Knowledge + Practice

Linux Professional Institute Certification Level 1 LPIC-1 (LPIC-1) — Questions 376–450

522 questions total · 7pages · All types, answers revealed

Take a mock exam Exam hub

Page 6 of 7

376

MCQeasy

Refer to the exhibit. How many physical disks are present in the system?

A.3

B.2

C.4

D.1

AnswerB

Correct: Two disks: sda and sdb.

Why this answer

The output shows two SCSI disks: /dev/sda and /dev/sdb. Each device file represents a physical disk, so there are exactly two physical disks present. The partitions (sda1, sda2, sdb1) are subdivisions of those disks and do not count as separate physical disks.

Exam trap

The trap here is that candidates often count partition entries (e.g., sda1, sda2, sdb1) as separate physical disks, leading them to overcount the actual number of drives.

How to eliminate wrong answers

Option A is wrong because it likely counts partitions (sda1, sda2, sdb1) as separate disks, but partitions are logical divisions, not physical disks. Option C is wrong because it may misinterpret the number of device files or include non-disk devices (e.g., /dev/sr0 for optical drive) as physical disks. Option D is wrong because it ignores the second disk /dev/sdb, possibly assuming all partitions belong to a single disk.

Full explanation →

377

MCQeasy

To enable disk quotas for user quotas on a filesystem, which line should be added to /etc/fstab's mount options?

A.grpquota

B.userquota

C.quota

D.usrquota

AnswerD

Adding 'usrquota' to the mount options in /etc/fstab enables user quotas on the filesystem.

Why this answer

Option D is correct because the 'usrquota' mount option is the standard Linux kernel parameter used to enable user disk quotas on a filesystem. When added to the fourth field of an /etc/fstab entry, it instructs the kernel to track per-user disk usage, allowing the quota system (via quotacheck, edquota, etc.) to enforce limits.

Exam trap

The trap here is that candidates confuse 'usrquota' with the generic term 'quota' or the incorrect 'userquota', assuming any word containing 'quota' will work, but the Linux kernel strictly requires the exact 'usrquota' string for user quotas.

How to eliminate wrong answers

Option A is wrong because 'grpquota' is the mount option for enabling group quotas, not user quotas. Option B is wrong because 'userquota' is not a valid Linux mount option; the correct syntax uses 'usrquota' for users and 'grpquota' for groups. Option C is wrong because 'quota' alone is not a valid mount option in /etc/fstab; the kernel requires the specific 'usrquota' or 'grpquota' strings to activate quota tracking.

Full explanation →

378

MCQeasy

A small office has a network printer with IP 192.168.1.100. The printer is shared via CUPS. A user reports that they cannot print a document from their workstation. The printer appears in the list of available printers, but when they try to print, the job hangs in the queue with status 'processing'. The administrator suspects the printer may be offline or the CUPS service is not running. Which command should the administrator run first to gather diagnostic information about the printer and its queue?

A.ping 192.168.1.100

B.lpstat -t

C.lpadmin -p printer -E

D.systemctl restart cups

AnswerB

lpstat -t shows printer status, queue, and error information for diagnosis.

Why this answer

lpstat -t provides a comprehensive overview of printer status, including whether the printer is accepting jobs, the queue state, and any error messages. Restarting cups could disrupt print jobs. Ping only tests network connectivity but not CUPS functionality.

Re-adding the printer is unnecessary without first diagnosing the issue.

Full explanation →

379

Multi-Selectmedium

Which TWO of the following are valid methods to specify a partition in /etc/fstab?

Select 2 answers

A.PARTUUID

B.UUID

C.LABEL

D.DEVPATH

E.ID

AnswersB, C

UUID (Universally Unique Identifier) is a standard way to identify partitions.

Why this answer

UUID and LABEL are both valid identifiers for partitions in /etc/fstab. UUID uses the filesystem's universally unique identifier, while LABEL uses a human-readable name assigned to the filesystem. Both are persistent across reboots and preferred over device names like /dev/sda1, which can change.

Exam trap

The trap here is that candidates may confuse PARTUUID (a partition table identifier) with UUID (a filesystem identifier), or assume any udev property like DEVPATH or ID is valid in fstab, when only UUID, LABEL, and device paths are supported.

Full explanation →

380

Multi-Selectmedium

Which TWO characteristics describe the difference between 'apt-get' and 'aptitude'? (Choose two.)

Select 2 answers

A.Aptitude offers a text-based interactive interface (TUI).

B.Aptitude provides a more sophisticated dependency resolution and can mark packages as automatically installed.

C.Apt-get uses a different package format than aptitude.

D.Apt-get can only be used from the command line, while aptitude only has a text-based interface.

E.Aptitude is an older tool and no longer maintained.

AnswersA, B

You can run aptitude without arguments to enter TUI.

Why this answer

Option A is correct because aptitude includes a text-based interactive interface (TUI) that allows users to browse, search, and manage packages in a menu-driven environment, whereas apt-get is strictly command-line only. This TUI provides features like visual dependency trees and interactive conflict resolution, making aptitude more user-friendly for interactive package management.

Exam trap

The trap here is that candidates often assume apt-get and aptitude are interchangeable or that aptitude is obsolete, but the exam tests the specific technical distinction that aptitude has a TUI and superior dependency resolution, while both use the same package format.

Full explanation →

381

Multi-Selecthard

Which THREE steps are necessary to configure a static IP address using ifcfg files on a RHEL-based system? (Choose THREE.)

Select 3 answers

A.Edit /etc/sysconfig/network-scripts/ifcfg-eth0

B.Set ONBOOT=yes

C.Run 'systemctl restart network'

D.Run 'ip addr add 192.168.1.10/24 dev eth0'

E.Set BOOTPROTO=static

AnswersA, B, E

Correct: the ifcfg file must be edited.

Why this answer

Option A is correct because on RHEL-based systems, persistent network interface configuration is stored in files named `/etc/sysconfig/network-scripts/ifcfg-<interface>`. Editing this file allows you to define static IP parameters that survive reboots. This is the standard method for configuring static IP addresses using ifcfg files.

Exam trap

The trap here is that candidates often confuse runtime commands (like `ip addr add`) with persistent configuration steps, or they mistakenly think restarting the network service is a configuration step rather than an activation step.

Full explanation →

382

MCQhard

A server in a corporate network uses systemd-resolved for DNS. Internal hostnames (e.g., server.example.lan) fail to resolve, but external names (e.g., google.com) work. The /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf. The administrator checks the systemd-resolved configuration and finds that the internal DNS server is listed globally, but the network interface has no specific DNS set. Which command should be used to assign the internal DNS server to the interface and fix resolution?

A.Add the internal hostnames to /etc/hosts.

B.Run 'resolvectl dns eth0 10.0.0.1' to set the DNS server for the interface.

C.Restart systemd-resolved service.

D.Edit /etc/resolv.conf and add the internal DNS server.

AnswerB

This sets the per-link DNS, allowing systemd-resolved to use the internal server for that interface.

Why this answer

The issue is that the per-link DNS configuration is missing. resolvectl dns sets the DNS server for a specific interface, overriding the global setting for that interface. Editing /etc/resolv.conf directly is ineffective as it is managed by systemd-resolved. Restarting the service does not set the missing per-link DNS.

Adding entries to /etc/hosts is a static workaround.

Full explanation →

383

Multi-Selecthard

Which three commands are commonly used to display information about running processes?

Select 3 answers

A.top

B.pkill

C.kill

D.htop

E.ps

AnswersA, D, E

Realtime process viewer.

Why this answer

The `top` command (option A) is a standard Linux utility that provides a real-time, dynamic view of running processes, including CPU and memory usage, and is commonly used for process monitoring. It is a core tool for displaying process information, making it correct for this question.

Exam trap

The trap here is that candidates may confuse commands that manipulate processes (like `kill` and `pkill`) with commands that display process information, leading them to incorrectly select those options.

Full explanation →

384

Drag & Dropmedium

Order the steps to mount an NFS share from a remote server.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

NFS mounting requires the client package, a local directory, and the mount command with server and export path.

Full explanation →

385

MCQeasy

A user submitted a print job to a CUPS printer but used the wrong options. Which command should the administrator use to cancel the job?

A.lpstat

B.cancel

C.lprm

D.lpadmin

AnswerB

The cancel command is part of CUPS and cancels print jobs.

Why this answer

Option B is correct because cancel is the standard CUPS command to remove print jobs. Option A (lprm) is from the legacy BSD printing system. Option C (lpstat) lists jobs, and Option D (lpadmin) configures printers.

Full explanation →

386

MCQhard

A developer wants to change the ownership of all files in a directory tree to the user 'www-data' and group 'www-data', but only files that are currently owned by user 'nobody'. Which command accomplishes this?

A.chown --from=nobody www-data:www-data /path

B.find /path -user nobody -exec chown www-data:www-data {} \;

C.chown -R --from=nobody www-data:www-data /path

D.chown -R www-data:www-data /path

AnswerC

Correctly uses recursive mode and the --from option to limit changes to files owned by nobody.

Why this answer

Option C is correct because the `chown -R --from=nobody www-data:www-data /path` command recursively changes ownership of files and directories only if they are currently owned by the user 'nobody'. The `--from` option specifies the current owner (and optionally group) to match before applying the change, and `-R` ensures recursion into subdirectories. This exactly meets the requirement to change ownership only for files owned by 'nobody'.

Exam trap

The trap here is that candidates often forget the `-R` flag for recursion or overlook the `--from` option, leading them to choose a brute-force approach like `chown -R` (option D) that changes all files regardless of current ownership, or a more complex `find`-based solution (option B) that works but is not the most direct command tested.

How to eliminate wrong answers

Option A is wrong because it lacks the `-R` flag, so it only changes ownership of the top-level directory `/path` itself, not files within the directory tree. Option B is wrong because while it uses `find` to locate files owned by 'nobody' and executes `chown`, it does not use the `--from` option and would change ownership of all files found, but the command is syntactically correct; however, it is less efficient and not the single command the question expects, and the question asks for 'which command accomplishes this' with the implication of a direct `chown` approach. Option D is wrong because it changes ownership of all files in the directory tree to 'www-data:www-data' regardless of the current owner, not only those owned by 'nobody'.

Full explanation →

387

MCQeasy

Which systemd target corresponds to the traditional runlevel 3?

A.multi-user.target

B.graphical.target

C.emergency.target

D.rescue.target

AnswerA

Multi-user.target is the standard text mode, equivalent to runlevel 3.

Why this answer

The correct option is C: multi-user.target corresponds to runlevel 3 (multi-user text mode). Option A (graphical.target) is runlevel 5. Option B (rescue.target) is runlevel 1.

Option D (emergency.target) is a more minimal state.

Full explanation →

388

MCQmedium

A system administrator wants to disable the graphical target and boot to the text mode multi-user.target permanently. Which command should they run?

A.systemctl enable multi-user.target

B.systemctl isolate multi-user.target

C.systemctl set-default multi-user.target

D.systemctl default multi-user.target

AnswerC

This sets the default target for future boots.

Why this answer

systemctl set-default multi-user.target changes the default target permanently, so the system will boot to multi-user mode (text) instead of graphical.target.

Full explanation →

389

MCQmedium

A Linux system fails to boot with the error: 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. What is the most likely cause?

A.Missing root filesystem

B.Corrupt kernel image

C.Damaged bootloader

D.Missing or incorrect initrd

AnswerD

Initrd contains drivers needed to mount root filesystem.

Why this answer

Correct: C. This error typically indicates that the initrd (initial ramdisk) is missing or does not contain the necessary drivers to mount the root filesystem. Option A (missing root filesystem) would produce a different error; B (corrupt kernel) would show earlier issues; D (damaged bootloader) would prevent kernel loading.

Full explanation →

390

Multi-Selectmedium

Which TWO commands can be used to sort the output of ps -ef by the resident set size (RSS) in descending order?

Select 2 answers

A.ps -ef | sort -k5,5 -rn

B.ps --sort=-rss

C.ps -ef | sort -k3 -rn

D.ps --sort=rss

E.ps -ef | sort -k5 -rn

AnswersB, E

--sort=-rss sorts by RSS descending.

Why this answer

Option B is correct because `ps --sort=-rss` directly sorts the process list by resident set size (RSS) in descending order, using the minus sign prefix to indicate reverse sort. This is a native `ps` feature that avoids piping to `sort`, which can be less reliable due to column alignment issues.

Exam trap

The trap here is that candidates often confuse the field number for RSS in `ps -ef` output (it is the 5th field, not the 3rd) and may overlook that `--sort=rss` defaults to ascending order, requiring a minus sign for descending.

Full explanation →

391

MCQhard

An administrator needs to display the current and previous runlevels of a Linux system. Which command provides this information?

A.who -r

B.runlevel

C.telinit 1

D.init 0

AnswerB

Outputs previous and current runlevel.

Why this answer

The `runlevel` command displays both the previous and current runlevels of a Linux system. It outputs two characters: the first indicates the previous runlevel (or 'N' if the runlevel has not changed since boot), and the second indicates the current runlevel. This is the standard tool for querying runlevel information on SysV init systems.

Exam trap

The trap here is that candidates confuse `who -r` with `runlevel` because both display the current runlevel, but `who -r` omits the previous runlevel, which is the key piece of information the question explicitly asks for.

How to eliminate wrong answers

Option A is wrong because `who -r` shows the current runlevel and the time of the last runlevel change, but it does not display the previous runlevel. Option C is wrong because `telinit 1` is used to change the runlevel to single-user mode (runlevel 1), not to display current or previous runlevels. Option D is wrong because `init 0` is used to shut down the system (runlevel 0), not to query runlevel information.

Full explanation →

392

MCQmedium

Refer to the exhibit. Based on the mount options shown, which filesystem is most likely to store filenames with mixed case and support long filenames?

A./dev/sdc1

B./dev/sda2

C./dev/sda1

D./dev/sdb1

E.tmpfs

AnswerA

vfat with shortname=mixed handles mixed case and long filenames.

Why this answer

The mount options shown for /dev/sdc1 include 'utf8' and 'codepage=437', which are characteristic of VFAT (or FAT32) filesystems. VFAT supports mixed-case filenames (though it is case-insensitive) and long filenames via the VFAT extension, which stores up to 255 UTF-16 characters. The other filesystems are either ext4 (which also supports mixed case and long names but does not use codepage/utf8 options) or tmpfs (which is RAM-based and not typically mounted with such options).

Exam trap

LPI often tests the misconception that ext4 filesystems require codepage or utf8 mount options for long filenames, when in fact those options are specific to FAT/VFAT filesystems that need explicit character set handling for backward compatibility with short 8.3 names.

How to eliminate wrong answers

Option B (/dev/sda2) is wrong because it is mounted as ext4 (type ext4) and does not use codepage or utf8 mount options; ext4 supports long filenames and mixed case natively but the given options are specific to FAT/VFAT. Option C (/dev/sda1) is wrong because it is mounted as ext4 (type ext4) and lacks the codepage/utf8 options that indicate a FAT-based filesystem. Option D (/dev/sdb1) is wrong because it is mounted as ext4 (type ext4) and does not have the codepage or utf8 mount options; ext4 handles filenames differently and does not require these options.

Option E (tmpfs) is wrong because tmpfs is a RAM-based filesystem that does not use codepage or utf8 mount options; it supports long filenames and mixed case but is not the filesystem most likely to store filenames with those specific mount options.

Full explanation →

393

Matchingmedium

Match each Linux directory to its standard purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

System configuration files

Variable data (logs, databases)

User-installed software and libraries

Temporary files (often cleared on reboot)

Virtual file system for process and kernel info

Why these pairings

Standard directories in the Filesystem Hierarchy Standard (FHS).

Full explanation →

394

MCQhard

A system has a software RAID1 array (/dev/md0) with two disks: /dev/sda and /dev/sdb. Disk /dev/sda fails. Which command sequence will replace the failed disk with a new /dev/sdc without stopping the array?

A.mdadm --stop /dev/md0; replace disk; mdadm --assemble /dev/md0 /dev/sdb /dev/sdc

B.mdadm --manage /dev/md0 --fail /dev/sda --remove /dev/sda && mdadm --manage /dev/md0 --add /dev/sdc

C.Shutdown system, physically replace disk, reboot

D.dd if=/dev/sdb of=/dev/sdc bs=64K

AnswerB

Correct sequence: fail, remove, then add new disk.

Why this answer

Correct: A. The mdadm commands '--fail' marks the disk as failed, '--remove' removes it, then '--add' adds the new disk. Option B stops the array which is unnecessary; C (dd) is not appropriate for live replacement; D requires reboot which is not ideal.

Full explanation →

395

Multi-Selectmedium

A system administrator needs to install a new kernel on a Debian-based system. Which TWO commands can be used to achieve this? (Choose TWO.)

Select 2 answers

A.apt-cache search linux-image-5.10.0-20-amd64

B.apt-get update

C.apt-get install linux-image-5.10.0-20-amd64

D.make install

E.dpkg -i linux-image-5.10.0-20-amd64.deb

AnswersC, E

apt-get install installs packages from repositories, including kernel images.

Why this answer

Option C is correct because `apt-get install` is the standard command for installing a specific kernel package from the configured repositories on Debian-based systems. The package name `linux-image-5.10.0-20-amd64` corresponds to a precompiled kernel image that APT will download and install, automatically handling dependencies and updating the bootloader configuration.

Exam trap

The trap here is that candidates confuse package management commands (like `apt-cache search` or `apt-get update`) with installation commands, or assume that `make install` is a valid method for installing a precompiled kernel package.

Full explanation →

396

MCQmedium

A system administrator needs to ensure that the httpd service starts automatically when the system enters the multi-user.target. Which command should be used?

A.systemctl add-wants multi-user.target httpd.service

B.systemctl enable httpd

C.systemctl start httpd

D.systemctl set-default multi-user.target

AnswerB

Enables the service to start automatically on boot for the current default target.

Why this answer

systemctl enable httpd creates symlinks so the service starts at boot when the target includes it. The default target for multi-user is typically multi-user.target.

Full explanation →

397

MCQmedium

Based on the /etc/fstab entry, which filesystem will be checked by fsck at boot time?

A.All filesystems except NFS

B./, /boot, and /mnt/data

C./, /boot, and swap

D./ and /boot only

AnswerD

Correct: pass numbers 1 and 2.

Why this answer

The /etc/fstab entry shows that only the root filesystem (/) and /boot have a non-zero value in the dump field (the fifth field). The fsck command at boot time checks filesystems with a dump value greater than 0, in the order specified by the pass number (the sixth field). Since /mnt/data and swap have a dump value of 0, they are skipped.

Exam trap

The trap here is that candidates often confuse the dump field with the pass field, assuming that a non-zero pass number alone triggers a check, but fsck actually requires both a non-zero dump field and a non-zero pass number to perform the check.

How to eliminate wrong answers

Option A is wrong because not all filesystems are checked; only those with a non-zero dump field are checked, and NFS filesystems are never checked by fsck regardless of the dump field. Option B is wrong because /mnt/data has a dump value of 0, so it is not checked by fsck at boot time. Option C is wrong because swap filesystems are never checked by fsck; they have a dump value of 0 and a pass number of 0, meaning they are skipped.

Full explanation →

398

MCQmedium

A sysadmin notices that after modifying iptables rules, the SSH service is unreachable from a specific subnet (192.168.1.0/24). Which command should be used to view the current rules with line numbers for easier identification?

A.iptables -L

B.iptables -L --line-numbers

C.iptables -t raw -L

D.iptables -t nat -L

AnswerB

Shows rules with line numbers for easier editing.

Why this answer

Option B is correct because iptables -L --line-numbers displays rules with line numbers, helpful for inserting or deleting rules. Option A is wrong because it shows rules but without line numbers. Option C is wrong because it shows the NAT table, not the filter table affecting SSH.

Option D is wrong because it shows raw table.

Full explanation →

399

Multi-Selecthard

Which THREE of the following directories are part of the FHS and must be present on a standard Linux system? (Choose three.)

Select 3 answers

A./var

B./etc

C./lost+found

D./bin

E./home

AnswersA, B, D

/var is required for variable data.

Why this answer

/var is required by the FHS to store variable data such as logs (/var/log), mail spools, and print queues. It must exist on a standard Linux system because many core services depend on it for runtime data that changes in size and content.

Exam trap

The trap here is that /lost+found appears essential because it is commonly seen on ext filesystems, but it is not part of the FHS mandatory list, and /home is often assumed required due to its ubiquity, yet the FHS does not mandate it for a standard Linux system.

Full explanation →

400

MCQeasy

An organization wants to implement a centralized logging solution for multiple Linux servers. Which service should run on the central server to receive syslog messages?

A.journald

B.syslogd

C.rsyslogd

D.syslog-ng

AnswerC

Standard syslog daemon used for receiving remote logs.

Why this answer

Option B is correct because the rsyslog daemon (rsyslogd) is the standard syslog server on modern Linux distributions. Option A is wrong because syslog-ng is not the default on most distributions. Option C is wrong because journald is the systemd log collector but not typically used as network syslog receiver by default.

Option D is wrong because syslogd is the legacy daemon, often replaced by rsyslog.

Full explanation →

401

MCQmedium

An administrator needs to mount a USB drive with the ext4 filesystem automatically at boot. The drive has a filesystem label 'DATA'. Which entry in /etc/fstab will mount it at /mnt/data with noatime and default mount options?

A./dev/sdb1 /mnt/data ext4 noatime,defaults 0 0

B.LABEL=DATA /mnt/data ext4 noatime,defaults 0 0

C.LABEL=DATA /mnt/data ext4 defaults 0 0

D.UUID=DATA /mnt/data ext4 noatime,defaults 0 0

AnswerB

Correct use of label and options.

Why this answer

Option B is correct because it uses the filesystem label 'DATA' to identify the USB drive, which is more reliable than a device name like /dev/sdb1 that can change between boots. The mount options 'noatime,defaults' are specified in the correct order, with 'defaults' providing standard mount options (rw, suid, dev, exec, auto, nouser, async) and 'noatime' disabling access time updates to reduce writes. The entry also includes the proper ext4 filesystem type and the mount point /mnt/data.

Exam trap

The trap here is that candidates often default to using /dev/sdX device names (option A) out of habit, forgetting that device names are dynamic and unreliable for persistent mounts, while also overlooking that 'defaults' must be explicitly included when other options like 'noatime' are specified.

How to eliminate wrong answers

Option A is wrong because it uses the device path /dev/sdb1, which is not guaranteed to be consistent across reboots (e.g., if another USB drive is plugged in, the device name may change), making it unsuitable for automatic boot mounting. Option C is wrong because it omits the 'noatime' mount option, which the question explicitly requires for the mount. Option D is wrong because 'UUID=DATA' is invalid syntax; UUIDs are hexadecimal strings (e.g., UUID=1234-5678), not arbitrary labels, and the correct identifier for a filesystem label is 'LABEL=DATA'.

Full explanation →

402

MCQmedium

A web server running on this host is not accessible from clients. Based on the exhibit, what is the most likely reason?

A.The FORWARD chain policy is DROP.

B.The OUTPUT chain policy is ACCEPT.

C.Incoming HTTP traffic is blocked by a DROP rule on port 80.

D.SSH traffic is blocked.

AnswerC

The rule explicitly drops TCP port 80.

Why this answer

Option A is correct. The INPUT chain has a DROP rule for TCP port 80, blocking incoming web traffic. Option B is wrong because port 22 (SSH) is allowed.

Option C is wrong because FORWARD policy is DROP but that affects forwarded traffic, not local input. Option D is wrong because OUTPUT policy is ACCEPT.

Full explanation →

403

MCQmedium

A system administrator notices that the server's clock is consistently off by several minutes. Which service should be used to synchronize the time with an external time source?

A.ntpd

B.timed

C.chronyd

D.systemd-timesyncd

AnswerA

ntpd is the standard NTP daemon for time synchronization.

Why this answer

The Network Time Protocol (NTP) daemon (ntpd) is the traditional and widely used service for synchronizing a server's clock with an external time source. It continuously adjusts the system time by communicating with NTP servers, compensating for clock drift and network delays to maintain accurate time. This makes ntpd the correct choice for resolving a consistent clock offset of several minutes.

Exam trap

The trap here is that candidates may confuse chronyd (a modern alternative) with ntpd, but LPIC-1 traditionally expects ntpd as the standard answer for time synchronization, even though chronyd is also correct in practice—the exam tests knowledge of the classic service name.

How to eliminate wrong answers

Option B (timed) is wrong because 'timed' is not a standard Linux time synchronization service; it is a legacy BSD tool for time synchronization and is not used in modern Linux distributions. Option C (chronyd) is wrong because although chronyd is a valid NTP client and server (part of the chrony suite) and can synchronize time, it is not the service named in the question's context—the question specifically asks for the service that should be used, and ntpd is the classic, expected answer for LPIC-1. Option D (systemd-timesyncd) is wrong because it is a lightweight SNTP client that only performs periodic time corrections and lacks the full NTP protocol capabilities (e.g., it cannot act as a time server or handle large clock offsets as effectively as ntpd), making it unsuitable for consistently correcting a several-minute offset.

Full explanation →

404

Multi-Selectmedium

Which TWO of the following are required for a bash script to be executed by the shell (assuming the script is in the current directory)?

Select 2 answers

A.The script must have a shebang (#!) as the first line.

B.The script must not contain any comments.

C.The script must have a .sh extension.

D.The script must be in the PATH environment variable.

E.The script must have execute permission.

AnswersA, E

Required to specify interpreter.

Why this answer

Option A is correct because the shebang (#!) as the first line of a bash script tells the kernel which interpreter to use (e.g., #!/bin/bash). Without it, the shell may attempt to execute the script using the default shell (often /bin/sh), which can lead to syntax errors or unexpected behavior. The shebang is essential for explicitly specifying the interpreter, especially when the script uses bash-specific features.

Exam trap

LPI often tests the misconception that a .sh extension is required for shell scripts, but Linux/Unix systems determine executability via the shebang and execute permission, not file extensions.

Full explanation →

405

Multi-Selecteasy

Which TWO of the following are valid methods to change the default runlevel on a SysV init-based system?

Select 2 answers

A.Use the 'runlevel' command to set the default runlevel.

B.Edit /etc/inittab to set the initdefault line.

C.Pass the desired runlevel as a kernel parameter at boot time.

D.Use 'systemctl set-default' to set the default runlevel.

E.Use the 'telinit' command to change the default runlevel.

AnswersB, C

The initdefault line in /etc/inittab defines the default runlevel.

Why this answer

In SysV init-based systems, the default runlevel is defined in the /etc/inittab file by the 'initdefault' line, which specifies the runlevel the system should enter after boot. Editing this line is the standard method to permanently change the default runlevel. Option B correctly identifies this mechanism.

Exam trap

The trap here is that candidates confuse the 'runlevel' command (which only displays) with a command that can set the default, or they mistakenly apply systemd commands like 'systemctl set-default' to SysV init systems.

Full explanation →

406

MCQeasy

Refer to the exhibit. What is the current state of the SSH service?

A.It is active and running

B.It is inactive

C.It is disabled

D.It has failed

AnswerA

Correct: clearly states 'active (running)'.

Why this answer

The exhibit shows the output of `systemctl status sshd`, which displays the service state as 'active (running)' in the green text. This indicates that the SSH daemon (sshd) is currently loaded and executing, providing secure shell access to the system. The 'active (running)' state is the normal operational state for a service that has been started and is functioning correctly.

Exam trap

LPI often tests the distinction between a service's current runtime state (active/inactive) and its boot-time enablement (enabled/disabled), causing candidates to confuse 'disabled' with 'inactive' when the question explicitly asks for the current state.

How to eliminate wrong answers

Option B is wrong because 'inactive' would show as 'inactive (dead)' in the systemctl status output, meaning the service is not currently running, but the exhibit clearly shows 'active (running)'. Option C is wrong because 'disabled' refers to the service's startup configuration (whether it starts automatically at boot), not its current runtime state; the exhibit shows the service is enabled for startup, but the question asks about the current state. Option D is wrong because 'failed' would display as 'failed' with a red indicator, indicating the service exited with an error or crashed, which is not shown in the exhibit.

Full explanation →

407

Matchingmedium

Match each ACL term to its meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Permissions for a specific user

Permissions for a specific group

Maximum permissions for named users and groups

Permissions for everyone else

Inherited ACL for new files/directories

Why these pairings

Access Control List (ACL) entries.

Full explanation →

408

MCQeasy

A user reports that they cannot connect to a remote server using SSH. The administrator checks the SSH server status and it is running. Which of the following is the most likely cause?

A.A firewall is blocking port 22.

B.The client's subnet mask is incorrect.

C.The client cannot resolve the server's hostname.

D.The SSH server is using UDP instead of TCP.

AnswerA

Firewall blocking SSH port is a common issue.

Why this answer

SSH operates over TCP port 22 by default. If the SSH server is running but the client cannot connect, a firewall blocking port 22 is the most likely cause because it would prevent the TCP handshake from completing, even though the SSH daemon (sshd) is active and listening.

Exam trap

The trap here is that candidates may assume a running SSH server guarantees connectivity, overlooking that a firewall can block the port even when the service is active, or they may confuse SSH's TCP usage with UDP-based protocols like DNS.

How to eliminate wrong answers

Option B is wrong because an incorrect subnet mask would prevent the client from reaching any host outside its local subnet, but the question specifies a remote server, so routing or gateway issues would be more relevant; a subnet mask error alone would not selectively block SSH while allowing other traffic. Option C is wrong because if the client cannot resolve the server's hostname, the user would likely receive a 'Name or service not known' error, not a connection failure to a running SSH server; the administrator could test with the server's IP address to isolate DNS issues. Option D is wrong because SSH uses TCP (Transmission Control Protocol) for reliable, connection-oriented communication, not UDP; UDP is used by protocols like DNS or DHCP, and SSH has no UDP mode.

Full explanation →

409

MCQhard

A sysadmin wants to prevent an APT package from being upgraded automatically but still allow it to be upgraded manually if needed. Which configuration method best achieves this?

A.Set the package version to a non-existent version in /etc/apt/preferences

B.Use 'apt-mark hold <package>'

C.Add the package to /etc/apt/preferences with Pin-Priority: 1000

D.Remove the package from sources.list

AnswerB

This marks the package as held, preventing automatic upgrades.

Why this answer

The `apt-mark hold <package>` command marks a package as held back, preventing it from being automatically upgraded during `apt upgrade` or `apt dist-upgrade`, while still allowing manual upgrades via `apt install <package>` or `apt-mark unhold`. This directly meets the requirement of blocking automatic upgrades but permitting manual intervention.

Exam trap

The trap here is that candidates confuse `apt-mark hold` with pinning in `/etc/apt/preferences`, assuming a high Pin-Priority (like 1000) prevents upgrades, when in fact it only sets preference order and does not block automatic upgrades.

How to eliminate wrong answers

Option A is wrong because setting a package version to a non-existent version in `/etc/apt/preferences` does not prevent upgrades; APT will simply ignore the invalid version and may still upgrade the package to the next available version. Option C is wrong because a Pin-Priority of 1000 in `/etc/apt/preferences` forces the package to be installed from a specific release, but it does not prevent automatic upgrades—it actually encourages them by making that version the preferred candidate. Option D is wrong because removing the package from `sources.list` would remove the repository entirely, preventing both automatic and manual upgrades of that package (and all other packages from that repository), which is too broad and does not target a single package.

Full explanation →

410

MCQeasy

Refer to the exhibit. The system administrator sees that /var/log is 93% full and the syslog file is nearly 2 GB. What is the most appropriate immediate action to free up disk space without losing any critical log data?

A.Run 'logrotate -f /etc/logrotate.conf' to force log rotation.

B.Increase the size of the /var/log partition using lvextend.

C.Delete /var/log/syslog and restart the syslog daemon.

D.Move /var/log/syslog to /tmp and create a symbolic link.

AnswerA

logrotate will compress and rotate the file, freeing space while keeping old logs.

Why this answer

Option A is correct because 'logrotate -f' forces an immediate rotation of all log files as defined in /etc/logrotate.conf, which compresses or archives the current syslog file (e.g., syslog becomes syslog.1) and creates a fresh empty log file. This frees disk space without deleting any data, as the rotated logs remain on disk until the configured retention policy removes them. It is the standard, safe immediate action for a nearly full /var/log partition.

Exam trap

LPI often tests the misconception that deleting or moving log files is acceptable, when in fact the correct immediate action is to use logrotate -f to safely rotate logs without data loss.

How to eliminate wrong answers

Option B is wrong because increasing the partition size with lvextend does not free up existing disk space; it only adds more capacity, which does not address the immediate 93% full condition and may not be possible without available free space in the volume group. Option C is wrong because deleting /var/log/syslog and restarting the syslog daemon permanently loses all current log data, which violates the requirement to not lose any critical log data. Option D is wrong because moving the syslog file to /tmp and creating a symbolic link does not free up space on /var/log (the file still occupies space elsewhere), and /tmp is often a tmpfs filesystem that may lose data on reboot, risking log loss.

Full explanation →

411

MCQmedium

An administrator needs to mount an ISO file located at /tmp/data.iso to /mnt/iso for read-only access. Which command should be used?

A.mount /tmp/data.iso /mnt/iso

B.mount -t iso9660 -o loop /tmp/data.iso /mnt/iso

C.mount -o loop,ro /tmp/data.iso /mnt/iso

D.mount -o ro,loop /mnt/iso /tmp/data.iso

AnswerC

Correctly uses loop device and read-only option.

Why this answer

Option C is correct because it uses the `-o loop,ro` options to mount the ISO file as a loop device with read-only access. The `loop` option is required to mount a file as a block device, and `ro` ensures the filesystem is mounted read-only, which is appropriate for an ISO image (typically an iso9660 filesystem).

Exam trap

The trap here is that candidates often forget the `loop` option when mounting a file, or they incorrectly specify the filesystem type with `-t iso9660` thinking it is required, while the kernel can auto-detect it, and they may also reverse the source and mount point arguments.

How to eliminate wrong answers

Option A is wrong because it does not specify the `loop` option, so the mount command will attempt to mount the file as a block device directly, which will fail since `/tmp/data.iso` is a regular file, not a block device. Option B is wrong because it explicitly specifies `-t iso9660`, which is unnecessary and may cause the mount to fail if the ISO uses a different filesystem (e.g., UDF) or if the kernel's iso9660 module is not loaded; the `-o loop` option alone is sufficient for the kernel to auto-detect the filesystem type. Option D is wrong because it swaps the source and target arguments: the source (the ISO file) must come first, and the mount point second; additionally, it places `/mnt/iso` as the source, which is incorrect.

Full explanation →

412

MCQmedium

To add a kernel parameter temporarily to the kernel command line at boot, what key should be pressed in the GRUB menu?

A.e

B.b

C.r

D.c

AnswerA

Press 'e' to edit the selected boot entry.

Why this answer

Option A is correct: pressing 'e' allows editing the current boot entry. Option C boots immediately, B opens GRUB shell, D is not a standard key.

Full explanation →

413

MCQeasy

Which command schedules a job to run once at 2:30 PM today?

A.crontab -e

B.batch

C.at 14.30

D.at 14:30

AnswerD

The 'at' command with a time in 24-hour format schedules a one-time job at that time.

Why this answer

The `at` command schedules a one-time job for a specified time. The correct syntax uses a colon (:) to separate hours and minutes, as in `at 14:30`, which schedules the job for 2:30 PM today. Option D is correct because it follows the standard `at` time format.

Exam trap

The trap here is that candidates may confuse the `at` time separator (colon) with the period used in some other contexts, or mistakenly think `crontab` can schedule one-time jobs, leading them to choose option A or C.

How to eliminate wrong answers

Option A is wrong because `crontab -e` edits the user's cron table for recurring jobs (e.g., daily, weekly), not for one-time execution. Option B is wrong because `batch` schedules jobs to run when system load levels permit, not at a specific time. Option C is wrong because `at 14.30` uses a period (.) instead of a colon (:), which is not a valid time separator for the `at` command; the correct syntax requires a colon.

Full explanation →

414

MCQhard

A dependency analysis shows that removing package 'libfoo' will also remove 'appA' and 'appB' because they depend on libfoo. The administrator wants to remove libfoo but keep appA and appB. What is the best approach?

A.Force removal of libfoo using `dpkg --force-depends`.

B.Recompile appA and appB without the dependency on libfoo.

C.Check if a compatible alternative package exists and install it, then remove libfoo.

D.Use `apt-get remove libfoo --no-dep`

AnswerC

Allows removal while preserving dependent applications.

Why this answer

The best approach is to find a compatible alternative package that provides the same functionality as libfoo and can satisfy the dependencies of appA and appB, then install it before removing libfoo. The other options are flawed: `--no-dep` option does not exist, recompiling both applications is time-consuming and risky, and force removal would break the dependent applications.

Full explanation →

415

Multi-Selecteasy

Which TWO of the following are Debian package management tools?

Select 2 answers

A.yum

B.dpkg

C.rpm

D.apt

E.zypper

AnswersB, D

dpkg is the low-level package manager for Debian-based systems.

Why this answer

B is correct because dpkg is the core low-level package manager for Debian-based systems, handling installation, removal, and querying of .deb packages directly. D is correct because apt (Advanced Package Tool) is the high-level package management tool that resolves dependencies and retrieves packages from repositories, built on top of dpkg.

Exam trap

The trap here is that candidates often confuse package managers by distribution family (e.g., thinking yum or rpm could be Debian tools because they are also 'package managers'), but LPIC-1 tests the specific association of dpkg and apt with Debian-based systems versus rpm-based tools like yum, rpm, and zypper.

Full explanation →

416

MCQeasy

A user reports that a file cannot be saved due to 'No space left on device'. Which command should the administrator use to verify disk usage?

A.du -sh /

B.fdisk -l

C.df -i

D.df -h

AnswerD

Correct: shows disk space usage.

Why this answer

The 'df -h' command displays disk space usage in human-readable format (e.g., GB, MB) for all mounted filesystems. When a user encounters 'No space left on device', the most direct verification is to check available disk space with 'df -h', which shows used and available blocks. Option D is correct because it specifically addresses the space shortage indicated by the error.

Exam trap

The trap here is that candidates may confuse 'df -h' (disk free, human-readable) with 'du -sh' (disk usage summary) or 'df -i' (inode usage), not recognizing that the error message directly points to block space exhaustion, which 'df -h' is designed to check.

How to eliminate wrong answers

Option A is wrong because 'du -sh /' summarizes disk usage of the root directory, not the available space on the filesystem; it can be slow and does not show free space. Option B is wrong because 'fdisk -l' lists partition tables and disk geometry, not filesystem-level usage or free space. Option C is wrong because 'df -i' shows inode usage, not block space; the error 'No space left on device' typically refers to block space exhaustion, though inode exhaustion can produce a similar message, but the question asks to verify disk usage, not inode usage.

Full explanation →

417

MCQhard

Based on the exhibit, the 'custom' repository shows 0 packages. What is the most likely cause?

A.The repository is disabled because 'enabled=1' is missing

B.The $releasever or $basearch variables are not expanding correctly, leading to an invalid URL

C.The GPG key is missing, causing yum to ignore the repository

D.The repository metadata is corrupt and needs to be regenerated

AnswerB

Variables may not be set or the repository doesn't exist for that release.

Why this answer

The 'custom' repository shows 0 packages because the $releasever or $basearch variables are not expanding correctly, resulting in an invalid or unreachable repository URL. Yum uses these variables to dynamically construct the baseurl, and if they are undefined or incorrect (e.g., due to a missing or misconfigured /etc/yum/vars/ directory or incorrect release version), the repository metadata cannot be downloaded, so yum reports 0 packages available.

Exam trap

The trap here is that candidates often assume 'enabled=1' is mandatory or that GPG key issues cause repositories to be ignored, but the real culprit is variable expansion failure, which silently yields an empty package list without error messages.

How to eliminate wrong answers

Option A is wrong because 'enabled=1' is not required; the default value for 'enabled' is 1 (enabled) if the directive is omitted, so missing it does not disable the repository. Option C is wrong because a missing GPG key would cause yum to warn or fail on package installation, not ignore the repository entirely or show 0 packages; yum still fetches metadata and lists packages even without a GPG key. Option D is wrong because corrupt repository metadata would typically cause a checksum error or a failure to parse the metadata, not a clean display of 0 packages; yum would report an error rather than silently showing zero packages.

Full explanation →

418

MCQeasy

A user downloaded a Debian package file named 'software.deb'. Which command should be used to install it?

A.rpm -ivh software.deb

B.apt install software.deb

C.apt-get install software.deb

D.dpkg -i software.deb

AnswerD

dpkg -i installs a .deb package locally.

Why this answer

The dpkg command with -i option installs a .deb package. apt-get and apt are package management tools that work with repositories, not local .deb files directly (though 'apt install ./software.deb' works in newer versions, dpkg is the standard low-level tool). rpm is for Red Hat packages.

Full explanation →

419

MCQhard

Refer to the exhibit. An administrator is trying to install Google Chrome but receives a GPG error. Which command should be run to add the repository's GPG key?

A.`wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -`

B.`gpg --import https://dl.google.com/linux/linux_signing_key.pub`

C.`apt-key adv --keyserver keyserver.ubuntu.com --recv-keys <keyid>`

D.`dpkg --add-key google`

AnswerA

Downloads and adds the key to apt's keyring.

Why this answer

The correct method is to download the signing key from the repository's official source and add it using `apt-key add`. `apt-key adv` requires knowing the key ID, which is not provided. `gpg --import` without apt-key does not integrate with apt. `dpkg --add-key` is not a valid command.

Full explanation →

420

MCQhard

A Debian system has a broken package that was partially installed. Which command will attempt to fix dependencies and configure all unpacked but not configured packages?

A.dpkg -i --force-depends

B.apt-get autoremove

C.apt-get clean

D.dpkg --configure -a

AnswerD

This configures all unpacked packages, fixing incomplete installations.

Why this answer

The command `dpkg --configure -a` is the correct choice because it configures all unpacked but not yet configured packages, and also attempts to fix dependency issues by re-running the configuration scripts. This is the standard way to recover from a partially installed package on Debian systems, as it ensures all packages in the 'unpacked' or 'half-configured' state are fully processed.

Exam trap

The trap here is that candidates confuse `dpkg --configure -a` with `apt-get install -f` (which fixes broken dependencies by installing missing packages), but the question specifically asks for configuring unpacked packages, not just fixing dependencies.

How to eliminate wrong answers

Option A is wrong because `dpkg -i --force-depends` forces installation of a package even if dependencies are unmet, which can break the system further and does not specifically target unpacked but not configured packages. Option B is wrong because `apt-get autoremove` removes packages that were automatically installed as dependencies and are no longer needed, not fixing partially installed packages. Option C is wrong because `apt-get clean` clears the local repository of retrieved package files (.deb) from the cache, which has no effect on package configuration or dependency resolution.

Full explanation →

421

MCQmedium

A developer is troubleshooting a shell script that uses the variable $HOME but it outputs nothing when the script runs. The script is executed with ./script.sh from an interactive shell. What is the most likely cause?

A.The script is run with sh instead of bash

B.The script is run with sudo

C.The HOME variable is not exported

D.The user has no home directory

AnswerC

Variables must be exported to be available in child processes; interactive shells export HOME, but scripts invoked with ./ may not inherit if the parent shell is non-interactive.

Why this answer

Option C is correct because the HOME variable is typically set by the login process and exported to the environment. If the script is run in a context where HOME is not exported (e.g., a non-interactive shell or a script that clears the environment), the variable will be empty. The script uses $HOME, which expands to nothing if HOME is unset or not exported, causing the output to be empty.

Exam trap

The trap here is that candidates may think the script's shell interpreter (sh vs bash) or sudo is the cause, but the real issue is that the HOME variable must be exported to be inherited by the script's environment.

How to eliminate wrong answers

Option A is wrong because running with sh instead of bash does not affect the HOME variable; HOME is a standard environment variable set by the system regardless of the shell. Option B is wrong because running with sudo does not clear HOME by default; sudo preserves the HOME variable unless explicitly configured with env_reset or the -H flag. Option D is wrong because if the user had no home directory, the HOME variable would still be set to the default (e.g., /) or the system would assign a fallback; the variable would not be empty.

Full explanation →

422

MCQeasy

A user reports that they cannot access the company's web server. The administrator confirms the server is running and network connectivity is fine. Which command should be used to verify that the HTTP service is listening on the correct port?

A.ping 127.0.0.1

B.netstat -rn

C.iperf3 -c localhost

D.ss -tlnp

AnswerD

Shows listening TCP sockets with port and process.

Why this answer

Option B is correct because ss -tlnp shows listening TCP sockets with port numbers and process names. Option A is wrong because it shows routing table. Option C is wrong because it tests connectivity, not listening sockets.

Option D is wrong because it shows network statistics, not listening ports.

Full explanation →

423

MCQeasy

A user frequently runs 'ls -la' and wants to create an alias 'll' for this command. Which command adds this alias persistently?

A.export ll='ls -la'

B.echo "alias ll='ls -la'" >> ~/.bashrc

C.alias ll='ls -la'

D.alias ll='ls -la' && echo "alias ll='ls -la'" >> ~/.bashrc

AnswerD

Creates the alias immediately and persists it to ~/.bashrc.

Why this answer

Option C is correct because it both creates the alias in the current session and appends it to ~/.bashrc so it persists across sessions. Option A only creates a temporary alias. Option B adds to the file but does not activate it immediately.

Option D exports a variable, not an alias.

Full explanation →

424

MCQmedium

A system administrator needs to see the boot messages recorded by systemd-journald from the current boot. Which command is most appropriate?

A.journalctl -b

B.dmesg

C.tail -n 50 /var/log/syslog

D.cat /var/log/messages

AnswerA

Correctly shows all log entries from the current boot, including boot-time messages.

Why this answer

journalctl -b filters the journal to show messages from the current boot. This includes boot messages recorded by systemd-journald.

Full explanation →

425

MCQmedium

Refer to the exhibit. During the next boot, which filesystem will be checked first by fsck?

A./dev/sda1

B.All checked in parallel

C./dev/sda2

D./dev/sda3

AnswerA

It has fsck order 1.

Why this answer

The order in which fsck checks filesystems during boot is determined by the pass number (field 6) in /etc/fstab. The filesystem with the lowest pass number is checked first. In the exhibit, /dev/sda1 has a pass number of 1, while /dev/sda2 and /dev/sda3 have pass numbers of 2, so /dev/sda1 will be checked first.

Exam trap

The trap here is that candidates often assume all filesystems are checked in parallel or that the order is based on device naming (e.g., sda1 before sda2), rather than understanding that the explicit pass number in /etc/fstab dictates the sequence.

How to eliminate wrong answers

Option B is wrong because filesystems are not all checked in parallel; fsck checks them sequentially based on their pass number, and only filesystems with the same pass number (and on different physical drives) may be checked in parallel. Option C is wrong because /dev/sda2 has a pass number of 2, which is higher than 1, so it will be checked after /dev/sda1. Option D is wrong because /dev/sda3 also has a pass number of 2, so it will be checked after /dev/sda1, not first.

Full explanation →

426

MCQhard

Refer to the exhibit. The job runs every hour but the administrator notices that it does not execute on Sundays. Which cron syntax element is responsible?

A.The minute field

B.The hour field

C.The month field

D.The day-of-week field

AnswerD

Correct: 1-6 excludes Sunday.

Why this answer

The day-of-week field (the 5th field in a cron expression) controls which days of the week the job runs. If this field is set to 1-6 (Monday–Saturday) or explicitly excludes 0/7 (Sunday), the job will not execute on Sundays. Since the job runs every hour but not on Sundays, the day-of-week field is responsible.

Exam trap

The trap here is that candidates often confuse the day-of-month field (3rd field) with the day-of-week field (5th field), or assume the hour field controls daily execution, when in fact the day-of-week field is the only one that can selectively exclude a specific weekday like Sunday.

How to eliminate wrong answers

Option A is wrong because the minute field (1st field) controls the minute within the hour when the job runs, not the day of the week; it would affect timing within each hour, not skip entire days. Option B is wrong because the hour field (2nd field) controls which hours of the day the job runs, not which days of the week; it could restrict execution to certain hours but cannot exclude an entire day like Sunday. Option C is wrong because the month field (4th field) controls which months the job runs, not days of the week; it could skip entire months but not specific weekdays.

Full explanation →

427

MCQeasy

A user reports that when they run 'ls -l' in their home directory, they see files but all files have permissions like '-rwxrwxrwx', which is unexpected. The system administrator checks and finds that the user's umask is set to 000. The user wants all new files to be created with default permissions of -rw-r--r-- (644) and directories that are drwxr-xr-x (755). What should the user set their umask to?

A.007

B.022

C.002

D.027

AnswerB

022 gives files 644 and directories 755.

Why this answer

The umask is a three-digit octal value that is subtracted from the default base permissions (666 for files, 777 for directories) to determine the default permissions for newly created files and directories. To achieve file permissions of 644 (rw-r--r--) and directory permissions of 755 (rwxr-xr-x), the umask must be 022. This is because 666 - 022 = 644 for files, and 777 - 022 = 755 for directories.

Exam trap

The trap here is that candidates often mistakenly think the umask is added to or directly specifies the permissions, rather than understanding it is subtracted from the default base permissions (666 for files, 777 for directories).

How to eliminate wrong answers

Option A (007) is wrong because it would result in file permissions of 660 (rw-rw----) and directory permissions of 770 (rwxrwx---), which are too restrictive for the desired 644/755. Option C (002) is wrong because it would yield file permissions of 664 (rw-rw-r--) and directory permissions of 775 (rwxrwxr-x), giving group write access, which is not the requested 644/755. Option D (027) is wrong because it would produce file permissions of 640 (rw-r-----) and directory permissions of 750 (rwxr-x---), which are too restrictive for both files and directories.

Full explanation →

428

MCQmedium

A system administrator wants to monitor network traffic on a specific port (TCP/443) entering the server. Which command will capture packets on interface eth0 and display them in real-time?

A.netstat -tulpn | grep :443

B.ss -tulpn | grep :443

C.tcpdump -i eth0 port 443

D.iptables -L -n -v

AnswerC

tcpdump captures packets on specified port.

Why this answer

Option C is correct: `tcpdump -i eth0 port 443` captures and displays packets on port 443. Option A (netstat -tulpn) shows listening ports. Option B (ss -tulpn) shows sockets.

Option D (iptables -L -n) lists firewall rules.

Full explanation →

429

MCQeasy

A user reports that their cron jobs are not executing. The user has a valid crontab file and can execute the commands manually. Which of the following is the most likely cause of this issue?

A.The crontab file uses the wrong time format.

B.The user's home directory is missing.

C.The user is not in the /etc/cron.allow file.

D.The cron daemon is not running.

AnswerD

If cron is not running, no jobs will execute.

Why this answer

The cron daemon (crond) is responsible for reading crontab files and executing scheduled jobs at the appropriate times. If the cron daemon is not running, no cron jobs will execute, regardless of the validity of the user's crontab file or the user's ability to run the commands manually. This is the most likely cause because it directly prevents the cron system from functioning at all.

Exam trap

The trap here is that candidates often focus on user-level restrictions (like cron.allow or home directory issues) or syntax errors, but the most fundamental requirement—that the cron daemon itself must be running—is overlooked because it is assumed to always be active.

How to eliminate wrong answers

Option A is wrong because cron uses a specific time format (minute, hour, day of month, month, day of week), and if the format were incorrect, the crontab would typically be rejected when the user attempts to install it with `crontab -e` or `crontab <file>`, not silently fail to execute. Option B is wrong because the user's home directory is not required for cron job execution; cron jobs run with the user's environment, but the home directory is only relevant if the job script explicitly references it (e.g., via `$HOME`). Option C is wrong because the `/etc/cron.allow` file is used to restrict which users can create crontabs; if the user is not listed, they would be unable to install or edit their crontab file at all, but the question states the user already has a valid crontab file, implying they were previously allowed.

Full explanation →

430

MCQhard

A company runs a web server on Linux with two hard disks: /dev/sda (500GB) and /dev/sdb (500GB). The root filesystem is on /dev/sda1, and /var is on /dev/sda2. The administrator wants to add a new disk /dev/sdc (500GB) to be used as additional storage for /var/www/html. The new disk should be configured as an LVM physical volume and added to an existing volume group named 'vg_web'. The volume group currently has 200GB free space from /dev/sdb1. The administrator intends to extend the logical volume 'lv_web' mounted at /var/www/html by 300GB. Which of the following is the correct sequence of commands to achieve this without data loss?

A.pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend -L +300G /dev/vg_web/lv_web

B.pvcreate /dev/sdc; vgextend vg_web /dev/sdc; lvextend -L +300G /dev/vg_web/lv_web; resize2fs /dev/vg_web/lv_web

C.pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend --resizefs -L +300G /dev/vg_web/lv_web

D.pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend -L +300G /dev/vg_web/lv_web; resize2fs /dev/vg_web/lv_web

AnswerD

Correct sequence: pvcreate, vgextend, lvextend, resize2fs.

Why this answer

Option D is correct because it follows the proper sequence: create a physical volume on the partition /dev/sdc1, extend the volume group vg_web with it, then extend the logical volume lv_web by 300GB, and finally resize the filesystem with resize2fs to utilize the new space. Since the logical volume is mounted and contains data, the filesystem must be resized after extending the LV to avoid data loss. The --resizefs flag in option C would also work, but the question asks for the correct sequence without that flag, and option D explicitly includes the separate resize2fs step.

Exam trap

The trap here is that candidates often forget the filesystem resize step (resize2fs) after extending the logical volume, assuming lvextend alone is sufficient, or they mistakenly think --resizefs is always available or the only correct method, when in fact the explicit resize2fs is the traditional and more portable approach.

How to eliminate wrong answers

Option A is wrong because it omits the necessary filesystem resize step (resize2fs) after extending the logical volume, which would leave the filesystem unaware of the new space, potentially causing data loss or inability to use the added capacity. Option B is wrong because it uses /dev/sdc (the whole disk) instead of a partition /dev/sdc1; while LVM can use a whole disk, the question specifies adding a new disk /dev/sdc and typical practice is to create a partition first, but more critically, option B includes resize2fs but the sequence is correct in that regard; however, the use of the whole disk without a partition is not the standard approach and could cause issues with partition table alignment or future disk management. Option C is wrong because it uses the --resizefs flag, which automatically resizes the filesystem, but the question expects a sequence without that flag and with an explicit resize2fs command; additionally, the --resizefs flag may not be available on older LVM versions, making option D more universally correct.

Full explanation →

431

Multi-Selectmedium

Which three actions can an administrator take to securely erase data on a disk before decommissioning?

Select 3 answers

A.Format the disk with mkfs.

B.Delete the partition and create a new one.

C.Run dd if=/dev/urandom of=/dev/sda.

D.Run shred -n 3 /dev/sda.

E.Use the hdparm command with the --security-erase option.

AnswersC, D, E

Overwrites the entire device with random data, making recovery extremely difficult.

Why this answer

Option C is correct because using `dd if=/dev/urandom of=/dev/sda` overwrites the entire disk with random data from the kernel's non-blocking random number generator. This makes the original data unrecoverable through forensic techniques, as each sector is overwritten with unpredictable values, effectively destroying any residual magnetic traces.

Exam trap

The trap here is that candidates often think `mkfs` or partition deletion fully erases data, when in fact they only remove logical pointers, leaving the raw data recoverable with simple forensic tools.

Full explanation →

432

MCQmedium

During boot, a server loads the wrong kernel. Which file should the administrator modify to change the default kernel in a standard GRUB 2 configuration?

A./boot/grub/grub.conf

B./etc/grub.d/

C./etc/default/grub

D./boot/grub/grub.cfg

AnswerC

Edit GRUB_DEFAULT in this file and run update-grub.

Why this answer

The file /etc/default/grub contains the GRUB_DEFAULT variable to set the default menu entry. /boot/grub/grub.cfg is generated automatically and should not be edited manually. /etc/grub.d/ contains scripts that generate the config. /boot/grub/grub.conf is for GRUB 1.

Full explanation →

433

MCQeasy

A junior system administrator is tasked with setting up a new Linux server that will act as a network time client. The server must synchronize its clock with the external NTP pool servers 0.pool.ntp.org, 1.pool.ntp.org, and 2.pool.ntp.org. The administrator installs the ntp package and edits /etc/ntp.conf to include the following lines: server 0.pool.ntp.org server 1.pool.ntp.org server 2.pool.ntp.org However, after restarting the ntpd service, the administrator notices that the system time does not appear to be synchronized. The command 'ntpq -p' returns no output. The administrator checks the status of the ntpd service with 'systemctl status ntp' and sees that the service is active (running). What is the most likely reason for the synchronization failure?

A.The NTP servers are unreachable due to a firewall blocking UDP port 123.

B.The ntpd daemon is configured to only adjust the clock gradually and refuses to make large time jumps by default.

C.The ntp.conf file is missing the 'pool' directive; instead, 'server' lines are used incorrectly.

D.The ntpd service is not enabled to start at boot, so it stopped after the administrator logged out.

AnswerB

ntpd will not step the time if the offset is too large; the -g flag or ntpdate command should be used initially.

Why this answer

B is correct because the ntpd daemon, by default, will not make large time jumps (more than a certain threshold, typically 128 ms) and instead gradually slews the clock. If the system clock is significantly out of sync (e.g., by minutes or hours), ntpd will refuse to step the time and may appear to do nothing, resulting in no output from 'ntpq -p' until the daemon has had time to adjust or until the offset is corrected manually. The administrator likely started ntpd with a large clock offset, and the daemon is waiting for the clock to drift naturally or for a manual intervention.

Exam trap

The trap here is that candidates assume a running service with configured servers should immediately synchronize, overlooking ntpd's default conservative behavior of refusing large time jumps, which is a common cause of apparent synchronization failure in exam scenarios.

How to eliminate wrong answers

Option A is wrong because if UDP port 123 were blocked by a firewall, the ntpd service would still be active and 'ntpq -p' would typically show the configured servers with a 'reach' value of 0, not return no output at all. Option C is wrong because the 'server' directive is perfectly valid for specifying NTP servers; the 'pool' directive is an alternative for a pool of servers but not required, and using 'server' lines does not cause synchronization to fail. Option D is wrong because the service is shown as 'active (running)' via systemctl, so it is currently running regardless of whether it is enabled at boot; the administrator's logout does not stop a running systemd service.

Full explanation →

434

MCQmedium

An administrator needs to mount an ISO image file /tmp/image.iso to the directory /mnt/iso. Which command should be used?

A.mount -o loop /tmp/image.iso /mnt/iso

B.mount -o ro /tmp/image.iso /mnt/iso

C.mount -t iso /tmp/image.iso /mnt/iso

D.mount /tmp/image.iso /mnt/iso

AnswerA

Correct: loop option needed for file.

Why this answer

Option A is correct because the `-o loop` option tells the mount command to use a loop device, which is required to mount a file (like an ISO image) as if it were a block device. Without the loop option, mount expects a block device path, not a regular file.

Exam trap

The trap here is that candidates often forget the `-o loop` option and assume mount can directly handle a file path, or they confuse the read-only option (`-o ro`) with the loop option, thinking read-only is sufficient for ISO images.

How to eliminate wrong answers

Option B is wrong because `-o ro` only mounts the filesystem as read-only, but it does not enable loop device support, so mount will fail with an error like 'mount: /tmp/image.iso is not a block device'. Option C is wrong because `-t iso` is not a valid filesystem type; the correct type for ISO images is `iso9660` (or `udf`), and even with the correct type, the loop option is still required. Option D is wrong because without any options, mount expects a block device as the first argument, not a regular file, and will reject the ISO file.

Full explanation →

435

MCQeasy

Which command combination will display a sorted list of unique lines from a file?

A.cat file | uniq | sort

B.sort -u file

C.cat file | sort | uniq

D.Both A and C

AnswerD

Both methods yield sorted unique lines.

Why this answer

Option D is correct because both A and C produce a sorted list of unique lines from a file. In option A, `cat file | uniq | sort` first removes adjacent duplicates with `uniq`, then sorts the remaining lines, which yields a sorted unique list only if the file was already sorted. In option C, `cat file | sort | uniq` sorts the file first, then removes all duplicate lines (adjacent after sorting), guaranteeing a sorted unique list.

Option B (`sort -u file`) also produces a sorted unique list, but it is not part of the combination asked for in the question.

Exam trap

The trap here is that candidates often assume `uniq` alone removes all duplicates, forgetting that it only works on adjacent lines, leading them to pick option A as correct without realizing the sorting order matters.

How to eliminate wrong answers

Option A is wrong because `cat file | uniq | sort` only removes adjacent duplicates before sorting, so if the file is not already sorted, it will not remove all duplicates; the final sorted list may still contain duplicates. Option B is wrong because `sort -u file` is a single command that directly produces a sorted unique list, but the question asks for a 'command combination' (multiple commands piped together), and option B is a single command, not a combination. Option C is wrong because `cat file | sort | uniq` correctly sorts the file first, then removes all duplicates, producing a sorted unique list; however, the question's correct answer is D (both A and C), so C alone is not the complete answer.

Full explanation →

436

MCQeasy

An administrator is configuring a DHCP server to assign IP addresses to clients in the 192.168.10.0/24 subnet. The server should provide the default gateway as 192.168.10.1 and DNS server as 8.8.8.8. Which option in /etc/dhcp/dhcpd.conf defines the default gateway?

A.option subnet-mask 255.255.255.0;

B.option routers 192.168.10.1;

C.option broadcast-address 192.168.10.255;

D.option domain-name-servers 8.8.8.8;

AnswerB

routers is the DHCP option for default gateway.

Why this answer

Option A is correct: `option routers` in dhcpd.conf sets the default gateway. Option B (option domain-name-servers) sets DNS. Option C (option subnet-mask) sets netmask.

Option D (option broadcast-address) sets broadcast.

Full explanation →

437

MCQeasy

Which command is used to view the last few lines of a log file and simultaneously follow new entries as they are written?

A.tail -f

B.cat

C.head -n 10

D.less

AnswerA

Correctly displays last lines and follows new data.

Why this answer

The `tail -f` command is correct because it displays the last 10 lines of a file by default and then continues to monitor the file for new lines, outputting them as they are appended. This is essential for real-time log monitoring, as it uses inotify or polling to detect file changes without requiring manual re-reading.

Exam trap

The trap here is that candidates may confuse `tail -f` with `less` (which can also follow with `Shift+F`), but the question explicitly asks for the command that 'simultaneously follow new entries as they are written' in its default invocation, making `tail -f` the only correct answer without requiring additional key presses.

How to eliminate wrong answers

Option B (cat) is wrong because it outputs the entire file content at once and then exits, providing no ability to follow new entries. Option C (head -n 10) is wrong because it only shows the first 10 lines of a file and does not monitor for updates. Option D (less) is wrong because while it can view files interactively and with `Shift+F` can follow new entries, the default behavior does not follow; the question specifies 'simultaneously follow new entries as they are written,' which `tail -f` does directly without requiring a special key sequence.

Full explanation →

438

MCQeasy

Refer to the exhibit. This line is from /etc/passwd. What does the third field (1001) represent?

A.Home directory UID

B.Group ID (GID)

C.User ID (UID)

D.Login shell number

AnswerC

The third field in /etc/passwd is the numerical user ID.

Why this answer

In the /etc/passwd file, the third field is the User ID (UID), a numeric identifier assigned to each user. UID 0 is reserved for root, and values below 1000 are typically system accounts, while 1001 is a regular user UID. This field is used by the kernel to track user ownership of processes and files.

Exam trap

The trap here is that candidates often confuse the order of fields in /etc/passwd, specifically mixing up the UID (third field) with the GID (fourth field), because both are numeric identifiers.

How to eliminate wrong answers

Option A is wrong because the home directory is specified in the sixth field of /etc/passwd, not the third. Option B is wrong because the Group ID (GID) is the fourth field, not the third. Option D is wrong because the login shell is the seventh field, and there is no 'login shell number' field in /etc/passwd.

Full explanation →

439

Drag & Dropmedium

Arrange the steps to configure a firewall rule using iptables to allow SSH.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

iptables rules are added, then saved to a file, and persistence ensures they survive reboot.

Full explanation →

440

MCQhard

Refer to the exhibit. What is the purpose of the 'test -x /usr/sbin/anacron' command in the cron entries?

A.It checks if anacron is executable and then runs the periodic tasks.

B.It starts anacron if it is not already running.

C.It ensures the periodic tasks are not run if anacron is installed.

D.It logs the output of the periodic tasks to a file.

AnswerC

If anacron is installed, the test returns true, so the '||' branch (run-parts) is not executed, preventing cron from running tasks that anacron handles.

Why this answer

The 'test -x /usr/sbin/anacron' command checks if the anacron binary exists and is executable. If it is, the test returns true (exit code 0), and the subsequent periodic tasks (e.g., run-parts) are skipped due to the logical NOT operator '!' at the beginning of the cron entry. This prevents duplicate execution of periodic jobs when both cron and anacron are installed, as anacron is designed to handle them for systems that may not be running continuously.

Exam trap

The trap here is that candidates assume 'test -x' runs or starts anacron, when in fact it is a conditional check used with '!' to suppress duplicate job execution.

How to eliminate wrong answers

Option A is wrong because 'test -x' only checks for executability; it does not execute anacron or run any tasks. Option B is wrong because the command does not start anacron; it merely tests its presence, and the cron entry uses '!' to skip tasks if anacron is present, not to launch it. Option D is wrong because the command does not involve logging; it is a simple file test, and any logging would be handled by separate redirection or the cron daemon itself.

Full explanation →

441

MCQhard

During boot, a sysadmin sees the message 'Buffer I/O error on device sda1, logical block 0'. What does this most likely indicate?

A.Incorrect partition table

B.Filesystem corruption

C.Bad sector on the disk

D.Missing kernel module for the device

AnswerC

I/O error on a specific block suggests hardware failure.

Why this answer

Correct: B. A buffer I/O error on a specific logical block typically indicates a physical disk problem, such as a bad sector. Option A (filesystem corruption) might show different errors; C (missing driver) would prevent detection; D (incorrect partition table) would show partition errors.

Full explanation →

442

MCQeasy

An administrator needs to replace all occurrences of 'old_host' with 'new_host' in the file /etc/hosts. Which sed command should be used?

A.sed -n 's/old_host/new_host/gp' /etc/hosts

B.sed -i 's/old_host/new_host/' /etc/hosts

C.sed -i 's/old_host/new_host/g' /etc/hosts

D.sed 's/old_host/new_host/g' /etc/hosts

AnswerC

Edits /etc/hosts in-place, replacing all occurrences globally.

Why this answer

Option D is correct because sed -i edits the file in-place with global substitution. Without -i, changes are only displayed on stdout. Without the g flag, only the first occurrence per line is replaced.

Full explanation →

443

Multi-Selectmedium

Which TWO statements about udev rules are correct? (Choose two.)

Select 2 answers

A.Custom udev rules should be placed in /etc/udev/rules.d/.

B.Udev rules are only applied at boot time.

C.Udev rules can be used to schedule periodic tasks via cron.

D.Rules can match on attributes such as vendor ID and product ID.

E.The 'udevadm verify' command tests rule syntax.

AnswersA, D

Sysadmin rules go in /etc/udev/rules.d/.

Why this answer

Option A is correct because custom udev rules are placed in /etc/udev/rules.d/ to override or supplement the default rules in /lib/udev/rules.d/. This directory is the standard location for system administrators to add persistent device naming or custom actions without modifying distribution-provided files.

Exam trap

The trap here is that candidates may confuse 'udevadm verify' with a real command, but the LPIC-1 exam tests knowledge of the actual udevadm subcommands, and 'verify' is not one of them.

Full explanation →

444

MCQmedium

A system administrator notices that a server with a freshly installed Linux system fails to boot with the error 'No bootable device found'. The server has a single SATA hard disk connected to the motherboard's SATA controller. Which of the following is the most likely cause of this issue?

A.The root filesystem is formatted with an unsupported filesystem type.

B.The kernel module for the SATA controller is not included in the initramfs.

C.The GRUB bootloader configuration file is missing or corrupted.

D.The BIOS boot order is set to a device that does not contain a bootable operating system.

AnswerD

The BIOS attempts to boot from a device that lacks a bootloader, resulting in the error.

Why this answer

The error 'No bootable device found' occurs during the BIOS/UEFI POST phase, before any bootloader is loaded. This indicates that the system firmware cannot find a valid boot sector on any device in its boot order. Since the server has a single SATA hard disk, the most likely cause is that the BIOS boot order is set to a different device (e.g., a network boot or removable media) that does not contain a bootable operating system, or the hard disk itself is not listed first in the boot priority.

Exam trap

The trap here is that candidates often confuse a pre-boot firmware error with a bootloader or kernel issue, leading them to incorrectly select options related to GRUB configuration or initramfs modules, when the actual problem is a simple BIOS boot order misconfiguration.

How to eliminate wrong answers

Option A is wrong because an unsupported root filesystem type would cause a kernel panic or mount failure during the boot process, not a 'No bootable device found' error, which occurs before the kernel is loaded. Option B is wrong because a missing SATA controller kernel module in the initramfs would result in a kernel panic or inability to mount the root filesystem after the bootloader loads, not a pre-boot firmware error. Option C is wrong because a missing or corrupted GRUB configuration file would cause GRUB to drop to a rescue shell or display a GRUB-specific error, not a 'No bootable device found' message, which is issued by the BIOS/UEFI before any bootloader is executed.

Full explanation →

445

MCQhard

An administrator wants to combine two network interfaces into a single logical interface for redundancy and increased throughput. The system uses NetworkManager. Which method is currently recommended to achieve this?

A.Use ifenslave to enslave interfaces

B.Configure a bond using nmcli

C.Set up a team interface using teamd

D.Edit /proc/net/bonding directly

AnswerB

NetworkManager can manage bonded interfaces using nmcli, making it the recommended method.

Why this answer

Option A is correct because NetworkManager supports bonding via nmcli commands. Option B is legacy bonding configuration, Option C uses the older teaming approach, and Option D depends on ifenslave which is outdated.

Full explanation →

446

Multi-Selecthard

Which THREE of the following are characteristics of UEFI firmware compared to legacy BIOS? (Select exactly 3.)

Select 3 answers

A.Supports booting from disks larger than 2 TB.

B.Provides a graphical user interface during firmware setup.

C.Supports Secure Boot to prevent unauthorized operating systems from loading.

D.Uses the Master Boot Record partition table.

E.Requires a boot loader stored in the Master Boot Record.

AnswersA, B, C

UEFI uses GPT which supports large disks.

Why this answer

UEFI firmware uses the GUID Partition Table (GPT) instead of MBR, which supports 64-bit logical block addressing (LBA). This allows addressing disks larger than 2 TB, as the MBR scheme is limited to 32-bit LBA and a maximum addressable size of approximately 2.2 TB. Therefore, option A is correct.

Exam trap

The trap here is that candidates often confuse UEFI's support for GPT with MBR, incorrectly assuming UEFI still uses MBR for partition tables or boot loaders, leading them to select D or E as correct.

Full explanation →

447

MCQeasy

Which of the following commands displays the amount of free disk space on all mounted filesystems in a human-readable format?

A.df -i

B.df -h

C.du -sh

D.df -T

AnswerB

Correct: human-readable disk free.

Why this answer

The `df -h` command displays disk space usage for all mounted filesystems with sizes in human-readable units (e.g., KB, MB, GB). The `-h` flag converts raw block counts into powers of 1024 with appropriate suffixes, making the output easy to interpret at a glance.

Exam trap

The trap here is that candidates often confuse `df -h` (free disk space) with `du -sh` (used space for a directory) or `df -i` (inode usage), because all three involve storage-related metrics but serve fundamentally different purposes.

How to eliminate wrong answers

Option A is wrong because `df -i` shows inode usage, not disk space; it reports the number of used and free inodes on each filesystem, which is a separate resource from data blocks. Option C is wrong because `du -sh` estimates the total disk space used by a specific directory or file (defaulting to the current directory), not free space across all mounted filesystems. Option D is wrong because `df -T` displays the filesystem type (e.g., ext4, xfs) in addition to disk usage, but does not enable human-readable formatting; it still outputs sizes in 1K blocks unless combined with `-h`.

Full explanation →

448

MCQmedium

An administrator notices that /var/log/syslog is 3 GB in size, despite logrotate being configured to rotate logs weekly and keep 4 weeks. The logrotate configuration file /etc/logrotate.d/syslog contains: /var/log/syslog { weekly rotate 4 compress missingok notifempty } The administrator checks that logrotate is scheduled via cron and sees that the cron job exists. However, the administrator suspects that logrotate might not have been running. Which of the following commands should the administrator run first to force log rotation and diagnose the issue?

A.logrotate -d /etc/logrotate.d/syslog

B.systemctl restart crond

C.logrotate -f /etc/logrotate.d/syslog

D.cat /var/lib/logrotate/status

AnswerC

Forces rotation immediately, which tests the configuration.

Why this answer

Option C is correct because the `-f` (force) flag tells logrotate to rotate the log file immediately, regardless of whether the configured time interval has elapsed. This allows the administrator to trigger a rotation on demand and observe any errors or misconfigurations that might explain why the file grew to 3 GB despite the weekly rotation policy.

Exam trap

LPI often tests the difference between `-d` (debug/dry-run) and `-f` (force) in logrotate, and the trap here is that candidates may choose debug mode thinking it will fix the issue, when only force actually triggers the rotation.

How to eliminate wrong answers

Option A is wrong because `logrotate -d` runs in debug mode, which only prints what would happen without actually performing the rotation; it does not force the rotation or help diagnose a failure to rotate. Option B is wrong because restarting the cron daemon (`crond`) does not force logrotate to run; it only restarts the scheduler, and if logrotate itself is misconfigured or the cron job is not triggering properly, this action does not address the root cause. Option D is wrong because `cat /var/lib/logrotate/status` displays the last rotation timestamps for each log file, which can be useful for investigation but does not force a rotation or actively diagnose why the rotation did not occur.

Full explanation →

449

Matchingmedium

Match each file system type to its typical description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Journaling file system, default on many Linux distros

High-performance 64-bit journaling file system

Copy-on-write file system with snapshots

Used for virtual memory paging

Compatible with Windows FAT32

Why these pairings

Common Linux file systems and their roles.

Full explanation →

450

MCQeasy

During the boot process, the system stops at a GRUB prompt. Which command should be typed to continue booting?

A.quit

B.start

C.exit

D.boot

AnswerD

'boot' boots the selected kernel image.

Why this answer

Correct: C. In GRUB, the 'boot' command is used to boot the selected kernel. Option A 'exit' exits the GRUB menu; B 'quit' is not a valid GRUB command; D 'start' is not a standard GRUB command.

Full explanation →

Page 6 of 7

All pages

Practice LPIC-1 by domain

Target a specific domain to shore up weak areas.

GNU and Unix Commands Devices, Filesystems and FHS Linux Installation and Package Management Essential System Services and Networking Administrative Tasks Shells, Scripting and Data Management System Architecture

See all domains with question counts →