Linux Professional Institute Certification Level 1 LPIC-1 (LPIC-1) — Questions 451–525

Why this answer

How to eliminate wrong answers

Option A is wrong because `df -i` shows inode usage, not disk space; it reports the number of used and free inodes on each filesystem, which is a separate resource from data blocks. Option C is wrong because `du -sh` estimates the total disk space used by a specific directory or file (defaulting to the current directory), not free space across all mounted filesystems. Option D is wrong because `df -T` displays the filesystem type (e.g., ext4, xfs) in addition to disk usage, but does not enable human-readable formatting; it still outputs sizes in 1K blocks unless combined with `-h`.

Why this answer

How to eliminate wrong answers

Option A is wrong because `logrotate -d` runs in debug mode, which only prints what would happen without actually performing the rotation; it does not force the rotation or help diagnose a failure to rotate. Option B is wrong because restarting the cron daemon (`crond`) does not force logrotate to run; it only restarts the scheduler, and if logrotate itself is misconfigured or the cron job is not triggering properly, this action does not address the root cause. Option D is wrong because `cat /var/lib/logrotate/status` displays the last rotation timestamps for each log file, which can be useful for investigation but does not force a rotation or actively diagnose why the rotation did not occur.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because 'quit' is not a valid GRUB command; it would be ignored or cause an error. Option B is wrong because 'start' is not a GRUB command; GRUB uses 'boot' to initiate the boot process. Option C is wrong because 'exit' is not a valid GRUB command; in GRUB, you use 'boot' to continue booting, not 'exit'.

Why this answer

How to eliminate wrong answers

Option A is wrong because changing Restart to 'always' would cause the database service to restart indefinitely even after successful runs, but it does not solve the underlying issue of the mount not being ready; the service would still fail on the first attempt if the mount is missing, and Restart=on-failure already handles restarts after failure, but the service never got a chance to restart because it was never started again after the initial failure. Option B is wrong because removing the nofail option from /etc/fstab would cause the system to fail to boot entirely if the filesystem cannot be mounted, which is worse than the current behavior; the nofail option is correctly used to allow boot to proceed, but the dependency must be expressed in systemd units. Option D is wrong because webapp.service already has 'After=database.service' and 'Requires=database.service' (implied by the requirement that the database service must be running), so adding them again does nothing; the problem is that database.service itself fails due to the mount, not that webapp.service lacks ordering or dependency on database.service.

Why this answer

How to eliminate wrong answers

Option A is wrong because `rpm -qa kernel-core` lists all installed packages matching the name 'kernel-core', but does not verify any signature. Option B is wrong because `rpm -q --changelog kernel-core` displays the changelog of the installed package, which is unrelated to signature verification. Option D is wrong because `rpm -V kernel-core` verifies the installed files' attributes (size, permissions, checksums) against the RPM database, but does not check the package's cryptographic signature.

Why this answer

How to eliminate wrong answers

Option B is wrong because an incomplete TCP handshake would show only SYN and SYN-ACK (or SYN and RST) without the final ACK, but the exhibit includes the ACK completing the handshake. Option C is wrong because FTP uses TCP ports 20 and 21, and the exhibit does not show any FTP-specific commands (e.g., USER, PASS, RETR) or port numbers; it only shows generic TCP segments. Option D is wrong because DNS uses UDP (or TCP for zone transfers) on port 53, and the exhibit shows TCP segments with no DNS query/response structure (e.g., transaction IDs, question/answer sections).

Why this answer

How to eliminate wrong answers

Option A is wrong because -f /dev/st0 specifies the output device (tape drive), not the backup level; it is optional and not required for a full backup. Option B is wrong because -u updates the /etc/dumpdates file with the backup timestamp, but does not control whether the backup is full or incremental. Option D is wrong because -1 specifies an incremental backup level 1, which only backs up files changed since the last lower-level dump (e.g., level 0), not a full backup.

Why this answer

How to eliminate wrong answers

Option A is wrong because `PermitRootLogin prohibit-password` does not restrict root to localhost; it only prohibits password authentication, not key-based authentication from any host. Option B is wrong because root can still log in using public key authentication, so a complete login ban is not in effect. Option D is wrong because `prohibit-password` explicitly disables password-based login for root, so root cannot log in with a password.

Why this answer

How to eliminate wrong answers

Option A is wrong because the loop iterates over words, not lines; $(cat file.txt) splits the output by whitespace (default IFS), so the number of iterations equals the number of words, not lines. Option C is wrong because the loop does not execute once; it executes multiple times, once for each word in the single line. Option D is wrong because the loop will execute; file.txt exists and contains data, so the command substitution produces a non-empty string, causing the loop to run.

Why this answer

How to eliminate wrong answers

Option A is wrong because NTP is standardized on UDP port 123; changing the port would break compatibility with NTP servers and is not a supported configuration in chrony. Option B is wrong because restarting chronyd would not fix the underlying firewall block; the service would still be unable to reach NTP sources. Option D is wrong because ntpdate is a deprecated one-shot synchronization tool that does not address the persistent drift; it also relies on the same UDP 123 port and would fail if the firewall blocks it, and it does not provide ongoing correction.

Why this answer

How to eliminate wrong answers

Option A is wrong because shared object files require read permission, not execute permission, for the dynamic linker to load them; execute permission is irrelevant for libraries. Option B is wrong because setuid binaries do ignore LD_LIBRARY_PATH for security reasons, but the proper solution is to add the path to /etc/ld.so.conf and run ldconfig, not to rely on LD_LIBRARY_PATH which is insecure and not persistent. Option D is wrong because a library compiled for a different architecture would cause a different error (e.g., 'wrong ELF class' or 'cannot load shared object file: No such file or directory' due to ABI mismatch), not a simple 'cannot open' error when the file exists and is readable.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because changing the URI from ipp:// to socket:// would bypass CUPS' job management and authentication, but the error is about authorization, not protocol mismatch; the printer is reachable via ping, so the URI is not the issue. Option B is wrong because the lpadmin group is for printer administration (e.g., adding/removing printers), not for granting print access to users; the error is a client authorization failure, not a group membership issue. Option C is wrong because restarting cupsd would not change the access control rules; the service is already running and the error persists, indicating a configuration problem, not a service state issue.

Why this answer

How to eliminate wrong answers

Option A is wrong because cron jobs inherit a minimal PATH from the cron daemon, but the PATH variable is not required for a script to run; the script can use absolute paths or set its own PATH. Option B is wrong because cron jobs run as the user who owns the crontab, and the script's ownership does not prevent execution as long as the user has execute permission. Option D is wrong because a shebang line is not strictly required for a script to run; if missing, the script will be executed with the default shell (usually /bin/sh), but the script can still run if it is executable and contains valid shell commands.

Why this answer

How to eliminate wrong answers

Option B is wrong because `grub-mkconfig -o /boot/grub/grub.cfg` only regenerates the GRUB configuration file; it does not install the bootloader to the disk or ESP, so it cannot fix a corrupted bootloader. Option C is wrong because `grub2-install /dev/sda` (without a target) defaults to legacy BIOS mode, which writes to the Master Boot Record (MBR) and is incompatible with UEFI firmware and GPT partitioning. Option D is wrong because `grub-install /dev/sda` (without `--target=x86_64-efi`) also defaults to BIOS/legacy mode, failing to install the correct EFI binary to the ESP for UEFI boot.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'lvresize -L 50G' sets the absolute size to 50GB, which would shrink the volume from its current size (likely 100GB) to 50GB, causing data loss; also, xfs_growfs is only for XFS filesystems, not ext4. Option B is wrong because creating a new logical volume (lv_backup) does not increase the size of lv_db; it only adds a separate volume, leaving the database volume still at 95% capacity. Option D is wrong because 'vgextend' is unnecessary—the volume group already has 350GB free space—and 'lvextend -L 50G' without the '+' sign would set the absolute size to 50GB, potentially shrinking the volume.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `optional` means the module's success or failure is ignored unless it is the only module in the stack, which would not enforce the password history requirement. Option B is wrong because `sufficient` means if this module succeeds, PAM skips remaining modules in the stack, which could bypass other password quality checks. Option D is wrong because `requisite` causes immediate failure if the module fails, but it is typically used for critical checks like account expiration, not for password history; `required` is the correct control for enforcing history without aborting the entire stack prematurely.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `grep -r` recursively searches file contents but does not filter by modification time; `-mtime 0` is not a valid `grep` option (it belongs to `find`), so the command would fail or behave unexpectedly. Option C is wrong because `-mmin 1440` correctly finds files modified in the last 1440 minutes (24 hours), but `-exec grep 'error' {}` lacks the `-l` flag, causing it to print matching lines instead of filenames, and it does not use `+` or `;` correctly (missing `\;` or `+`), which may lead to syntax errors or unintended behavior. Option D is wrong because `ls -l /var/log | grep error` only lists filenames in `/var/log` that contain 'error' in their name (or metadata line), not files whose content contains the word 'error', and it ignores modification time filtering entirely.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because /etc/chrony.conf is the configuration file for chrony, a different NTP implementation, not for systemd-timesyncd. Option C is wrong because /etc/ntp.conf is the configuration file for the traditional ntpd service, not for systemd-timesyncd. Option D is wrong because /etc/ntp/ntp.conf is an alternative path for ntpd configuration (often used on some distributions like FreeBSD), but it is not used by systemd-timesyncd.

Why this answer

How to eliminate wrong answers

Option A is wrong because it claims 3 controllers are detected, but the exhibit only lists two distinct SATA controllers. Option C is wrong because it states the SSD is at 3.0 Gbps, but the exhibit explicitly shows '6 Gbps' for the SSD. Option D is wrong because it says only 1 controller is detected, while the exhibit clearly shows two separate SATA controller entries.

Why this answer

How to eliminate wrong answers

Option A is wrong because the `-o loop` option is used for mounting a file as a loop device (e.g., an ISO image), not a block device like `/dev/sda2`. Option B is wrong because `mount -a` mounts all filesystems listed in `/etc/fstab`, not a specific partition to a custom mount point. Option C is wrong because it specifies the mount point as `/mnt` instead of `/mnt/sysroot`, which does not match the required target directory.

Why this answer

How to eliminate wrong answers

Option A is wrong because `apt-get hold package` is not a valid command; `apt-get` does not have a `hold` subcommand—this is a common confusion with `apt-mark`. Option C is wrong because `dpkg --hold package` is not a valid dpkg option; dpkg uses `--set-selections` to manage hold states, not a direct `--hold` flag. Option D is wrong because the syntax `echo 'package hold' | dpkg --set-selections` is incorrect; the correct format for `dpkg --set-selections` is `package hold` (with the word 'hold' as the second field), but the command shown uses a pipe and the echo string is malformed (it should be `echo 'package hold'` without quotes around the whole string in practice, though the core issue is that the option is not the standard method—`apt-mark hold` is the preferred tool for this task).

Why this answer

How to eliminate wrong answers

Option A is wrong because /dev/sda3 is a logical drive within the extended partition, but its system ID is 83 (Linux native), not 8e (LVM), so it cannot be used directly as an LVM physical volume without changing its type. Option C is wrong because a new partition is not necessary; /dev/sda2 already exists with the correct LVM system ID and can be used. Option D is wrong because /dev/sda1 has system ID 83 (Linux native) and is typically used for /boot, not for LVM, and lacks the 8e flag.

Why this answer

How to eliminate wrong answers

Option A is wrong because changing ownership of /usr/local/bin would require root privileges, and the user only changed ownership of a file in their home directory, not a system directory. Option B is wrong because the script has permissions 755 and is owned by root:root, but it does not require root privileges to run; any user can execute it, and it was working yesterday without root. Option C is wrong because the script is located in /usr/local/bin and owned by root:root; the user cannot change ownership of that script without root privileges, and they only changed ownership of a file in their home directory.

Why this answer

How to eliminate wrong answers

Option A is wrong because `yum deplist` shows dependencies for a package but uses the YUM repository metadata, not the RPM package file itself, and may not reveal the exact missing library if the repository is incomplete or the package is local. Option B is wrong because `rpm -qlp` lists the files that would be installed by the package, not the dependencies it requires. Option C is wrong because `rpm -qa` lists all installed packages, which is irrelevant for diagnosing a missing dependency from a new package.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the package were updated to a newer version that no longer includes this file, the file would be removed during the update and rpm -V would not report it as missing (the RPM database would reflect the new package contents). Option B is wrong because a modified file would show a '5' (MD5 checksum change) or other attribute change in the output, not a 'missing' indicator. Option C is wrong because an incomplete installation would likely cause multiple missing files or other verification errors, and the RPM database would not have recorded the file as part of the package if it were never installed.

Why this answer

How to eliminate wrong answers

Option A is wrong because `mount -a` mounts all filesystems listed in /etc/fstab, not a specific device; it ignores the `/dev/sdc1 /mnt/usb` arguments. Option B is wrong because it reverses the positional arguments, placing the mountpoint before the device, which will cause mount to interpret `/mnt/usb` as the device and fail. Option D is technically valid but not the minimal correct answer; the question asks 'which command should be used' and the `-t ext4` flag is unnecessary since the kernel can auto-detect ext4, making C the simpler and more standard choice.

Why this answer

How to eliminate wrong answers

Why this answer

Why this answer

How to eliminate wrong answers

Option B (SHA-256) is wrong because SHA-256 uses the prefix '$5$', not '$6$'. Option C (MD5) is wrong because MD5 uses the prefix '$1$', and it is considered cryptographically broken for password storage. Option D (Blowfish) is wrong because Blowfish-based bcrypt uses the prefix '$2a$', '$2b$', or '$2y$', not '$6$'.

Why this answer

How to eliminate wrong answers

Option A is wrong because `rpm -K` checks the GPG signature and digest of an RPM package file (not installed packages) to verify its authenticity and integrity before installation, not to detect post-installation modifications. Option B is wrong because `rpm --verify` is a valid syntax but is incomplete; it requires a package name or `-a` to act on all packages, so without `-a` it does not verify all installed packages. Option C is wrong because `rpm -V all` is invalid syntax; `-V` expects a package name or the `-a` flag, and `all` is not a recognized argument, causing an error.

Why this answer

How to eliminate wrong answers

Option A is wrong because GNU grep and BSD grep both support the -E flag for extended regex, so the old system using GNU grep and the new system using BSD grep would not cause a discrepancy in pattern matching with -E. Option B is wrong because the -E flag explicitly tells grep to interpret the pattern as extended regex, so both systems would treat it the same; the issue is not about basic vs. extended regex interpretation but about whether the -E flag is supported at all. Option C is wrong because locale settings affect character classes and collation, not the fundamental interpretation of the alternation metacharacter '|' in extended regex; the shell's locale would not cause the pattern to fail matching entirely.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because /var is intended for variable data files such as logs, spools, and temporary files, not for executable scripts. Option B is wrong because /opt is reserved for add-on application software packages, typically installed in their own subdirectory tree, not for individual scripts meant to be directly executable from the PATH. Option D is wrong because /home contains user home directories and is not part of the default system PATH; scripts placed there would not be accessible to all users without explicit path configuration.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because it uses the 'noauto' mount option, which prevents the filesystem from being mounted automatically at boot, contradicting the requirement for persistent mounting. Option C is wrong because it uses LABEL=data instead of UUID=abc-123; while LABEL can be used for persistent mounting, the question explicitly specifies mounting by UUID. Option D is wrong because it uses the device path /dev/sda4, which is not persistent and can change across reboots (e.g., if disks are added or removed), failing the requirement to mount by UUID.

Why this answer

How to eliminate wrong answers

Option A is wrong because `systemctl restart sshd` stops and then starts the service, which drops all existing SSH connections. Option C is wrong because `systemctl refresh sshd` is not a valid systemctl command; systemctl does not have a 'refresh' action. Option D is wrong because it is identical to option A and also drops existing connections by restarting the service.

Why this answer

How to eliminate wrong answers

Option A is wrong because `dd` clones the raw block device including the ext4 filesystem metadata, so the target `/dev/sdb1` would remain an ext4 partition, not XFS; it also requires an identical or larger disk and does not convert the filesystem. Option C is wrong because `tune2fs` is an ext2/ext3/ext4 utility and cannot change a filesystem to XFS; the `-O xfs` flag does not exist, and attempting this would corrupt the filesystem. Option D is wrong because using an NFS share introduces network dependency and potential permission/ownership issues, and the procedure of unmounting and reformatting the original partition would cause significant downtime and data loss if the rsync copy is incomplete.

Why this answer

How to eliminate wrong answers

Option A is wrong because restarting the SSH service would not change the behavior; SSH does not cache account lock status, and the lock is already applied in /etc/shadow. Option B is wrong because SSH does not have a configuration option to allow passwordless login specifically for locked accounts; the lock only affects password authentication, not key-based authentication. Option D is wrong because SSH does check account lock status for password authentication, but for key-based authentication it only verifies the key against authorized_keys and does not check the shadow lock flag.

Why this answer

How to eliminate wrong answers

Option B is wrong because `tune2fs` modifies parameters on an existing ext2/3/4 filesystem, but the question asks to create a new filesystem; `tune2fs` cannot create a filesystem. Option C is wrong because `mke2fs -r 2` sets the filesystem revision level (e.g., revision 1 or 2), not the reserved block percentage; the correct flag for reserved blocks is `-m`. Option D is wrong because `mkfs.ext4 -R 2` is invalid; `-R` is not a recognized option in `mkfs.ext4` (the correct flag is `-m`), and this would likely produce an error or be ignored.

Why this answer

How to eliminate wrong answers

Option A is wrong because `-n` causes fsck to perform a non-interactive, read-only check without making any repairs, which does not allow the administrator to interactively decide on fixes. Option B is wrong because `-y` automatically answers 'yes' to all repair prompts, bypassing the interactive decision-making the administrator needs. Option D is wrong because `-a` is a legacy flag that automatically repairs without prompting (equivalent to `-y` on modern systems), and it does not provide interactive control.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the NFS server were unreachable, the error would be something like 'mount.nfs: Connection timed out' or 'mount: mounting ... failed: No route to host', not a complaint about the fstab entry. Option B is wrong because the 'noauto' option prevents automatic mounting at boot but does not cause mount to claim the entry is missing; the entry would still be found and simply skipped. Option D is wrong because if the mount point directory did not exist, the error would be 'mount: mount point /mnt/nfs does not exist' — a different message than 'can't find /mnt/nfs in /etc/fstab'.

Why this answer

How to eliminate wrong answers

Option B is wrong because `grub2-install` installs the GRUB2 bootloader to a disk or partition (e.g., the EFI System Partition) and updates the UEFI boot entry for GRUB itself, but it does not add arbitrary kernel entries to the UEFI boot manager; it is a bootloader installation tool, not a boot manager entry editor. Option C is wrong because `lilo` is a legacy bootloader for BIOS/MBR systems and does not support UEFI boot manager manipulation; it is obsolete for UEFI environments. Option D is wrong because `mknbi` is a tool for creating network boot images (e.g., for PXE or Etherboot), not for managing UEFI NVRAM boot entries.

Why this answer

How to eliminate wrong answers

Option A is wrong because it places the DROP rule first, which would drop all SSH traffic (including from 10.0.0.0/8) before the ACCEPT rule is ever reached, effectively blocking all SSH access. Option B is wrong because it drops traffic from 10.0.0.0/8 and then accepts all other traffic, which is the opposite of the required policy. Option C is wrong because it only adds an ACCEPT rule for the 10.0.0.0/8 network, but with a default ACCEPT policy on the INPUT chain, all other traffic to port 22 would still be allowed, failing to deny other sources.

Why this answer

How to eliminate wrong answers

Option B is wrong because `sensors -u` reads from kernel-based sensor drivers (e.g., lm-sensors) and only reports current sensor values in a raw format; it does not access the BMC or event logs, and it cannot detect power supply failures that cause random reboots if the OS is already unstable. Option C is wrong because `lspci -v` lists PCI devices and their configuration details, but it does not monitor hardware health, sensor data, or event logs; it is purely for enumerating the PCI bus. Option D is wrong because `dmidecode -t baseboard` decodes DMI/SMBIOS tables to show motherboard information (e.g., manufacturer, serial number), but it provides no dynamic sensor readings or event log history; it is static hardware inventory data, not a health monitoring tool.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it specifies minute=3 and hour=0, which would run at 12:03 AM (00:03), not 3:00 AM. Option C is wrong because hour=15 corresponds to 3:00 PM, not 3:00 AM. Option D is wrong because day-of-week=0 represents Sunday, not Monday (in cron, 0 and 7 both mean Sunday).

Why this answer

How to eliminate wrong answers

Option B is wrong because RAID 0 stripes data across both disks, combining their storage capacity and speed but also mixing frequently and infrequently accessed data on both the SSD and HDD, which negates the goal of isolating hot data on the faster SSD. Option C is wrong because symbolic links redirect file access at the filesystem level but do not provide a mechanism to automatically or efficiently place frequently accessed files on the SSD; they require manual management and do not leverage any filesystem feature for performance tiering. Option D is wrong because a union mount overlays one filesystem on top of another, but it does not intelligently direct frequently accessed files to the SSD; it simply merges directories, and writes typically go to the top layer, which could be the HDD, defeating the purpose.

Why this answer

How to eliminate wrong answers

Option A is wrong because converting /var to LVM requires backing up, reformatting, and restoring data, which would cause significant downtime and is unnecessary when a simpler bind mount solution exists. Option B is wrong because a symbolic link cannot point to a block device like /dev/sdb1; symbolic links point to file paths, not device nodes, and even if you created a symlink to a mount point, it would not automatically mount the filesystem. Option C is wrong because moving /var/www/uploads to /mnt/uploads and creating a symbolic link would break the current file paths for the web application until the symlink is created, and the move operation itself could disrupt running services if files are in use; additionally, the symlink would not persist across reboots without proper fstab entries.

Why this answer

How to eliminate wrong answers

Option A is wrong because lscpu is a valid command that displays architecture information, but it is not the only one; the question asks which command displays the architecture, and since multiple commands do, 'All of the above' is the correct choice. Option C is wrong because arch is a valid command that outputs the architecture, but again it is not the only one, making 'All of the above' the comprehensive answer. Option D is wrong because uname -m is a valid command that shows the machine hardware name (architecture), but it is not the only command that does so, so the correct answer is the inclusive option.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'miimon=100' enables link monitoring via MII, which is already functioning (the bond detected the cable pull and failed over), so it is not the missing parameter. Option B is wrong because 'downdelay=0' (default) controls the delay before deactivating a slave after link loss; the issue is about failback, not failover timing. Option C is wrong because 'updelay=0' (default) controls the delay before considering a link as up after reconnection; the bond already sees eth0 as 'up', so the problem is not a delay but the lack of a preference to switch back.

Why this answer

How to eliminate wrong answers

Option A is wrong because 256G is the total disk size, not the unpartitioned space; it ignores that partitions already occupy 250 GB. Option C is wrong because 6G is the raw difference between total size and partition sum (256 - 250 = 6), but it fails to account for the extended partition's metadata overhead (e.g., extended boot record), which reduces usable unpartitioned space to about 5.5 GB. Option D is wrong because 150G is the size of a single partition (sda3), not the unpartitioned space; it likely confuses a partition's size with free space.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'systemctl start app.service' only starts the service immediately in the current session, but does not configure it to start automatically on boot. Option C is wrong because 'chkconfig' is a legacy tool for SysV init systems (e.g., RHEL/CentOS 6 and earlier), not for systemd-based systems; it would not work or would be deprecated. Option D is wrong because 'update-rc.d' is a Debian/Ubuntu-specific command for managing SysV init scripts, not for systemd services; it would not properly enable a systemd unit.

Why this answer

How to eliminate wrong answers

Option A is wrong because emergency.target is a minimal environment used for troubleshooting when the system cannot boot normally; it is not the default target shown in the exhibit. Option C is wrong because rescue.target is a single-user mode with basic system services, but it is not the default target displayed. Option D is wrong because graphical.target is the default for desktop-oriented installations that include a display manager, but the exhibit explicitly shows multi-user.target as the current default.

Why this answer

How to eliminate wrong answers

Option B is wrong because `systemctl isolate multi-user.target` immediately switches the current running target to `multi-user.target`, but this change is not persistent; it only affects the current session and does not modify the default target for future boots. Option C is wrong because `systemctl enable multi-user.target` is not a valid systemd command for setting the default target; `enable` is used to enable services or units at boot, not to set the default target. Option D is wrong because `systemctl start multi-user.target` starts the target immediately but does not make it the default for subsequent boots; it only activates the target in the current session.

Why this answer

How to eliminate wrong answers

Option A is wrong because `chown jane.staff file` uses a period (dot) as a separator, which is an obsolete and non-portable syntax; modern systems interpret the dot as part of the username, not as a user:group delimiter, and may fail or produce unexpected results. Option B is wrong because `chgrp jane staff file` is invalid syntax—`chgrp` changes only the group, and its correct usage is `chgrp group file`; passing two arguments (jane and staff) before the file name is incorrect and will cause a command error. Option D is wrong because `chown jane staff file` treats 'staff' as a second file argument, not as a group; `chown` expects either a user alone or a user:group pair, so this will attempt to change ownership to user 'jane' on two files ('staff' and 'file'), which is not the intended operation.

Why this answer

How to eliminate wrong answers

Option A is wrong because `df -h /var` shows the total disk usage and free space on the filesystem mounted at /var, not the sizes of individual directories or files within it. Option B is wrong because `find /var -size +100M` finds files larger than 100 MB, not directories, and does not aggregate sizes of directory contents. Option C is wrong because `ls -lS /var` lists the immediate contents of /var sorted by file size, but it does not recurse into subdirectories and cannot show the total size of directories, which is needed to identify large directories.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because MX records are used for mail exchange routing, specifying mail servers for a domain, not for web server load balancing. Option B is wrong because PTR records perform reverse DNS lookups (IP to hostname), which are irrelevant for distributing web traffic. Option C is wrong because CNAME records create an alias from one hostname to another, but they cannot point to multiple IP addresses or provide round-robin functionality; they only map a name to a single canonical name.

Why this answer

How to eliminate wrong answers

Option A is wrong because it uses ls output inside double quotes, which treats the entire output as a single string, so the loop runs only once with all filenames concatenated, not iterating over individual files. Option B is wrong because it uses backticks without quotes around the ls command, causing word splitting that breaks filenames with spaces into separate loop iterations, and also lacks quotes around $file in the test, leading to errors with spaces. Option C is wrong because $(ls) is subject to word splitting and pathname expansion, so filenames with spaces are split into multiple arguments, and the loop may also expand glob characters in filenames, causing incorrect behavior.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'every minute of every hour, but only weekdays' would require the day-of-week field to be set to 1-5 (or MON-FRI), not `*`. Option B is wrong because 'every day at midnight' would require the minute and hour fields to be `0 0`, not `* *`. Option D is wrong because 'every hour' would require the minute field to be a specific value (e.g., `0`) and the hour field to be `*`, but here both minute and hour are `*`, which means every minute, not just every hour.

Why this answer

How to eliminate wrong answers

Option A is wrong because `addgroup` is not a standard Linux command; it is a Debian/Ubuntu-specific wrapper that may not exist on all distributions, and the standard command is `groupadd`. Option C is wrong because `newgroup` is not a valid Linux command; the correct command is `groupadd`. Option D is wrong because `groupadd -r developers` creates a system group (with a GID in the system range, typically below 1000), not a regular group named 'developers' as required by the question.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'stat /' displays metadata about the root filesystem (like inode count, block size, and timestamps) but does not show which processes are holding deleted files or provide insight into inode exhaustion. Option C is wrong because 'du -sh /' calculates disk space usage of the root directory, which would show normal usage (matching 'df -h' 60%) and cannot detect inode exhaustion or deleted-but-open files. Option D is wrong because 'df -i' shows inode usage statistics (used vs free inodes) and could confirm inode exhaustion, but it does not identify the specific processes or files causing the issue; 'lsof +L1' is needed to pinpoint the culprit.

Why this answer

How to eliminate wrong answers

Option A is wrong because writing to `/proc/sys/vm/drop_caches` clears kernel page cache, dentries, and inode caches, which frees memory but does not affect disk space; the /var partition remains full. Option B is wrong because remounting with `noatime` prevents future access time updates, which can reduce write overhead but does not recover already consumed disk space. Option D is wrong because `df -i` checks inode usage (the number of files/directories), not block usage; the problem is the partition is full due to block exhaustion, not inode exhaustion.

Why this answer

How to eliminate wrong answers

Option A is wrong because `lvcreate` creates a new logical volume, not extends an existing one; using it would attempt to create a separate 10 GB LV, not modify the target LV. Option B is wrong because `vgextend` is used to add a physical volume to a volume group, not to extend a logical volume; the syntax and purpose are entirely mismatched. Option D is wrong because `lvresize -L 10G` sets the absolute size of the logical volume to exactly 10 GB, which would shrink it if it were larger than 10 GB, rather than adding 10 GB; the `+` sign is required for an extension operation.