog` reads a traditional text log file that may not exist on systems using journald, and it shows only the last 50 lines of general system logs, not specifically boot messages from the current boot. Option D is wrong because `/var/log/messages` is a legacy log file used by syslog, not by systemd-journald; on modern systems, this file may be absent or incomplete, and it does not provide a boot-specific filter.

Full explanation →

428

MCQmedium

Refer to the exhibit. During the next boot, which filesystem will be checked first by fsck?

A./dev/sda1

B.All checked in parallel

C./dev/sda2

D./dev/sda3

AnswerA

It has fsck order 1.

Why this answer

The order in which fsck checks filesystems during boot is determined by the pass number (field 6) in /etc/fstab. The filesystem with the lowest pass number is checked first. In the exhibit, /dev/sda1 has a pass number of 1, while /dev/sda2 and /dev/sda3 have pass numbers of 2, so /dev/sda1 will be checked first.

Exam trap

The trap here is that candidates often assume all filesystems are checked in parallel or that the order is based on device naming (e.g., sda1 before sda2), rather than understanding that the explicit pass number in /etc/fstab dictates the sequence.

How to eliminate wrong answers

Option B is wrong because filesystems are not all checked in parallel; fsck checks them sequentially based on their pass number, and only filesystems with the same pass number (and on different physical drives) may be checked in parallel. Option C is wrong because /dev/sda2 has a pass number of 2, which is higher than 1, so it will be checked after /dev/sda1. Option D is wrong because /dev/sda3 also has a pass number of 2, so it will be checked after /dev/sda1, not first.

Full explanation →

429

MCQhard

Refer to the exhibit. The job runs every hour but the administrator notices that it does not execute on Sundays. Which cron syntax element is responsible?

A.The minute field

B.The hour field

C.The month field

D.The day-of-week field

AnswerD

Correct: 1-6 excludes Sunday.

Why this answer

The day-of-week field (the 5th field in a cron expression) controls which days of the week the job runs. If this field is set to 1-6 (Monday–Saturday) or explicitly excludes 0/7 (Sunday), the job will not execute on Sundays. Since the job runs every hour but not on Sundays, the day-of-week field is responsible.

Exam trap

The trap here is that candidates often confuse the day-of-month field (3rd field) with the day-of-week field (5th field), or assume the hour field controls daily execution, when in fact the day-of-week field is the only one that can selectively exclude a specific weekday like Sunday.

How to eliminate wrong answers

Option A is wrong because the minute field (1st field) controls the minute within the hour when the job runs, not the day of the week; it would affect timing within each hour, not skip entire days. Option B is wrong because the hour field (2nd field) controls which hours of the day the job runs, not which days of the week; it could restrict execution to certain hours but cannot exclude an entire day like Sunday. Option C is wrong because the month field (4th field) controls which months the job runs, not days of the week; it could skip entire months but not specific weekdays.

Full explanation →

430

MCQeasy

A user reports that when they run 'ls -l' in their home directory, they see files but all files have permissions like '-rwxrwxrwx', which is unexpected. The system administrator checks and finds that the user's umask is set to 000. The user wants all new files to be created with default permissions of -rw-r--r-- (644) and directories that are drwxr-xr-x (755). What should the user set their umask to?

A.007

B.022

C.002

D.027

AnswerB

022 gives files 644 and directories 755.

Why this answer

The umask is a three-digit octal value that is subtracted from the default base permissions (666 for files, 777 for directories) to determine the default permissions for newly created files and directories. To achieve file permissions of 644 (rw-r--r--) and directory permissions of 755 (rwxr-xr-x), the umask must be 022. This is because 666 - 022 = 644 for files, and 777 - 022 = 755 for directories.

Exam trap

The trap here is that candidates often mistakenly think the umask is added to or directly specifies the permissions, rather than understanding it is subtracted from the default base permissions (666 for files, 777 for directories).

How to eliminate wrong answers

Option A (007) is wrong because it would result in file permissions of 660 (rw-rw----) and directory permissions of 770 (rwxrwx---), which are too restrictive for the desired 644/755. Option C (002) is wrong because it would yield file permissions of 664 (rw-rw-r--) and directory permissions of 775 (rwxrwxr-x), giving group write access, which is not the requested 644/755. Option D (027) is wrong because it would produce file permissions of 640 (rw-r-----) and directory permissions of 750 (rwxr-x---), which are too restrictive for both files and directories.

Full explanation →

431

MCQmedium

A system administrator wants to monitor network traffic on a specific port (TCP/443) entering the server. Which command will capture packets on interface eth0 and display them in real-time?

A.netstat -tulpn | grep :443

B.ss -tulpn | grep :443

C.tcpdump -i eth0 port 443

D.iptables -L -n -v

AnswerC

tcpdump captures packets on specified port.

Why this answer

C is correct because `tcpdump -i eth0 port 443` captures packets on interface eth0 filtering for TCP port 443 (HTTPS) and displays them in real-time as they arrive. This command uses the libpcap library to intercept raw network frames, making it the standard tool for live packet capture and analysis.

Exam trap

The trap here is that candidates confuse commands that show socket state (netstat/ss) with commands that capture live packets (tcpdump), leading them to pick a command that only lists current connections rather than monitoring traffic in real-time.

How to eliminate wrong answers

Option A is wrong because `netstat -tulpn | grep :443` shows listening sockets and established connections, not live packet capture; it only displays current socket states from /proc/net/tcp, not real-time traffic. Option B is wrong because `ss -tulpn | grep :443` similarly lists socket statistics from kernel data, not packet-level capture; it cannot show individual packets or their contents. Option D is wrong because `iptables -L -n -v` lists firewall rules and their packet/byte counters, but it does not capture or display packet contents in real-time; it only shows accumulated statistics for rules.

Full explanation →

432

MCQeasy

A user reports that their cron jobs are not executing. The user has a valid crontab file and can execute the commands manually. Which of the following is the most likely cause of this issue?

A.The crontab file uses the wrong time format.

B.The user's home directory is missing.

C.The user is not in the /etc/cron.allow file.

D.The cron daemon is not running.

AnswerD

If cron is not running, no jobs will execute.

Why this answer

The cron daemon (crond) is responsible for reading crontab files and executing scheduled jobs at the appropriate times. If the cron daemon is not running, no cron jobs will execute, regardless of the validity of the user's crontab file or the user's ability to run the commands manually. This is the most likely cause because it directly prevents the cron system from functioning at all.

Exam trap

The trap here is that candidates often focus on user-level restrictions (like cron.allow or home directory issues) or syntax errors, but the most fundamental requirement—that the cron daemon itself must be running—is overlooked because it is assumed to always be active.

How to eliminate wrong answers

Option A is wrong because cron uses a specific time format (minute, hour, day of month, month, day of week), and if the format were incorrect, the crontab would typically be rejected when the user attempts to install it with `crontab -e` or `crontab <file>`, not silently fail to execute. Option B is wrong because the user's home directory is not required for cron job execution; cron jobs run with the user's environment, but the home directory is only relevant if the job script explicitly references it (e.g., via `$HOME`). Option C is wrong because the `/etc/cron.allow` file is used to restrict which users can create crontabs; if the user is not listed, they would be unable to install or edit their crontab file at all, but the question states the user already has a valid crontab file, implying they were previously allowed.

Full explanation →

433

MCQhard

A company runs a web server on Linux with two hard disks: /dev/sda (500GB) and /dev/sdb (500GB). The root filesystem is on /dev/sda1, and /var is on /dev/sda2. The administrator wants to add a new disk /dev/sdc (500GB) to be used as additional storage for /var/www/html. The new disk should be configured as an LVM physical volume and added to an existing volume group named 'vg_web'. The volume group currently has 200GB free space from /dev/sdb1. The administrator intends to extend the logical volume 'lv_web' mounted at /var/www/html by 300GB. Which of the following is the correct sequence of commands to achieve this without data loss?

A.pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend -L +300G /dev/vg_web/lv_web

B.pvcreate /dev/sdc; vgextend vg_web /dev/sdc; lvextend -L +300G /dev/vg_web/lv_web; resize2fs /dev/vg_web/lv_web

C.pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend --resizefs -L +300G /dev/vg_web/lv_web

D.pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend -L +300G /dev/vg_web/lv_web; resize2fs /dev/vg_web/lv_web

AnswerC, D

This sequence uses the `--resizefs` flag with `lvextend`, which automatically resizes the filesystem. This is a valid method in modern LVM2. Correct.

Why this answer

Both options C and D are correct for extending an ext4 filesystem. Option C uses the `--resizefs` flag with `lvextend`, which automatically resizes the filesystem after extending the logical volume. This flag is supported in modern LVM2 for ext4 and other filesystems.

Option D performs the resize explicitly with `resize2fs`. Both achieve the same result. Option A omits the filesystem resize, so the new space is not usable.

Option B uses the whole disk without a partition, which is not standard practice and may cause issues. Therefore, the correct sequence includes either the `--resizefs` flag or an explicit resize step.

Exam trap

The trap is that candidates might think only one method (explicit resize2fs) is correct, but modern LVM also supports the --resizefs flag. Both are valid.

How to eliminate wrong answers

Option A is wrong because it omits the necessary filesystem resize step (resize2fs) after extending the logical volume, which would leave the filesystem unaware of the new space, potentially causing data loss or inability to use the added capacity. Option B is wrong because it uses /dev/sdc (the whole disk) instead of a partition /dev/sdc1; while LVM can use a whole disk, the question specifies adding a new disk /dev/sdc and typical practice is to create a partition first, but more critically, option B includes resize2fs but the sequence is correct in that regard; however, the use of the whole disk without a partition is not the standard approach and could cause issues with partition table alignment or future disk management. Option C is wrong because it uses the --resizefs flag, which automatically resizes the filesystem, but the question expects a sequence without that flag and with an explicit resize2fs command; additionally, the --resizefs flag may not be available on older LVM versions, making option D more universally correct.

Full explanation →

434

Multi-Selectmedium

Which three actions can an administrator take to securely erase data on a disk before decommissioning?

Select 3 answers

A.Format the disk with mkfs.

B.Delete the partition and create a new one.

C.Run dd if=/dev/urandom of=/dev/sda.

D.Run shred -n 3 /dev/sda.

E.Use the hdparm command with the --security-erase option.

AnswersC, D, E

Overwrites the entire device with random data, making recovery extremely difficult.

Why this answer

Using `dd if=/dev/urandom of=/dev/sda` overwrites the entire disk with random data from the kernel's non-blocking random number generator. This makes the original data unrecoverable through forensic techniques, as each sector is overwritten with unpredictable values, effectively destroying any residual magnetic traces.

Exam trap

The trap here is that candidates often think `mkfs` or partition deletion fully erases data, when in fact they only remove logical pointers, leaving the raw data recoverable with simple forensic tools.

Full explanation →

435

MCQmedium

During boot, a server loads the wrong kernel. Which file should the administrator modify to change the default kernel in a standard GRUB 2 configuration?

A./boot/grub/grub.conf

B./etc/grub.d/

C./etc/default/grub

D./boot/grub/grub.cfg

AnswerC

Edit GRUB_DEFAULT in this file and run update-grub.

Why this answer

In a standard GRUB 2 configuration, the default kernel is selected by setting the GRUB_DEFAULT variable in /etc/default/grub. After modifying this file, the administrator must run update-grub (or grub-mkconfig) to regenerate the /boot/grub/grub.cfg file, which is the actual configuration read by the bootloader. This two-step process separates user-facing settings from the bootloader's runtime configuration.

Exam trap

The trap here is that candidates confuse the GRUB 2 configuration file (/etc/default/grub) with the GRUB Legacy file (/boot/grub/grub.conf) or the auto-generated runtime file (/boot/grub/grub.cfg), leading them to pick an option that either belongs to an older bootloader version or is not meant for direct editing.

How to eliminate wrong answers

Option A is wrong because /boot/grub/grub.conf is the configuration file for GRUB Legacy, not GRUB 2; GRUB 2 uses /boot/grub/grub.cfg. Option B is wrong because /etc/grub.d/ is a directory containing scripts that generate parts of the GRUB 2 configuration, but editing these scripts directly is not the standard way to change the default kernel; the correct approach is to set GRUB_DEFAULT in /etc/default/grub. Option D is wrong because /boot/grub/grub.cfg is the auto-generated runtime configuration file; manually editing it is discouraged as changes will be overwritten by update-grub, and the proper method is to modify /etc/default/grub and regenerate the file.

Full explanation →

436

MCQeasy

A junior system administrator is tasked with setting up a new Linux server that will act as a network time client. The server must synchronize its clock with the external NTP pool servers 0.pool.ntp.org, 1.pool.ntp.org, and 2.pool.ntp.org. The administrator installs the ntp package and edits /etc/ntp.conf to include the following lines: server 0.pool.ntp.org server 1.pool.ntp.org server 2.pool.ntp.org However, after restarting the ntpd service, the administrator notices that the system time does not appear to be synchronized. The command 'ntpq -p' returns no output. The administrator checks the status of the ntpd service with 'systemctl status ntp' and sees that the service is active (running). What is the most likely reason for the synchronization failure?

A.The NTP servers are unreachable due to a firewall blocking UDP port 123.

B.The ntpd daemon is configured to only adjust the clock gradually and refuses to make large time jumps by default.

C.The ntp.conf file is missing the 'pool' directive; instead, 'server' lines are used incorrectly.

D.The ntpd service is not enabled to start at boot, so it stopped after the administrator logged out.

AnswerB

ntpd will not step the time if the offset is too large; the -g flag or ntpdate command should be used initially.

Why this answer

The ntpd daemon, by default, refuses to make large time jumps (typically more than 128 ms) to prevent abrupt time changes. If the clock is significantly out of sync, ntpd will not adjust it, even if it eventually contacts the NTP servers. The empty output from 'ntpq -p' could indicate that no server associations have been formed yet, but the fundamental reason for the synchronization failure is ntpd's conservative stepping policy.

To synchronize the clock, the administrator should manually set the system time close to the correct time or use the 'ntpd -g' option to allow a one-time large step.

Exam trap

The trap here is that candidates assume a running service with configured servers should immediately synchronize, overlooking ntpd's default conservative behavior of refusing large time jumps, which is a common cause of apparent synchronization failure in exam scenarios.

How to eliminate wrong answers

Option A is wrong because if UDP port 123 were blocked by a firewall, the ntpd service would still be active and 'ntpq -p' would typically show the configured servers with a 'reach' value of 0, not return no output at all. Option C is wrong because the 'server' directive is perfectly valid for specifying NTP servers; the 'pool' directive is an alternative for a pool of servers but not required, and using 'server' lines does not cause synchronization to fail. Option D is wrong because the service is shown as 'active (running)' via systemctl, so it is currently running regardless of whether it is enabled at boot; the administrator's logout does not stop a running systemd service.

Full explanation →

437

MCQmedium

An administrator needs to mount an ISO image file /tmp/image.iso to the directory /mnt/iso. Which command should be used?

A.mount -o loop /tmp/image.iso /mnt/iso

B.mount -o ro /tmp/image.iso /mnt/iso

C.mount -t iso /tmp/image.iso /mnt/iso

D.mount /tmp/image.iso /mnt/iso

AnswerA

Correct: loop option needed for file.

Why this answer

The `-o loop` option tells the mount command to use a loop device, which is required to mount a file (like an ISO image) as if it were a block device. Without the loop option, mount expects a block device path, not a regular file.

Exam trap

The trap here is that candidates often forget the `-o loop` option and assume mount can directly handle a file path, or they confuse the read-only option (`-o ro`) with the loop option, thinking read-only is sufficient for ISO images.

How to eliminate wrong answers

Option B is wrong because `-o ro` only mounts the filesystem as read-only, but it does not enable loop device support, so mount will fail with an error like 'mount: /tmp/image.iso is not a block device'. Option C is wrong because `-t iso` is not a valid filesystem type; the correct type for ISO images is `iso9660` (or `udf`), and even with the correct type, the loop option is still required. Option D is wrong because without any options, mount expects a block device as the first argument, not a regular file, and will reject the ISO file.

Full explanation →

438

MCQeasy

Which command combination will display a sorted list of unique lines from a file?

A.cat file | uniq | sort

B.sort -u file

C.cat file | sort | uniq

D.Both A and C

AnswerC

Correct. By sorting first (`sort`), all duplicates become adjacent, then `uniq` removes them. This guarantees a sorted list of unique lines regardless of the file's initial order.

Why this answer

(cat file | sort | uniq) is the only combination that always produces a sorted list of unique lines. The `sort` command first sorts all lines, making duplicates adjacent, then `uniq` removes those adjacent duplicates, guaranteeing a sorted unique output. Option A (cat file | uniq | sort) may omit non-adjacent duplicates, so it only works if the file is already sorted or duplicates happen to be adjacent.

Option B (sort -u file) is a single command that also produces a sorted unique list, but the question specifically asks for a 'command combination' (i.e., a pipeline of multiple commands), so B is not a valid answer. Option D (Both A and C) is incorrect because A does not always work.

Exam trap

The trap is assuming that `uniq` removes all duplicates. In fact, `uniq` only removes adjacent duplicates. Sorting before `uniq` (option C) is necessary to guarantee complete deduplication.

Candidates may incorrectly think option A works in all cases, or that option D is correct.

How to eliminate wrong answers

Option A is wrong because `cat file | uniq | sort` only removes adjacent duplicates before sorting, so if the file is not already sorted, it will not remove all duplicates; the final sorted list may still contain duplicates. Option B is wrong because `sort -u file` is a single command that directly produces a sorted unique list, but the question asks for a 'command combination' (multiple commands piped together), and option B is a single command, not a combination. Option C is wrong because `cat file | sort | uniq` correctly sorts the file first, then removes all duplicates, producing a sorted unique list; however, the question's correct answer is D (both A and C), so C alone is not the complete answer.

Full explanation →

439

MCQeasy

An administrator is configuring a DHCP server to assign IP addresses to clients in the 192.168.10.0/24 subnet. The server should provide the default gateway as 192.168.10.1 and DNS server as 8.8.8.8. Which option in /etc/dhcp/dhcpd.conf defines the default gateway?

A.option subnet-mask 255.255.255.0;

B.option routers 192.168.10.1;

C.option broadcast-address 192.168.10.255;

D.option domain-name-servers 8.8.8.8;

AnswerB

routers is the DHCP option for default gateway.

Why this answer

The `option routers` directive in the ISC DHCP server configuration file `/etc/dhcp/dhcpd.conf` explicitly defines the default gateway (router) that clients should use. This directive sends the Router Option (option 3) in the DHCPOFFER and DHCPACK messages, instructing clients to set their default route to the specified IP address.

Exam trap

The trap here is that candidates may confuse the `option routers` directive with `option domain-name-servers` or `option subnet-mask`, especially since all three are commonly used together in a subnet declaration, but only `option routers` sets the default gateway.

How to eliminate wrong answers

Option A is wrong because `option subnet-mask 255.255.255.0;` defines the subnet mask (option 1) for the client, not the default gateway. Option C is wrong because `option broadcast-address 192.168.10.255;` sets the broadcast address (option 28) for the subnet, which is a separate parameter from the router. Option D is wrong because `option domain-name-servers 8.8.8.8;` specifies the DNS server (option 6) for name resolution, not the default gateway.

Full explanation →

440

MCQeasy

Which command is used to view the last few lines of a log file and simultaneously follow new entries as they are written?

A.tail -f

B.cat

C.head -n 10

D.less

AnswerA

Correctly displays last lines and follows new data.

Why this answer

The `tail -f` command is correct because it displays the last 10 lines of a file by default and then continues to monitor the file for new lines, outputting them as they are appended. This is essential for real-time log monitoring, as it uses inotify or polling to detect file changes without requiring manual re-reading.

Exam trap

The trap here is that candidates may confuse `tail -f` with `less` (which can also follow with `Shift+F`), but the question explicitly asks for the command that 'simultaneously follow new entries as they are written' in its default invocation, making `tail -f` the only correct answer without requiring additional key presses.

How to eliminate wrong answers

Option B (cat) is wrong because it outputs the entire file content at once and then exits, providing no ability to follow new entries. Option C (head -n 10) is wrong because it only shows the first 10 lines of a file and does not monitor for updates. Option D (less) is wrong because while it can view files interactively and with `Shift+F` can follow new entries, the default behavior does not follow; the question specifies 'simultaneously follow new entries as they are written,' which `tail -f` does directly without requiring a special key sequence.

Full explanation →

441

MCQeasy

Refer to the exhibit. This line is from /etc/passwd. What does the third field (1001) represent?

A.Home directory UID

B.Group ID (GID)

C.User ID (UID)

D.Login shell number

AnswerC

The third field in /etc/passwd is the numerical user ID.

Why this answer

In the /etc/passwd file, the third field is the User ID (UID), a numeric identifier assigned to each user. UID 0 is reserved for root, and values below 1000 are typically system accounts, while 1001 is a regular user UID. This field is used by the kernel to track user ownership of processes and files.

Exam trap

The trap here is that candidates often confuse the order of fields in /etc/passwd, specifically mixing up the UID (third field) with the GID (fourth field), because both are numeric identifiers.

How to eliminate wrong answers

Option A is wrong because the home directory is specified in the sixth field of /etc/passwd, not the third. Option B is wrong because the Group ID (GID) is the fourth field, not the third. Option D is wrong because the login shell is the seventh field, and there is no 'login shell number' field in /etc/passwd.

Full explanation →

442

Drag & Dropmedium

Arrange the steps to configure a firewall rule using iptables to allow SSH.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

iptables rules are added, then saved to a file, and persistence ensures they survive reboot.

Full explanation →

443

MCQhard

Refer to the exhibit. What is the purpose of the 'test -x /usr/sbin/anacron' command in the cron entries?

A.It checks if anacron is executable and then runs the periodic tasks.

B.It starts anacron if it is not already running.

C.It ensures the periodic tasks are not run if anacron is installed.

D.It logs the output of the periodic tasks to a file.

AnswerC

If anacron is installed, the test returns true, so the '||' branch (run-parts) is not executed, preventing cron from running tasks that anacron handles.

Why this answer

The 'test -x /usr/sbin/anacron' command checks if the anacron binary exists and is executable. If it is, the test returns true (exit code 0), and the subsequent periodic tasks (e.g., run-parts) are skipped due to the logical NOT operator '!' at the beginning of the cron entry. This prevents duplicate execution of periodic jobs when both cron and anacron are installed, as anacron is designed to handle them for systems that may not be running continuously.

Exam trap

The trap here is that candidates assume 'test -x' runs or starts anacron, when in fact it is a conditional check used with '!' to suppress duplicate job execution.

How to eliminate wrong answers

Option A is wrong because 'test -x' only checks for executability; it does not execute anacron or run any tasks. Option B is wrong because the command does not start anacron; it merely tests its presence, and the cron entry uses '!' to skip tasks if anacron is present, not to launch it. Option D is wrong because the command does not involve logging; it is a simple file test, and any logging would be handled by separate redirection or the cron daemon itself.

Full explanation →

444

MCQhard

During boot, a sysadmin sees the message 'Buffer I/O error on device sda1, logical block 0'. What does this most likely indicate?

A.Incorrect partition table

B.Filesystem corruption

C.Bad sector on the disk

D.Missing kernel module for the device

AnswerC

I/O error on a specific block suggests hardware failure.

Why this answer

The 'Buffer I/O error on device sda1, logical block 0' message indicates that the kernel's block layer failed to read or write the first logical block (LBA 0) of the partition. This is a classic symptom of a physical bad sector on the disk surface, as the storage medium itself cannot reliably store or retrieve data at that location. Filesystem corruption or partition table issues would typically produce different error messages, such as 'invalid superblock' or 'partition table invalid'.

Exam trap

The trap here is that candidates often confuse a low-level block I/O error with filesystem corruption (Option B), but the error originates from the disk hardware layer, not the filesystem layer, and the specific mention of 'logical block 0' points to a physical sector issue rather than a logical structure problem.

How to eliminate wrong answers

Option A is wrong because an incorrect partition table would typically cause errors like 'invalid partition table' or 'unable to read partition table', not a buffer I/O error on a specific logical block of an existing partition. Option B is wrong because filesystem corruption usually manifests as 'superblock read error', 'fsck errors', or 'mount: wrong fs type', not a raw block-level I/O failure at logical block 0. Option D is wrong because a missing kernel module would prevent the device from being detected entirely, resulting in 'device not found' or 'unknown device' errors, not a buffer I/O error on an already recognized partition.

Full explanation →

445

MCQeasy

An administrator needs to replace all occurrences of 'old_host' with 'new_host' in the file /etc/hosts. Which sed command should be used?

A.sed -n 's/old_host/new_host/gp' /etc/hosts

B.sed -i 's/old_host/new_host/' /etc/hosts

C.sed -i 's/old_host/new_host/g' /etc/hosts

D.sed 's/old_host/new_host/g' /etc/hosts

AnswerC

Edits /etc/hosts in-place, replacing all occurrences globally.

Why this answer

The `-i` flag enables in-place editing of the file, and the `g` flag (global) ensures all occurrences on each line are replaced, not just the first. The command `sed -i 's/old_host/new_host/g' /etc/hosts` modifies the file directly, replacing every instance of 'old_host' with 'new_host' throughout the file.

Exam trap

The trap here is that candidates often forget the `g` flag for global replacement or omit the `-i` flag for in-place editing, mistakenly thinking sed modifies files by default.

How to eliminate wrong answers

Option A is wrong because the `-n` flag suppresses automatic printing, and `p` prints only lines where a substitution occurred, but without `-i` the file is not modified, so no changes are saved. Option B is wrong because it omits the `g` flag, so only the first occurrence of 'old_host' on each line is replaced, leaving subsequent occurrences unchanged. Option D is wrong because without `-i`, sed writes the modified output to stdout and does not alter the original file /etc/hosts.

Full explanation →

446

Multi-Selectmedium

Which TWO statements about udev rules are correct? (Choose two.)

Select 2 answers

A.Custom udev rules should be placed in /etc/udev/rules.d/.

B.Udev rules are only applied at boot time.

C.Udev rules can be used to schedule periodic tasks via cron.

D.Rules can match on attributes such as vendor ID and product ID.

E.The 'udevadm verify' command tests rule syntax.

AnswersA, D

Sysadmin rules go in /etc/udev/rules.d/.

Why this answer

Custom udev rules are placed in /etc/udev/rules.d/ to override or supplement the default rules in /lib/udev/rules.d/. This directory is the standard location for system administrators to add persistent device naming or custom actions without modifying distribution-provided files.

Exam trap

The trap here is that candidates may confuse 'udevadm verify' with a real command, but the LPIC-1 exam tests knowledge of the actual udevadm subcommands, and 'verify' is not one of them.

Full explanation →

447

MCQmedium

Refer to the exhibit. What is the expected outcome of the kill command?

A.Only the parent process (PID 12345) is terminated.

B.Only child processes are restarted.

C.The parent process reloads its configuration, and child processes continue serving.

D.All httpd processes are terminated immediately.

AnswerC

SIGHUP tells Apache to reload configuration without stopping.

Why this answer

The kill command with SIGHUP (signal 1) sent to the parent httpd process (PID 12345) instructs the parent to reload its configuration files and gracefully restart its child worker processes. This is the standard behavior for Apache httpd and many other daemons: the parent process rereads configuration, spawns new children, and terminates old ones without dropping existing connections.

Exam trap

A common misconception is that SIGHUP always terminates a process, when in fact it is the standard signal for daemon configuration reloads and graceful restarts.

How to eliminate wrong answers

Option A is wrong because sending SIGHUP to the parent process does not terminate it; instead, it triggers a graceful reload. Option B is wrong because child processes are not restarted independently; they are replaced by new children after the parent reloads configuration. Option D is wrong because SIGHUP does not immediately terminate all httpd processes; that would require SIGTERM (signal 15) or SIGKILL (signal 9).

Full explanation →

448

MCQmedium

A system administrator notices that a server with a freshly installed Linux system fails to boot with the error 'No bootable device found'. The server has a single SATA hard disk connected to the motherboard's SATA controller. Which of the following is the most likely cause of this issue?

A.The root filesystem is formatted with an unsupported filesystem type.

B.The kernel module for the SATA controller is not included in the initramfs.

C.The GRUB bootloader configuration file is missing or corrupted.

D.The BIOS boot order is set to a device that does not contain a bootable operating system.

AnswerD

The BIOS attempts to boot from a device that lacks a bootloader, resulting in the error.

Why this answer

The error 'No bootable device found' occurs during the BIOS/UEFI POST phase, before any bootloader is loaded. This indicates that the system firmware cannot find a valid boot sector on any device in its boot order. Since the server has a single SATA hard disk, the most likely cause is that the BIOS boot order is set to a different device (e.g., a network boot or removable media) that does not contain a bootable operating system, or the hard disk itself is not listed first in the boot priority.

Exam trap

The trap here is that candidates often confuse a pre-boot firmware error with a bootloader or kernel issue, leading them to incorrectly select options related to GRUB configuration or initramfs modules, when the actual problem is a simple BIOS boot order misconfiguration.

How to eliminate wrong answers

Option A is wrong because an unsupported root filesystem type would cause a kernel panic or mount failure during the boot process, not a 'No bootable device found' error, which occurs before the kernel is loaded. Option B is wrong because a missing SATA controller kernel module in the initramfs would result in a kernel panic or inability to mount the root filesystem after the bootloader loads, not a pre-boot firmware error. Option C is wrong because a missing or corrupted GRUB configuration file would cause GRUB to drop to a rescue shell or display a GRUB-specific error, not a 'No bootable device found' message, which is issued by the BIOS/UEFI before any bootloader is executed.

Full explanation →

449

MCQhard

An administrator wants to combine two network interfaces into a single logical interface for redundancy and increased throughput. The system uses NetworkManager. Which method is currently recommended to achieve this?

A.Use ifenslave to enslave interfaces

B.Configure a bond using nmcli

C.Set up a team interface using teamd

D.Edit /proc/net/bonding directly

AnswerB

NetworkManager can manage bonded interfaces using nmcli, making it the recommended method.

Why this answer

NetworkManager is the default network service on modern Linux distributions, and its recommended tool for managing network bonds is `nmcli`. Using `nmcli`, an administrator can create a bond master interface and assign slave interfaces with the `nmcli connection add type bond` and `nmcli connection add type bond-slave` commands, which ensures proper integration with NetworkManager's configuration and state management. This method is preferred over legacy tools like `ifenslave` or `teamd` because it aligns with the current systemd and NetworkManager ecosystem.

Exam trap

The trap here is that candidates may confuse the older `ifenslave` or `teamd` tools with the modern NetworkManager approach, or mistakenly think that `/proc/net/bonding` is writable, when in fact `nmcli` is the correct, supported method for bond configuration on current systems.

How to eliminate wrong answers

Option A is wrong because `ifenslave` is a legacy tool for enslaving interfaces to a bond, but it does not integrate with NetworkManager; its use is deprecated in favor of NetworkManager-native methods. Option C is wrong because `teamd` implements the libteam teaming driver, which is a separate technology from bonding (IEEE 802.3ad/LACP) and is not the recommended method for bonding; teaming is a different approach that is less commonly used and not the default for redundancy/throughput bonding. Option D is wrong because `/proc/net/bonding` is a read-only pseudo-filesystem that reports bond status; it cannot be edited to create or configure bonds, and any changes must be made through proper configuration tools.

Full explanation →

450

Multi-Selecthard

Which THREE of the following are characteristics of UEFI firmware compared to legacy BIOS? (Select exactly 3.)

Select 3 answers

A.Supports booting from disks larger than 2 TB.

B.Provides a graphical user interface during firmware setup.

C.Supports Secure Boot to prevent unauthorized operating systems from loading.

D.Uses the Master Boot Record partition table.

E.Requires a boot loader stored in the Master Boot Record.

AnswersA, B, C

UEFI uses GPT which supports large disks.

Why this answer

UEFI firmware uses the GUID Partition Table (GPT) instead of MBR, which supports 64-bit logical block addressing (LBA). This allows addressing disks larger than 2 TB, as the MBR scheme is limited to 32-bit LBA and a maximum addressable size of approximately 2.2 TB. Therefore, option A is correct.

Exam trap

The trap here is that candidates often confuse UEFI's support for GPT with MBR, incorrectly assuming UEFI still uses MBR for partition tables or boot loaders, leading them to select D or E as correct.

Full explanation →

Linux Professional Institute Certification Level 1 LPIC-1 (LPIC-1) — Questions 376–450