Linux Professional Institute Certification Level 1 LPIC-1 LPIC-1 Questions 526–532 | Page 8/8

526

MCQeasy

Refer to the exhibit. When will the cron job execute?

A.Every minute of every hour, but only weekdays.

B.Every day at midnight.

C.Every minute.

D.Every hour.

AnswerC

Five asterisks mean every minute of every hour of every day.

Why this answer

The cron job entry `* * * * *` specifies five fields (minute, hour, day of month, month, day of week), each set to `*`, meaning 'every'. This results in the job executing every minute of every hour, every day of the month, every month, and every day of the week — i.e., every minute without restriction.

Exam trap

The trap here is that candidates often misinterpret `* * * * *` as 'every hour' or 'every day at midnight' because they focus on the asterisks without understanding that each field must be evaluated independently — every asterisk means 'every possible value' for that field, leading to execution every minute.

How to eliminate wrong answers

Option A is wrong because 'every minute of every hour, but only weekdays' would require the day-of-week field to be set to 1-5 (or MON-FRI), not `*`. Option B is wrong because 'every day at midnight' would require the minute and hour fields to be `0 0`, not `* *`. Option D is wrong because 'every hour' would require the minute field to be a specific value (e.g., `0`) and the hour field to be `*`, but here both minute and hour are `*`, which means every minute, not just every hour.

Full explanation →

527

MCQeasy

Which command adds a new group named 'developers' to the system?

A.addgroup developers

B.groupadd developers

C.newgroup developers

D.groupadd -r developers

AnswerB

Correct: standard command to add a group.

Why this answer

The correct command to add a new group on a Linux system is `groupadd developers`. This command creates a new group entry in the system's group database (typically /etc/group). The `groupadd` utility is the standard tool for this task in Linux, and it is part of the shadow-utils package.

Exam trap

The trap here is that candidates may confuse `groupadd` with distribution-specific wrappers like `addgroup` (Debian/Ubuntu) or think that `newgroup` is a valid command, or they may overlook the significance of the `-r` flag which creates a system group instead of a regular group.

How to eliminate wrong answers

Option A is wrong because `addgroup` is not a standard Linux command; it is a Debian/Ubuntu-specific wrapper that may not exist on all distributions, and the standard command is `groupadd`. Option C is wrong because `newgroup` is not a valid Linux command; the correct command is `groupadd`. Option D is wrong because `groupadd -r developers` creates a system group (with a GID in the system range, typically below 1000), not a regular group named 'developers' as required by the question.

Full explanation →

528

MCQhard

A system reports 'No space left on device' but 'df -h' shows only 60% usage. Which command would help identify the cause?

A.stat /

B.lsof +L1

C.du -sh /

D.df -i

AnswerB

lsof +L1 lists files with link count 0 but still open; these occupy space.

Why this answer

The 'No space left on device' error can occur even when 'df -h' shows available space if the filesystem has exhausted its inodes (metadata structures that store file information). However, the question states 'df -h' shows only 60% usage, implying space is not the issue, but inodes could be. The command 'lsof +L1' lists all open files with a link count of zero (i.e., deleted but still held open by a process), which consume inodes and can fill the filesystem's inode table without using disk space.

This is the most direct way to identify processes holding deleted files that prevent inode reuse.

Exam trap

The trap here is that candidates assume 'No space left on device' always means disk space is full, but LPIC-1 tests the distinction between disk space exhaustion and inode exhaustion, where 'df -i' shows inode usage and 'lsof +L1' identifies the specific processes holding deleted files.

How to eliminate wrong answers

Option A is wrong because 'stat /' displays metadata about the root filesystem (like inode count, block size, and timestamps) but does not show which processes are holding deleted files or provide insight into inode exhaustion. Option C is wrong because 'du -sh /' calculates disk space usage of the root directory, which would show normal usage (matching 'df -h' 60%) and cannot detect inode exhaustion or deleted-but-open files. Option D is wrong because 'df -i' shows inode usage statistics (used vs free inodes) and could confirm inode exhaustion, but it does not identify the specific processes or files causing the issue; 'lsof +L1' is needed to pinpoint the culprit.

Full explanation →

529

MCQhard

A system administrator is troubleshooting a server where the /var partition is full, causing services to fail. The administrator deletes old log files in /var/log, but the available space does not increase. Which step should be taken next?

A.Run 'sync; echo 3 > /proc/sys/vm/drop_caches' to clear cache.

B.Remount the /var partition with the 'noatime' option.

C.Use 'lsof /var/log' to find processes holding deleted file handles, then restart those processes.

D.Run 'df -i' to check inode usage.

AnswerC

Deleted files remain until all file handles are closed; lsof identifies the processes.

Why this answer

When a file is deleted while a process still holds an open file descriptor to it, the file's data blocks are not freed until that process releases the handle. The `lsof /var/log` command identifies such processes, and restarting them forces the kernel to release the deleted inodes, thereby reclaiming the disk space. This is why option C is the correct next step.

Exam trap

The trap here is that candidates assume deleting files immediately frees space, but they overlook that processes can keep deleted files open, and they confuse memory caches (cleared by drop_caches) with disk space.

How to eliminate wrong answers

Option A is wrong because writing to `/proc/sys/vm/drop_caches` clears kernel page cache, dentries, and inode caches, which frees memory but does not affect disk space; the /var partition remains full. Option B is wrong because remounting with `noatime` prevents future access time updates, which can reduce write overhead but does not recover already consumed disk space. Option D is wrong because `df -i` checks inode usage (the number of files/directories), not block usage; the problem is the partition is full due to block exhaustion, not inode exhaustion.

Full explanation →

530

MCQmedium

An administrator needs to extend a logical volume by 10GB. The volume group has available physical extents. Which command should be used?

A.lvcreate -L 10G /dev/vg/lv

B.vgextend /dev/vg/lv -L +10G

C.lvextend -L +10G /dev/vg/lv

D.lvresize -L 10G /dev/vg/lv

AnswerC

Correct: extends the LV by 10GB.

Why this answer

Option C is correct because the `lvextend` command with the `-L +10G` flag increases the size of the existing logical volume `/dev/vg/lv` by exactly 10 GB, using available physical extents from the volume group. This is the standard LVM command for extending a logical volume without recreating it.

Exam trap

The trap here is that candidates confuse `lvcreate` with `lvextend` or forget the `+` sign in `lvresize`, leading them to choose an option that either creates a new volume or sets an absolute size instead of incrementing it.

How to eliminate wrong answers

Option A is wrong because `lvcreate` creates a new logical volume, not extends an existing one; using it would attempt to create a separate 10 GB LV, not modify the target LV. Option B is wrong because `vgextend` is used to add a physical volume to a volume group, not to extend a logical volume; the syntax and purpose are entirely mismatched. Option D is wrong because `lvresize -L 10G` sets the absolute size of the logical volume to exactly 10 GB, which would shrink it if it were larger than 10 GB, rather than adding 10 GB; the `+` sign is required for an extension operation.

Full explanation →

531

MCQmedium

An administrator notices that a large file on an ext4 filesystem is taking up more disk space than expected based on its size. Which command would show the actual disk usage (block allocation) of the file?

A.ls -l

B.df -h

C.du -h

D.stat

AnswerC

du -h displays disk usage in human-readable format for files and directories.

Why this answer

Option C (du -h) is correct because du (disk usage) reports the actual disk space consumed by a file, including allocated blocks, which can be larger than the file's logical size due to block size overhead, fragmentation, or sparse file handling. On ext4, the default block size is 4096 bytes, so a 1-byte file occupies 4096 bytes on disk, and du reflects this allocation.

Exam trap

The trap here is that candidates confuse logical file size (shown by ls -l) with actual disk block allocation, assuming they are identical, and overlook that du accounts for filesystem overhead like block size rounding and sparse file handling.

How to eliminate wrong answers

Option A (ls -l) is wrong because it shows the logical file size (st_size), not the actual disk blocks allocated; it does not account for block size overhead or sparse file holes. Option B (df -h) is wrong because it reports filesystem-wide free and used space, not per-file disk usage. Option D (stat) is wrong because while it displays the file's size and blocks allocated (in 512-byte units), it does not directly show human-readable disk usage like du does; stat is more for inode metadata, not a quick usage summary.

Full explanation →

532

MCQhard

A database server on a Linux system is configured to listen on TCP port 3306. The administrator wants to restrict access to the database server to only the local network (192.168.1.0/24) using iptables. Which of the following iptables rules achieves this?

A.iptables -A INPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j DROP

B.iptables -A OUTPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j ACCEPT

C.iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -j ACCEPT

D.iptables -A OUTPUT -p tcp --sport 3306 -s 192.168.1.0/24 -j ACCEPT

AnswerC

Correct rule to allow incoming MySQL from local subnet.

Why this answer

Option C is correct because it adds an INPUT chain rule that accepts TCP traffic destined for port 3306 only when the source address is within the 192.168.1.0/24 subnet. This effectively restricts incoming database connections to the local network, while all other sources are implicitly dropped by the default INPUT policy or subsequent rules.

Exam trap

The trap here is confusing the -s (source) and -d (destination) flags, leading candidates to pick Option A which drops traffic to the local network instead of accepting traffic from it.

How to eliminate wrong answers

Option A is wrong because it uses the -d (destination) flag instead of -s (source), and then jumps to DROP, which would block traffic destined for the 192.168.1.0/24 network (i.e., traffic going out to that subnet) rather than restricting incoming connections from it. Option B is wrong because it applies to the OUTPUT chain, which controls outgoing traffic; restricting access to an incoming database server requires an INPUT chain rule, not OUTPUT. Option D is wrong because it uses the OUTPUT chain with --sport 3306 (source port) and -s (source address), which would match outgoing packets originating from port 3306 with a source address in 192.168.1.0/24 — this is irrelevant for controlling incoming connections to the database server.

Full explanation →

Linux Professional Institute Certification Level 1 LPIC-1 (LPIC-1) — Questions 526–532