Courseiva

CCNA Devices, Filesystems and FHS Questions

33 of 108 questions · Page 2/2 · Devices, Filesystems and FHS · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQmedium

After running 'df -h', the administrator sees that /dev/sda1 is 100% used. 'du -sh /mountpoint' shows only 50% used. What is the most likely cause?

A.The disk has bad blocks
B.A large file was deleted but a process still holds it open
C.There is a hard link that du does not count
D.The filesystem is corrupted and needs fsck
AnswerB

Correct: The file remains on disk until the process releases it.

Why this answer

When a file is deleted but a process still holds an open file descriptor to it, the kernel does not release the disk space until the process closes the file. The 'df' command reports space usage based on the filesystem's superblock, which still counts the deleted file's blocks. 'du' calculates space by traversing the directory tree and summing file sizes, so it does not see the unlinked file. This discrepancy explains why 'df' shows 100% usage while 'du' shows only 50%.

Exam trap

The trap here is that candidates assume 'du' and 'df' should always match, overlooking the fact that 'du' cannot account for space used by unlinked files still held open by processes.

How to eliminate wrong answers

Option A is wrong because bad blocks would cause read/write errors and potential data loss, but they would not create a discrepancy between df and du; bad blocks are marked as unusable and do not inflate used space. Option C is wrong because hard links are counted correctly by both df and du; du counts each hard link's contribution to the directory tree, and df accounts for the inode's allocated blocks only once. Option D is wrong because filesystem corruption typically causes inconsistencies in metadata that fsck can repair, but it would not produce a clean df vs du mismatch; corruption often leads to errors or missing files, not a hidden file consuming space.

Practice this question →
77
Multi-Selectmedium

Which THREE of the following directories are defined in the Filesystem Hierarchy Standard (FHS) and are expected to exist on a typical Linux system?

Select 3 answers
A./net
B./run
C./opt
D./proc
E./sys
AnswersB, D, E

/run is a standard temporary filesystem for runtime data.

Why this answer

B is correct because /run is a tmpfs directory defined in FHS 3.0+ that stores volatile runtime data (e.g., PID files, Unix sockets) since boot. It replaced /var/run to ensure early-boot processes have a writable location before /var is mounted.

Exam trap

The trap here is that /opt is defined in FHS but is optional, so candidates often assume it is mandatory, while /run, /proc, and /sys are the three that are truly expected on every typical Linux system.

Practice this question →
78
Drag & Dropmedium

Arrange the steps to create a LVM logical volume and mount it.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

LVM requires PVs, VG, LV creation, then formatting and mounting.

Practice this question →
79
MCQeasy

Refer to the exhibit. How many physical disks are present in the system?

A.3
B.2
C.4
D.1
AnswerB

Correct: Two disks: sda and sdb.

Why this answer

The output shows two SCSI disks: /dev/sda and /dev/sdb. Each device file represents a physical disk, so there are exactly two physical disks present. The partitions (sda1, sda2, sdb1) are subdivisions of those disks and do not count as separate physical disks.

Exam trap

The trap here is that candidates often count partition entries (e.g., sda1, sda2, sdb1) as separate physical disks, leading them to overcount the actual number of drives.

How to eliminate wrong answers

Option A is wrong because it likely counts partitions (sda1, sda2, sdb1) as separate disks, but partitions are logical divisions, not physical disks. Option C is wrong because it may misinterpret the number of device files or include non-disk devices (e.g., /dev/sr0 for optical drive) as physical disks. Option D is wrong because it ignores the second disk /dev/sdb, possibly assuming all partitions belong to a single disk.

Practice this question →
80
Multi-Selectmedium

Which TWO of the following are valid methods to specify a partition in /etc/fstab?

Select 2 answers
A.PARTUUID
B.UUID
C.LABEL
D.DEVPATH
E.ID
AnswersB, C

UUID (Universally Unique Identifier) is a standard way to identify partitions.

Why this answer

UUID and LABEL are both valid identifiers for partitions in /etc/fstab. UUID uses the filesystem's universally unique identifier, while LABEL uses a human-readable name assigned to the filesystem. Both are persistent across reboots and preferred over device names like /dev/sda1, which can change.

Exam trap

The trap here is that candidates may confuse PARTUUID (a partition table identifier) with UUID (a filesystem identifier), or assume any udev property like DEVPATH or ID is valid in fstab, when only UUID, LABEL, and device paths are supported.

Practice this question →
81
MCQmedium

Refer to the exhibit. Based on the mount options shown, which filesystem is most likely to store filenames with mixed case and support long filenames?

A./dev/sdc1
B./dev/sda2
C./dev/sda1
D./dev/sdb1
E.tmpfs
AnswerA

vfat with shortname=mixed handles mixed case and long filenames.

Why this answer

The mount options shown for /dev/sdc1 include 'utf8' and 'codepage=437', which are characteristic of VFAT (or FAT32) filesystems. VFAT supports mixed-case filenames (though it is case-insensitive) and long filenames via the VFAT extension, which stores up to 255 UTF-16 characters. The other filesystems are either ext4 (which also supports mixed case and long names but does not use codepage/utf8 options) or tmpfs (which is RAM-based and not typically mounted with such options).

Exam trap

LPI often tests the misconception that ext4 filesystems require codepage or utf8 mount options for long filenames, when in fact those options are specific to FAT/VFAT filesystems that need explicit character set handling for backward compatibility with short 8.3 names.

How to eliminate wrong answers

Option B (/dev/sda2) is wrong because it is mounted as ext4 (type ext4) and does not use codepage or utf8 mount options; ext4 supports long filenames and mixed case natively but the given options are specific to FAT/VFAT. Option C (/dev/sda1) is wrong because it is mounted as ext4 (type ext4) and lacks the codepage/utf8 options that indicate a FAT-based filesystem. Option D (/dev/sdb1) is wrong because it is mounted as ext4 (type ext4) and does not have the codepage or utf8 mount options; ext4 handles filenames differently and does not require these options.

Option E (tmpfs) is wrong because tmpfs is a RAM-based filesystem that does not use codepage or utf8 mount options; it supports long filenames and mixed case but is not the filesystem most likely to store filenames with those specific mount options.

Practice this question →
82
MCQmedium

Based on the /etc/fstab entry, which filesystem will be checked by fsck at boot time?

A.All filesystems except NFS
B./, /boot, and /mnt/data
C./, /boot, and swap
D./ and /boot only
AnswerD

Correct: pass numbers 1 and 2.

Why this answer

The /etc/fstab entry shows that only the root filesystem (/) and /boot have a non-zero value in the dump field (the fifth field). The fsck command at boot time checks filesystems with a dump value greater than 0, in the order specified by the pass number (the sixth field). Since /mnt/data and swap have a dump value of 0, they are skipped.

Exam trap

The trap here is that candidates often confuse the dump field with the pass field, assuming that a non-zero pass number alone triggers a check, but fsck actually requires both a non-zero dump field and a non-zero pass number to perform the check.

How to eliminate wrong answers

Option A is wrong because not all filesystems are checked; only those with a non-zero dump field are checked, and NFS filesystems are never checked by fsck regardless of the dump field. Option B is wrong because /mnt/data has a dump value of 0, so it is not checked by fsck at boot time. Option C is wrong because swap filesystems are never checked by fsck; they have a dump value of 0 and a pass number of 0, meaning they are skipped.

Practice this question →
83
Multi-Selecthard

Which THREE of the following directories are part of the FHS and must be present on a standard Linux system? (Choose three.)

Select 3 answers
A./var
B./etc
C./lost+found
D./bin
E./home
AnswersA, B, D

/var is required for variable data.

Why this answer

/var is required by the FHS to store variable data such as logs (/var/log), mail spools, and print queues. It must exist on a standard Linux system because many core services depend on it for runtime data that changes in size and content.

Exam trap

The trap here is that /lost+found appears essential because it is commonly seen on ext filesystems, but it is not part of the FHS mandatory list, and /home is often assumed required due to its ubiquity, yet the FHS does not mandate it for a standard Linux system.

Practice this question →
84
MCQmedium

An administrator needs to mount a USB drive with the ext4 filesystem automatically at boot. The drive has a filesystem label 'DATA'. Which entry in /etc/fstab will mount it at /mnt/data with noatime and default mount options?

A./dev/sdb1 /mnt/data ext4 noatime,defaults 0 0
B.LABEL=DATA /mnt/data ext4 noatime,defaults 0 0
C.LABEL=DATA /mnt/data ext4 defaults 0 0
D.UUID=DATA /mnt/data ext4 noatime,defaults 0 0
AnswerB

Correct use of label and options.

Why this answer

Option B is correct because it uses the filesystem label 'DATA' to identify the USB drive, which is more reliable than a device name like /dev/sdb1 that can change between boots. The mount options 'noatime,defaults' are specified in the correct order, with 'defaults' providing standard mount options (rw, suid, dev, exec, auto, nouser, async) and 'noatime' disabling access time updates to reduce writes. The entry also includes the proper ext4 filesystem type and the mount point /mnt/data.

Exam trap

The trap here is that candidates often default to using /dev/sdX device names (option A) out of habit, forgetting that device names are dynamic and unreliable for persistent mounts, while also overlooking that 'defaults' must be explicitly included when other options like 'noatime' are specified.

How to eliminate wrong answers

Option A is wrong because it uses the device path /dev/sdb1, which is not guaranteed to be consistent across reboots (e.g., if another USB drive is plugged in, the device name may change), making it unsuitable for automatic boot mounting. Option C is wrong because it omits the 'noatime' mount option, which the question explicitly requires for the mount. Option D is wrong because 'UUID=DATA' is invalid syntax; UUIDs are hexadecimal strings (e.g., UUID=1234-5678), not arbitrary labels, and the correct identifier for a filesystem label is 'LABEL=DATA'.

Practice this question →
85
MCQeasy

Refer to the exhibit. The system administrator sees that /var/log is 93% full and the syslog file is nearly 2 GB. What is the most appropriate immediate action to free up disk space without losing any critical log data?

A.Run 'logrotate -f /etc/logrotate.conf' to force log rotation.
B.Increase the size of the /var/log partition using lvextend.
C.Delete /var/log/syslog and restart the syslog daemon.
D.Move /var/log/syslog to /tmp and create a symbolic link.
AnswerA

logrotate will compress and rotate the file, freeing space while keeping old logs.

Why this answer

Option A is correct because 'logrotate -f' forces an immediate rotation of all log files as defined in /etc/logrotate.conf, which compresses or archives the current syslog file (e.g., syslog becomes syslog.1) and creates a fresh empty log file. This frees disk space without deleting any data, as the rotated logs remain on disk until the configured retention policy removes them. It is the standard, safe immediate action for a nearly full /var/log partition.

Exam trap

LPI often tests the misconception that deleting or moving log files is acceptable, when in fact the correct immediate action is to use logrotate -f to safely rotate logs without data loss.

How to eliminate wrong answers

Option B is wrong because increasing the partition size with lvextend does not free up existing disk space; it only adds more capacity, which does not address the immediate 93% full condition and may not be possible without available free space in the volume group. Option C is wrong because deleting /var/log/syslog and restarting the syslog daemon permanently loses all current log data, which violates the requirement to not lose any critical log data. Option D is wrong because moving the syslog file to /tmp and creating a symbolic link does not free up space on /var/log (the file still occupies space elsewhere), and /tmp is often a tmpfs filesystem that may lose data on reboot, risking log loss.

Practice this question →
86
MCQmedium

An administrator needs to mount an ISO file located at /tmp/data.iso to /mnt/iso for read-only access. Which command should be used?

A.mount /tmp/data.iso /mnt/iso
B.mount -t iso9660 -o loop /tmp/data.iso /mnt/iso
C.mount -o loop,ro /tmp/data.iso /mnt/iso
D.mount -o ro,loop /mnt/iso /tmp/data.iso
AnswerC

Correctly uses loop device and read-only option.

Why this answer

Option C is correct because it uses the `-o loop,ro` options to mount the ISO file as a loop device with read-only access. The `loop` option is required to mount a file as a block device, and `ro` ensures the filesystem is mounted read-only, which is appropriate for an ISO image (typically an iso9660 filesystem).

Exam trap

The trap here is that candidates often forget the `loop` option when mounting a file, or they incorrectly specify the filesystem type with `-t iso9660` thinking it is required, while the kernel can auto-detect it, and they may also reverse the source and mount point arguments.

How to eliminate wrong answers

Option A is wrong because it does not specify the `loop` option, so the mount command will attempt to mount the file as a block device directly, which will fail since `/tmp/data.iso` is a regular file, not a block device. Option B is wrong because it explicitly specifies `-t iso9660`, which is unnecessary and may cause the mount to fail if the ISO uses a different filesystem (e.g., UDF) or if the kernel's iso9660 module is not loaded; the `-o loop` option alone is sufficient for the kernel to auto-detect the filesystem type. Option D is wrong because it swaps the source and target arguments: the source (the ISO file) must come first, and the mount point second; additionally, it places `/mnt/iso` as the source, which is incorrect.

Practice this question →
87
MCQhard

A company runs a web server on Linux with two hard disks: /dev/sda (500GB) and /dev/sdb (500GB). The root filesystem is on /dev/sda1, and /var is on /dev/sda2. The administrator wants to add a new disk /dev/sdc (500GB) to be used as additional storage for /var/www/html. The new disk should be configured as an LVM physical volume and added to an existing volume group named 'vg_web'. The volume group currently has 200GB free space from /dev/sdb1. The administrator intends to extend the logical volume 'lv_web' mounted at /var/www/html by 300GB. Which of the following is the correct sequence of commands to achieve this without data loss?

A.pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend -L +300G /dev/vg_web/lv_web
B.pvcreate /dev/sdc; vgextend vg_web /dev/sdc; lvextend -L +300G /dev/vg_web/lv_web; resize2fs /dev/vg_web/lv_web
C.pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend --resizefs -L +300G /dev/vg_web/lv_web
D.pvcreate /dev/sdc1; vgextend vg_web /dev/sdc1; lvextend -L +300G /dev/vg_web/lv_web; resize2fs /dev/vg_web/lv_web
AnswerD

Correct sequence: pvcreate, vgextend, lvextend, resize2fs.

Why this answer

Option D is correct because it follows the proper sequence: create a physical volume on the partition /dev/sdc1, extend the volume group vg_web with it, then extend the logical volume lv_web by 300GB, and finally resize the filesystem with resize2fs to utilize the new space. Since the logical volume is mounted and contains data, the filesystem must be resized after extending the LV to avoid data loss. The --resizefs flag in option C would also work, but the question asks for the correct sequence without that flag, and option D explicitly includes the separate resize2fs step.

Exam trap

The trap here is that candidates often forget the filesystem resize step (resize2fs) after extending the logical volume, assuming lvextend alone is sufficient, or they mistakenly think --resizefs is always available or the only correct method, when in fact the explicit resize2fs is the traditional and more portable approach.

How to eliminate wrong answers

Option A is wrong because it omits the necessary filesystem resize step (resize2fs) after extending the logical volume, which would leave the filesystem unaware of the new space, potentially causing data loss or inability to use the added capacity. Option B is wrong because it uses /dev/sdc (the whole disk) instead of a partition /dev/sdc1; while LVM can use a whole disk, the question specifies adding a new disk /dev/sdc and typical practice is to create a partition first, but more critically, option B includes resize2fs but the sequence is correct in that regard; however, the use of the whole disk without a partition is not the standard approach and could cause issues with partition table alignment or future disk management. Option C is wrong because it uses the --resizefs flag, which automatically resizes the filesystem, but the question expects a sequence without that flag and with an explicit resize2fs command; additionally, the --resizefs flag may not be available on older LVM versions, making option D more universally correct.

Practice this question →
88
MCQmedium

An administrator needs to mount an ISO image file /tmp/image.iso to the directory /mnt/iso. Which command should be used?

A.mount -o loop /tmp/image.iso /mnt/iso
B.mount -o ro /tmp/image.iso /mnt/iso
C.mount -t iso /tmp/image.iso /mnt/iso
D.mount /tmp/image.iso /mnt/iso
AnswerA

Correct: loop option needed for file.

Why this answer

Option A is correct because the `-o loop` option tells the mount command to use a loop device, which is required to mount a file (like an ISO image) as if it were a block device. Without the loop option, mount expects a block device path, not a regular file.

Exam trap

The trap here is that candidates often forget the `-o loop` option and assume mount can directly handle a file path, or they confuse the read-only option (`-o ro`) with the loop option, thinking read-only is sufficient for ISO images.

How to eliminate wrong answers

Option B is wrong because `-o ro` only mounts the filesystem as read-only, but it does not enable loop device support, so mount will fail with an error like 'mount: /tmp/image.iso is not a block device'. Option C is wrong because `-t iso` is not a valid filesystem type; the correct type for ISO images is `iso9660` (or `udf`), and even with the correct type, the loop option is still required. Option D is wrong because without any options, mount expects a block device as the first argument, not a regular file, and will reject the ISO file.

Practice this question →
89
Multi-Selectmedium

Which TWO statements about udev rules are correct? (Choose two.)

Select 2 answers
A.Custom udev rules should be placed in /etc/udev/rules.d/.
B.Udev rules are only applied at boot time.
C.Udev rules can be used to schedule periodic tasks via cron.
D.Rules can match on attributes such as vendor ID and product ID.
E.The 'udevadm verify' command tests rule syntax.
AnswersA, D

Sysadmin rules go in /etc/udev/rules.d/.

Why this answer

Option A is correct because custom udev rules are placed in /etc/udev/rules.d/ to override or supplement the default rules in /lib/udev/rules.d/. This directory is the standard location for system administrators to add persistent device naming or custom actions without modifying distribution-provided files.

Exam trap

The trap here is that candidates may confuse 'udevadm verify' with a real command, but the LPIC-1 exam tests knowledge of the actual udevadm subcommands, and 'verify' is not one of them.

Practice this question →
90
MCQeasy

Which of the following commands displays the amount of free disk space on all mounted filesystems in a human-readable format?

A.df -i
B.df -h
C.du -sh
D.df -T
AnswerB

Correct: human-readable disk free.

Why this answer

The `df -h` command displays disk space usage for all mounted filesystems with sizes in human-readable units (e.g., KB, MB, GB). The `-h` flag converts raw block counts into powers of 1024 with appropriate suffixes, making the output easy to interpret at a glance.

Exam trap

The trap here is that candidates often confuse `df -h` (free disk space) with `du -sh` (used space for a directory) or `df -i` (inode usage), because all three involve storage-related metrics but serve fundamentally different purposes.

How to eliminate wrong answers

Option A is wrong because `df -i` shows inode usage, not disk space; it reports the number of used and free inodes on each filesystem, which is a separate resource from data blocks. Option C is wrong because `du -sh` estimates the total disk space used by a specific directory or file (defaulting to the current directory), not free space across all mounted filesystems. Option D is wrong because `df -T` displays the filesystem type (e.g., ext4, xfs) in addition to disk usage, but does not enable human-readable formatting; it still outputs sizes in 1K blocks unless combined with `-h`.

Practice this question →
91
Matchingmedium

Match each file system type to its typical description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Journaling file system, default on many Linux distros

High-performance 64-bit journaling file system

Copy-on-write file system with snapshots

Used for virtual memory paging

Compatible with Windows FAT32

Why these pairings

Common Linux file systems and their roles.

Practice this question →
92
MCQmedium

An administrator plans to back up the /home filesystem using dump. Which option to dump is required to perform a full backup?

A.-f /dev/st0
B.-u
C.-0
D.-1
AnswerC

Level 0 is a full backup.

Why this answer

The dump utility uses dump levels (0-9) to control backup depth. A level 0 dump performs a full backup of the specified filesystem, copying all files regardless of modification time. This is the required option for a complete backup of /home.

Exam trap

The trap here is that candidates confuse the -0 option with a generic flag or think -1 is the full backup because it is the lowest non-zero number, but dump levels start at 0 for full backups.

How to eliminate wrong answers

Option A is wrong because -f /dev/st0 specifies the output device (tape drive), not the backup level; it is optional and not required for a full backup. Option B is wrong because -u updates the /etc/dumpdates file with the backup timestamp, but does not control whether the backup is full or incremental. Option D is wrong because -1 specifies an incremental backup level 1, which only backs up files changed since the last lower-level dump (e.g., level 0), not a full backup.

Practice this question →
93
MCQeasy

A technician is repairing a system and needs to mount the root filesystem from a different disk to /mnt/sysroot. The partition is /dev/sda2 with an ext4 filesystem. Which command should be used?

A.mount -o loop /dev/sda2 /mnt/sysroot
B.mount -a
C.mount -t ext4 /dev/sda2 /mnt
D.mount /dev/sda2 /mnt/sysroot
AnswerD

This correctly mounts the device to the specified mount point, auto-detecting the filesystem type.

Why this answer

Option D is correct because the `mount` command with the device and mount point as arguments automatically detects the filesystem type (e.g., ext4) and mounts the partition at the specified directory. This is the standard way to mount a root filesystem from a different disk for repair purposes.

Exam trap

The trap here is that candidates may confuse the `-o loop` option with mounting a partition, or assume that `-t ext4` is always required, when in fact `mount` auto-detects the filesystem type for common formats like ext4.

How to eliminate wrong answers

Option A is wrong because the `-o loop` option is used for mounting a file as a loop device (e.g., an ISO image), not a block device like `/dev/sda2`. Option B is wrong because `mount -a` mounts all filesystems listed in `/etc/fstab`, not a specific partition to a custom mount point. Option C is wrong because it specifies the mount point as `/mnt` instead of `/mnt/sysroot`, which does not match the required target directory.

Practice this question →
94
MCQeasy

A system administrator wants to mount a USB flash drive formatted with the ext4 filesystem. The device is detected as /dev/sdc1. Which command should be used to mount the device to /mnt/usb?

A.mount -a /dev/sdc1 /mnt/usb
B.mount /mnt/usb /dev/sdc1
C.mount /dev/sdc1 /mnt/usb
D.mount -t ext4 /dev/sdc1 /mnt/usb
AnswerC

Correct: mount with device and mount point, filesystem auto-detected.

Why this answer

Option C is correct because the standard syntax for the mount command is `mount [options] <device> <mountpoint>`. Here, `/dev/sdc1` is the device and `/mnt/usb` is the target directory. The ext4 filesystem is auto-detected by the kernel, so specifying `-t ext4` is optional but not incorrect.

Exam trap

The trap here is that candidates often over-specify the `-t` flag thinking it is required, or confuse the argument order (device vs. mountpoint), leading them to pick D or B instead of the simpler and correct C.

How to eliminate wrong answers

Option A is wrong because `mount -a` mounts all filesystems listed in /etc/fstab, not a specific device; it ignores the `/dev/sdc1 /mnt/usb` arguments. Option B is wrong because it reverses the positional arguments, placing the mountpoint before the device, which will cause mount to interpret `/mnt/usb` as the device and fail. Option D is technically valid but not the minimal correct answer; the question asks 'which command should be used' and the `-t ext4` flag is unnecessary since the kernel can auto-detect ext4, making C the simpler and more standard choice.

Practice this question →
95
MCQmedium

A user reports that a USB drive (device /dev/sdc1) is not automatically mounted at boot. The output of 'blkid' and the relevant line in /etc/fstab are shown in the exhibit. What is the most likely cause of the failure?

A.The device /dev/sdc1 does not exist.
B.The mount point /media/usb does not exist.
C.The UUID in /etc/fstab does not match the device's UUID.
D.The filesystem is corrupted and requires fsck.
E.The filesystem type is incorrectly specified as vfat.
AnswerC

The fstab entry has UUID=5678-EFGH but blkid shows UUID=1234-ABCD, so the system cannot find the device.

Why this answer

The UUID in /etc/fstab does not match the UUID reported by blkid, causing the system to not find the device at boot. Option A is incorrect because the filesystem is detected by blkid. Option B is incorrect because the mount point exists (otherwise manual mount would fail).

Option D is incorrect because the filesystem type matches. Option E is incorrect because the device file exists.

Practice this question →
96
MCQmedium

A system administrator wants to install custom scripts that should be available to all users. The scripts are not part of any package and should be placed under the Filesystem Hierarchy Standard (FHS). Which directory is most appropriate?

A./var
B./opt
C./usr/local/bin
D./home
AnswerC

/usr/local/bin is the standard location for locally administered binaries and scripts.

Why this answer

The correct answer is /usr/local/bin because the Filesystem Hierarchy Standard (FHS) designates /usr/local as the location for locally installed software not managed by the system's package manager. Placing custom scripts in /usr/local/bin ensures they are in the default PATH for all users, while keeping them separate from system binaries in /usr/bin and /bin.

Exam trap

The trap here is that candidates often confuse /opt with /usr/local, but /opt is designed for self-contained third-party application packages (each in its own subdirectory), not for individual scripts that need to be directly in the PATH.

How to eliminate wrong answers

Option A is wrong because /var is intended for variable data files such as logs, spools, and temporary files, not for executable scripts. Option B is wrong because /opt is reserved for add-on application software packages, typically installed in their own subdirectory tree, not for individual scripts meant to be directly executable from the PATH. Option D is wrong because /home contains user home directories and is not part of the default system PATH; scripts placed there would not be accessible to all users without explicit path configuration.

Practice this question →
97
MCQmedium

Refer to the exhibit. An administrator wants to mount /dev/sda4 persistently by its UUID. Which line should be added to /etc/fstab?

A.UUID=abc-123 /mnt/data ext4 defaults 0 2
B.UUID=abc-123 /mnt/data ext4 noauto 0 2
C.LABEL=data /mnt/data ext4 defaults 0 2
D./dev/sda4 /mnt/data ext4 defaults 0 2
AnswerA

This correctly uses the UUID and mount point.

Why this answer

The UUID is 'abc-123', filesystem type is ext4, and the mount point is /mnt/data. The correct fstab entry uses UUID=abc-123.

Practice this question →
98
MCQhard

A company wants to migrate a database server from ext4 to XFS to support larger files and better scalability. The current data resides on a single partition /dev/sda1 mounted at /data. Which procedure ensures a successful migration with minimal downtime?

A.Use dd if=/dev/sda1 of=/dev/sdb1 bs=4M to clone the partition, then change fstab to use /dev/sdb1.
B.Add a new disk, create a partition with mkfs.xfs, mount it at /mnt, copy /data contents using cp -a, update /etc/fstab to use the new device, and remount.
C.Run tune2fs -O xfs /dev/sda1 to change the filesystem type.
D.Mount an NFS share, use rsync to copy data to the NFS mount, then unmount and reformat the original partition with XFS.
AnswerB

This creates a fresh XFS filesystem, preserves permissions with cp -a, and updates fstab for persistence.

Why this answer

Option B is correct because it provides a safe, low-downtime migration path: create a new XFS filesystem on a separate disk, copy the existing data with `cp -a` to preserve permissions and metadata, update `/etc/fstab` to mount the new XFS device at `/data`, and remount. This avoids modifying the original ext4 partition and ensures the database files are intact on a supported filesystem.

Exam trap

The trap here is that candidates may think `dd` or `tune2fs` can convert filesystem types, but `dd` only clones raw data and `tune2fs` is ext-specific, so the only safe method is to create a new XFS filesystem and copy the data.

How to eliminate wrong answers

Option A is wrong because `dd` clones the raw block device including the ext4 filesystem metadata, so the target `/dev/sdb1` would remain an ext4 partition, not XFS; it also requires an identical or larger disk and does not convert the filesystem. Option C is wrong because `tune2fs` is an ext2/ext3/ext4 utility and cannot change a filesystem to XFS; the `-O xfs` flag does not exist, and attempting this would corrupt the filesystem. Option D is wrong because using an NFS share introduces network dependency and potential permission/ownership issues, and the procedure of unmounting and reformatting the original partition would cause significant downtime and data loss if the rsync copy is incomplete.

Practice this question →
99
MCQmedium

An administrator needs to create a new ext4 filesystem on /dev/sdb1 and wants to reserve 2% of the blocks for the root user. Which command should be used?

A.mkfs.ext4 -m 2 /dev/sdb1
B.tune2fs -m 2 /dev/sdb1
C.mke2fs -r 2 /dev/sdb1
D.mkfs.ext4 -R 2 /dev/sdb1
AnswerA

Correct: -m specifies reserved blocks percentage.

Why this answer

Option A is correct because the `-m` flag in `mkfs.ext4` specifies the percentage of filesystem blocks reserved for the root user (superuser). By default, ext4 reserves 5% of blocks; using `-m 2` reduces this to 2%, as required. This command creates a new ext4 filesystem on `/dev/sdb1` with the specified reserved block percentage.

Exam trap

The trap here is that candidates confuse `-m` (reserved block percentage) with `-r` (revision level) or assume `tune2fs` can be used to create a filesystem, when in fact `tune2fs` only modifies existing filesystems.

How to eliminate wrong answers

Option B is wrong because `tune2fs` modifies parameters on an existing ext2/3/4 filesystem, but the question asks to create a new filesystem; `tune2fs` cannot create a filesystem. Option C is wrong because `mke2fs -r 2` sets the filesystem revision level (e.g., revision 1 or 2), not the reserved block percentage; the correct flag for reserved blocks is `-m`. Option D is wrong because `mkfs.ext4 -R 2` is invalid; `-R` is not a recognized option in `mkfs.ext4` (the correct flag is `-m`), and this would likely produce an error or be ignored.

Practice this question →
100
MCQhard

After a system crash, the root filesystem (ext4) is mounted read-only and the administrator needs to perform an interactive check. Which command should be used?

A.fsck -n /dev/sda1
B.fsck -y /dev/sda1
C.fsck -r /dev/sda1
D.fsck -a /dev/sda1
AnswerC

Correct: -r runs interactive check, prompting for each repair.

Why this answer

Option C is correct because the `-r` flag in `fsck` performs an interactive repair, prompting the administrator for a yes/no decision before fixing each filesystem issue. This is exactly what is needed after a crash when the root filesystem is mounted read-only and the administrator wants to manually check and decide on repairs. The `-r` flag is the standard way to invoke interactive mode for ext4 filesystems.

Exam trap

The trap here is that candidates confuse the `-r` (interactive repair) flag with the `-a` (automatic repair) or `-y` (assume yes) flags, mistakenly thinking automatic repair is safer or more appropriate for a post-crash scenario, when in fact interactive checking is the standard for root filesystems to avoid unintended damage.

How to eliminate wrong answers

Option A is wrong because `-n` causes fsck to perform a non-interactive, read-only check without making any repairs, which does not allow the administrator to interactively decide on fixes. Option B is wrong because `-y` automatically answers 'yes' to all repair prompts, bypassing the interactive decision-making the administrator needs. Option D is wrong because `-a` is a legacy flag that automatically repairs without prompting (equivalent to `-y` on modern systems), and it does not provide interactive control.

Practice this question →
101
MCQhard

A Linux system fails to boot after an admin added an entry in /etc/fstab to mount an NFS share. The error message indicates 'mount: can't find /mnt/nfs in /etc/fstab'. Which is the most likely cause?

A.The NFS server is unreachable.
B.The option 'noauto' was used in fstab.
C.The fstab entry has incorrect syntax causing mount to ignore it.
D.The mount point directory /mnt/nfs does not exist.
AnswerC

A syntax error can cause the entire line to be skipped, leading to 'can't find' error.

Why this answer

Option C is correct because the error message 'mount: can't find /mnt/nfs in /etc/fstab' indicates that the system's mount command cannot locate a valid entry for the mount point in /etc/fstab. This typically occurs when the fstab entry contains a syntax error (e.g., missing fields, incorrect whitespace, or invalid options) that causes the system to skip or ignore the line entirely. Even if the mount point directory exists, a malformed entry will prevent the system from recognizing it during boot.

Exam trap

The trap here is that candidates confuse the error message for a missing mount point (Option D) with a missing fstab entry, when in fact the system is telling you it cannot find the entry in the fstab file due to a syntax error.

How to eliminate wrong answers

Option A is wrong because if the NFS server were unreachable, the error would be something like 'mount.nfs: Connection timed out' or 'mount: mounting ... failed: No route to host', not a complaint about the fstab entry. Option B is wrong because the 'noauto' option prevents automatic mounting at boot but does not cause mount to claim the entry is missing; the entry would still be found and simply skipped. Option D is wrong because if the mount point directory did not exist, the error would be 'mount: mount point /mnt/nfs does not exist' — a different message than 'can't find /mnt/nfs in /etc/fstab'.

Practice this question →
102
MCQmedium

You are a systems administrator for a medium-sized company that runs a web server on a Linux host. The server has two physical disks: /dev/sda (250 GB) and /dev/sdb (500 GB). The root filesystem is on /dev/sda2, and /var is on /dev/sda3 (50 GB). The web application stores user-uploaded files in /var/www/uploads, which is part of the /var filesystem. Recently, /var has been running out of space because uploads have grown to 40 GB. You have added /dev/sdb1 (500 GB) and created an ext4 filesystem on it. You need to make the space available for uploads without disrupting the current file paths. The server must remain online during the process. Which of the following actions should you take?

A.Convert /var to use LVM by backing up, reformatting, and restoring data.
B.Create a symbolic link from /var/www/uploads to /dev/sdb1.
C.Move /var/www/uploads to /mnt/uploads and create a symbolic link from /var/www/uploads to /mnt/uploads.
D.Mount /dev/sdb1 on /mnt, copy /var/www/uploads to /mnt/uploads, then mount --bind /mnt/uploads /var/www/uploads.
AnswerD

This moves the data to the new disk and uses a bind mount to keep the original path, preserving application access without downtime.

Why this answer

Option D is correct because using a bind mount allows you to mount the new 500 GB filesystem at /mnt/uploads and then bind it to /var/www/uploads, preserving the existing file paths without moving or renaming anything. This operation can be performed online without unmounting /var or disrupting the web server, as bind mounts are a feature of the Linux kernel that make a mounted filesystem accessible at another directory.

Exam trap

The trap here is that candidates often confuse symbolic links with bind mounts, assuming a symlink to a device or mount point will work, when in fact only a bind mount can transparently redirect directory access to a different filesystem without breaking paths or requiring manual mounting.

How to eliminate wrong answers

Option A is wrong because converting /var to LVM requires backing up, reformatting, and restoring data, which would cause significant downtime and is unnecessary when a simpler bind mount solution exists. Option B is wrong because a symbolic link cannot point to a block device like /dev/sdb1; symbolic links point to file paths, not device nodes, and even if you created a symlink to a mount point, it would not automatically mount the filesystem. Option C is wrong because moving /var/www/uploads to /mnt/uploads and creating a symbolic link would break the current file paths for the web application until the symlink is created, and the move operation itself could disrupt running services if files are in use; additionally, the symlink would not persist across reboots without proper fstab entries.

Practice this question →
103
MCQeasy

Refer to the exhibit. How much unpartitioned space is available on /dev/sda?

A.256G
B.5.5G
C.6G
D.150G
AnswerB

256G - (0.5G + 100G + 150G) = 5.5G.

Why this answer

The correct answer is B because the output of `fdisk -l /dev/sda` shows the total disk size as 256 GB, with partitions sda1 (50G), sda2 (100G), and sda3 (100G) summing to 250 GB. The unpartitioned space is the difference: 256 GB - 250 GB = 6 GB, but the question asks for 'unpartitioned space available,' which excludes the extended partition's metadata overhead (typically ~0.5 GB for the EBR), leaving approximately 5.5 GB of usable unpartitioned space.

Exam trap

The trap here is that candidates naively subtract the sum of partition sizes from the total disk size (256 - 250 = 6) and pick 6G, forgetting that extended partition metadata (EBR) consumes a small but real amount of space, making the available unpartitioned space slightly less than the raw difference.

How to eliminate wrong answers

Option A is wrong because 256G is the total disk size, not the unpartitioned space; it ignores that partitions already occupy 250 GB. Option C is wrong because 6G is the raw difference between total size and partition sum (256 - 250 = 6), but it fails to account for the extended partition's metadata overhead (e.g., extended boot record), which reduces usable unpartitioned space to about 5.5 GB. Option D is wrong because 150G is the size of a single partition (sda3), not the unpartitioned space; it likely confuses a partition's size with free space.

Practice this question →
104
MCQeasy

A system administrator needs to locate the largest directories under /var to free up disk space. Which command is most appropriate?

A.df -h /var
B.find /var -size +100M
C.ls -lS /var
D.du -sk /var/* | sort -rn
AnswerD

du reports disk usage per directory; sort -rn sorts numerically descending.

Why this answer

Option D is correct because `du -sk /var/* | sort -rn` calculates the disk usage in kilobytes for each top-level item under /var, then sorts them numerically in reverse order, showing the largest directories first. This directly addresses the need to locate the largest directories to free up space, as `du` reports actual disk usage (including subdirectories) rather than file sizes.

Exam trap

The trap here is that candidates often confuse `df` (filesystem-level usage) with `du` (directory-level usage), or mistakenly think `ls -lS` can show directory sizes, when in fact `ls` only shows the size of the directory entry itself (typically 4 KB), not its contents.

How to eliminate wrong answers

Option A is wrong because `df -h /var` shows the total disk usage and free space on the filesystem mounted at /var, not the sizes of individual directories or files within it. Option B is wrong because `find /var -size +100M` finds files larger than 100 MB, not directories, and does not aggregate sizes of directory contents. Option C is wrong because `ls -lS /var` lists the immediate contents of /var sorted by file size, but it does not recurse into subdirectories and cannot show the total size of directories, which is needed to identify large directories.

Practice this question →
105
Drag & Dropmedium

Order the steps to create and apply a file system permission using ACLs.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

ACLs require the filesystem to be mounted with the acl option, then setfacl applies rules, and getfacl verifies them.

Practice this question →
106
MCQhard

A system reports 'No space left on device' but 'df -h' shows only 60% usage. Which command would help identify the cause?

A.stat /
B.lsof +L1
C.du -sh /
D.df -i
AnswerB

lsof +L1 lists files with link count 0 but still open; these occupy space.

Why this answer

The 'No space left on device' error can occur even when 'df -h' shows available space if the filesystem has exhausted its inodes (metadata structures that store file information). However, the question states 'df -h' shows only 60% usage, implying space is not the issue, but inodes could be. The command 'lsof +L1' lists all open files with a link count of zero (i.e., deleted but still held open by a process), which consume inodes and can fill the filesystem's inode table without using disk space.

This is the most direct way to identify processes holding deleted files that prevent inode reuse.

Exam trap

The trap here is that candidates assume 'No space left on device' always means disk space is full, but LPIC-1 tests the distinction between disk space exhaustion and inode exhaustion, where 'df -i' shows inode usage and 'lsof +L1' identifies the specific processes holding deleted files.

How to eliminate wrong answers

Option A is wrong because 'stat /' displays metadata about the root filesystem (like inode count, block size, and timestamps) but does not show which processes are holding deleted files or provide insight into inode exhaustion. Option C is wrong because 'du -sh /' calculates disk space usage of the root directory, which would show normal usage (matching 'df -h' 60%) and cannot detect inode exhaustion or deleted-but-open files. Option D is wrong because 'df -i' shows inode usage statistics (used vs free inodes) and could confirm inode exhaustion, but it does not identify the specific processes or files causing the issue; 'lsof +L1' is needed to pinpoint the culprit.

Practice this question →
107
MCQhard

A system administrator is troubleshooting a server where the /var partition is full, causing services to fail. The administrator deletes old log files in /var/log, but the available space does not increase. Which step should be taken next?

A.Run 'sync; echo 3 > /proc/sys/vm/drop_caches' to clear cache.
B.Remount the /var partition with the 'noatime' option.
C.Use 'lsof /var/log' to find processes holding deleted file handles, then restart those processes.
D.Run 'df -i' to check inode usage.
AnswerC

Deleted files remain until all file handles are closed; lsof identifies the processes.

Why this answer

When a file is deleted while a process still holds an open file descriptor to it, the file's data blocks are not freed until that process releases the handle. The `lsof /var/log` command identifies such processes, and restarting them forces the kernel to release the deleted inodes, thereby reclaiming the disk space. This is why option C is the correct next step.

Exam trap

The trap here is that candidates assume deleting files immediately frees space, but they overlook that processes can keep deleted files open, and they confuse memory caches (cleared by drop_caches) with disk space.

How to eliminate wrong answers

Option A is wrong because writing to `/proc/sys/vm/drop_caches` clears kernel page cache, dentries, and inode caches, which frees memory but does not affect disk space; the /var partition remains full. Option B is wrong because remounting with `noatime` prevents future access time updates, which can reduce write overhead but does not recover already consumed disk space. Option D is wrong because `df -i` checks inode usage (the number of files/directories), not block usage; the problem is the partition is full due to block exhaustion, not inode exhaustion.

Practice this question →
108
MCQmedium

An administrator notices that a large file on an ext4 filesystem is taking up more disk space than expected based on its size. Which command would show the actual disk usage (block allocation) of the file?

A.ls -l
B.df -h
C.du -h
D.stat
AnswerC

du -h displays disk usage in human-readable format for files and directories.

Why this answer

Option C (du -h) is correct because du (disk usage) reports the actual disk space consumed by a file, including allocated blocks, which can be larger than the file's logical size due to block size overhead, fragmentation, or sparse file handling. On ext4, the default block size is 4096 bytes, so a 1-byte file occupies 4096 bytes on disk, and du reflects this allocation.

Exam trap

The trap here is that candidates confuse logical file size (shown by ls -l) with actual disk block allocation, assuming they are identical, and overlook that du accounts for filesystem overhead like block size rounding and sparse file handling.

How to eliminate wrong answers

Option A (ls -l) is wrong because it shows the logical file size (st_size), not the actual disk blocks allocated; it does not account for block size overhead or sparse file holes. Option B (df -h) is wrong because it reports filesystem-wide free and used space, not per-file disk usage. Option D (stat) is wrong because while it displays the file's size and blocks allocated (in 512-byte units), it does not directly show human-readable disk usage like du does; stat is more for inode metadata, not a quick usage summary.

Practice this question →
← PreviousPage 2 of 2 · 108 questions total

Ready to test yourself?

Try a timed practice session using only Devices, Filesystems and FHS questions.

Start 20-question session