Courseiva

CCNA GNU and Unix Commands Questions

43 questions · GNU and Unix Commands · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

Refer to the exhibit. The process with PID 1234 is in state 'Z'. What is the most likely cause and appropriate action?

A.The process is stopped; use kill -CONT to continue.
B.The process is a daemon; it should be restarted.
C.The process is sleeping; wait for it to become ready.
D.The process is a zombie; the parent process must be killed or wait for it to be reaped.
AnswerD

Zombies require the parent to reap them; if parent is not waiting, it may need to be terminated.

Why this answer

In Linux process states, 'Z' indicates a zombie process, which is a child process that has terminated but whose exit status has not yet been read by its parent process via the wait() system call. The correct action is to either kill the parent process (so that the zombie is reaped by init) or ensure the parent calls wait() to reap the child. Option D correctly identifies this.

Exam trap

The trap here is that candidates confuse zombie ('Z') with stopped ('T') or sleeping ('S') states, leading them to choose a recovery action like sending SIGCONT or simply waiting, rather than recognizing that a zombie requires the parent to reap it or be terminated.

How to eliminate wrong answers

Option A is wrong because a stopped process is indicated by state 'T' (or 't'), not 'Z', and kill -CONT is used to resume a stopped process, not handle a zombie. Option B is wrong because a daemon process typically runs in the background with state 'S' (sleeping) or 'R' (running), and restarting a daemon does not address a zombie; zombies are already dead and waiting to be reaped. Option C is wrong because a sleeping process is indicated by state 'S' or 'D' (uninterruptible sleep), not 'Z', and waiting will not resolve a zombie—the zombie persists until the parent reaps it.

Practice this question →
2
Matchingmedium

Match each device file naming pattern to its device type.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

First SCSI/SATA disk

First NVMe SSD

First serial port (COM1)

First loopback device

First software RAID device

Why these pairings

Common Linux device naming conventions: /dev/sdX for SATA/SCSI, /dev/hdX for IDE, /dev/ttySX for serial ports, /dev/srX for optical drives, /dev/nvmeXnY for NVMe. Be cautious not to confuse with floppy (/dev/fdX) or other types.

Practice this question →
3
MCQmedium

A systems administrator needs to change the permissions of the file /home/user/script.sh so that the owner can read, write, and execute; the group can read and execute; and others have no access. Which command accomplishes this?

A.chmod 755 /home/user/script.sh
B.chmod 750 /home/user/script.sh
C.chmod 770 /home/user/script.sh
D.chmod 741 /home/user/script.sh
AnswerB

750 gives rwx for owner, r-x for group, and --- for others, matching the requirement.

Why this answer

Chmod 750 sets the permissions to rwxr-x---, which gives the owner read, write, and execute (7), the group read and execute (5), and others no access (0). This matches the requirement exactly.

Exam trap

The trap here is that candidates often confuse the octal values, especially mistaking 755 (which grants others read/execute) for the correct setting, or they forget that 750 denies others access while 755 does not.

How to eliminate wrong answers

Option A is wrong because chmod 755 sets permissions to rwxr-xr-x, which gives others read and execute access, violating the requirement that others have no access. Option C is wrong because chmod 770 sets permissions to rwxrwx---, which gives the group write access in addition to read and execute, exceeding the required group permissions. Option D is wrong because chmod 741 sets permissions to rwxr----x, which gives others only execute access (1) instead of no access, and the group has only read access (4) instead of read and execute.

Practice this question →
4
Multi-Selecteasy

Which THREE of the following are correct features of the 'grep' command? (Choose three.)

Select 3 answers
A.-i makes the search case-insensitive
B.-v inverts the match
C.-c counts matching lines
D.-l prints line numbers of matches
E.-r enables regular expression matching
AnswersA, B, C

Correct: --ignore-case.

Why this answer

The `-i` flag in `grep` performs case-insensitive matching, so patterns like 'error' will match 'Error', 'ERROR', etc. This is a common requirement when searching log files where case may vary.

Exam trap

The trap here is that candidates confuse `-l` (list filenames) with `-n` (show line numbers) and assume `-r` enables regex, when in fact `-r` is for recursive directory traversal and regex is the default behavior.

Practice this question →
5
MCQmedium

Which command is used to compress a file with the highest compression ratio?

A.gzip -9
B.xz -9
C.bzip2 -9
D.compress
AnswerB

xz offers the highest compression ratio among these tools, especially with -9.

Why this answer

`xz -9` uses the LZMA2 compression algorithm, which typically achieves a higher compression ratio than gzip (DEFLATE) or bzip2 (Burrows-Wheeler transform) at the cost of slower speed and higher memory usage. The `-9` flag sets the highest compression level, maximizing the ratio.

Exam trap

The trap here is that candidates often assume gzip or bzip2 with `-9` offers the highest compression ratio because they are more common, but xz is the correct answer due to its superior LZMA2 algorithm.

How to eliminate wrong answers

Option A is wrong because gzip uses the DEFLATE algorithm, which generally provides lower compression ratios than xz, especially at level 9. Option C is wrong because bzip2 uses the Burrows-Wheeler transform and Huffman coding, which can achieve good ratios but is typically outperformed by xz's LZMA2 in terms of compression ratio. Option D is wrong because `compress` uses the LZW algorithm, which is outdated and offers significantly lower compression ratios than modern tools like xz.

Practice this question →
6
Drag & Dropmedium

Order the steps to recover a forgotten root password on a Linux system.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Recovery involves booting into a shell with root access, remounting read-write, and changing the password.

Practice this question →
7
MCQhard

Refer to the exhibit. A user reports that the 'myapp' command fails to run. Based on the output, what is the most likely cause?

A.The interpreter path is incorrect.
B.The file is not a valid ELF executable.
C.A required shared library (libfoo.so.1) is missing.
D.The file is not executable for the user.
AnswerC

ldd shows libfoo.so.1 => not found, which will cause the dynamic linker to fail.

Why this answer

The error message 'error while loading shared libraries: libfoo.so.1: cannot open shared object file: No such file or directory' indicates that the dynamic linker cannot locate the required shared library libfoo.so.1. This is the most likely cause because the 'myapp' binary is linked against this library, and without it, the program cannot start.

Exam trap

LPI often tests the distinction between file permissions (executable bit) and runtime library dependencies, leading candidates to mistakenly choose 'file not executable' when the real issue is a missing shared library.

How to eliminate wrong answers

Option A is wrong because the interpreter path (e.g., #!/bin/bash or #!/usr/bin/python) is only relevant for script files, not for ELF binaries; the error message specifically mentions a missing shared library, not an interpreter issue. Option B is wrong because the file is clearly a valid ELF executable (as shown by the 'file' command output 'ELF 64-bit LSB executable'), and the error is about a missing library, not an invalid format. Option D is wrong because the file has execute permissions (as shown by '-rwxr-xr-x'), and the error message does not mention 'Permission denied'; the user can execute the file, but it fails at runtime due to the missing library.

Practice this question →
8
Multi-Selecthard

Which TWO of the following are valid methods to run a shell script named 'script.sh' using the bash shell, assuming the script has execute permission? (Choose two.)

Select 2 answers
A../script.sh
B.sh script.sh
C.script.sh (if in PATH)
D.source script.sh
E.bash script.sh
AnswersA, E

Executes the script using its shebang line, assumed to be bash.

Why this answer

'./script.sh' explicitly invokes the script using the current shell's shebang interpreter (e.g., #!/bin/bash) and requires execute permission. Option E is correct because 'bash script.sh' runs the script as an argument to the bash interpreter, which reads and executes the file line by line, also requiring execute permission.

Exam trap

The trap here is that candidates often confuse 'sh script.sh' with 'bash script.sh', not realizing that sh may be a different shell (e.g., dash) that lacks bash-specific features, and that 'source' is for importing functions/variables, not for running a script as a separate process.

Practice this question →
9
Multi-Selectmedium

Which TWO commands can be used to display the contents of a compressed text file (e.g., .gz, .bz2) directly to standard output without decompressing to disk?

Select 2 answers
A.gzcat
B.zless
C.bzcat
D.lzcat
E.zcat
AnswersC, E

bzcat decompresses .bz2 files to stdout.

Why this answer

(bzcat) is correct because it reads bzip2-compressed files (.bz2) and decompresses them directly to standard output without creating a decompressed file on disk. Option E (zcat) is correct because it does the same for gzip-compressed files (.gz), acting as a front-end to gzip -dc.

Exam trap

The trap here is that candidates may confuse zcat with gzcat (which is not standard) or think zless is equivalent to zcat, when in fact zless is a pager that does not output continuously to stdout.

Practice this question →
10
Matchingmedium

Match each Linux runlevel to its typical description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Halt

Single-user mode

Multi-user with networking

Multi-user with GUI

Reboot

Why these pairings

Standard SysV init runlevels: 0 (halt), 1 (single-user), 3 (multi-user with network), 5 (graphical multi-user), 6 (reboot). Common confusions involve swapping definitions between runlevels 3 and 5.

Practice this question →
11
MCQeasy

Refer to the exhibit. Which file system is full and what is the likely consequence if the administrator does not take action?

A.Both are full; system will crash.
B./dev/sda1 is full; system may become unstable.
C.Neither is full; available space is sufficient.
D./dev/sdb1 is full; applications writing to /var may fail.
AnswerD

The mount point /var is at 100% usage.

Why this answer

The exhibit shows that /dev/sdb1, mounted on /var, has 0% available space (100% used). The /var directory stores variable data such as logs, spool files, and temporary files. If /var fills up, critical services like syslog, cron, or package managers (e.g., apt, yum) cannot write to their log or spool files, causing applications that depend on /var to fail.

This is why option D is correct.

Exam trap

LPI often tests the misconception that a full root filesystem (/dev/sda1) is the only critical issue, but the trap here is that /var (often a separate partition) can fill up silently, causing application failures without an immediate system crash.

How to eliminate wrong answers

Option A is wrong because only /dev/sdb1 is full; /dev/sda1 has available space, so the system will not crash outright, but services relying on /var may fail. Option B is wrong because /dev/sda1 is not full; it has 20% used and 80% available, so the system will not become unstable from that mount point. Option C is wrong because /dev/sdb1 is indeed full (100% used), so available space is not sufficient for /var.

Practice this question →
12
MCQmedium

Refer to the exhibit. When will the backup script run?

A.Daily at 4:30 AM
B.Monthly at 4:30 AM on the 1st
C.Yearly at 4:30 AM
D.Weekly at 4:30 AM
AnswerB

The '1' in the day-of-month field indicates the first day of each month.

Why this answer

The cron entry `30 4 1 * * /usr/local/bin/backup.sh` specifies that the script runs when the minute is 30, hour is 4, and day-of-month is 1, with the month and day-of-week fields set to `*` (meaning every month and every day of the week). This results in execution at 4:30 AM on the 1st day of every month, making option B correct.

Exam trap

LPI often tests the misconception that a `*` in the day-of-week field implies 'every day' but candidates forget that the day-of-month field of `1` restricts execution to only the 1st, not daily.

How to eliminate wrong answers

Option A is wrong because 'Daily at 4:30 AM' would require the day-of-month field to be `*` (or a day-of-week field set to `*` with no day-of-month restriction), but here the day-of-month is `1`, limiting execution to only the 1st of each month. Option C is wrong because 'Yearly at 4:30 AM' would typically use a specific month field (e.g., `30 4 1 1 *` for January 1st), but the month field is `*`, meaning every month, not just one month per year. Option D is wrong because 'Weekly at 4:30 AM' would require a specific day-of-week value (e.g., `30 4 * * 0` for Sunday), but the day-of-week field is `*` and the day-of-month is `1`, which does not guarantee a weekly schedule.

Practice this question →
13
MCQmedium

After receiving a compressed tarball archive.tar.gz from a colleague, you want to list its contents without extracting. Which command should you use?

A.tar -xzf archive.tar.gz
B.tar -cvf archive.tar.gz
C.gzip -d archive.tar.gz | tar -t
D.tar -tvf archive.tar.gz
AnswerD

-t lists the contents of the archive without extracting.

Why this answer

The `tar -tvf archive.tar.gz` command lists the contents of a compressed tarball without extracting it. The `-t` option tells tar to list the archive's table of contents, `-v` provides verbose output (showing file permissions, ownership, etc.), and `-f` specifies the archive file. Tar automatically detects and decompresses the gzip compression when reading the file, so no separate decompression step is needed.

Exam trap

The trap here is that candidates confuse the `-x` (extract) flag with `-t` (list) because both are used for reading archives, but only `-t` lists without extracting; LPI often tests this by offering `-xzf` as a distractor, assuming candidates will misremember the flag for listing.

How to eliminate wrong answers

Option A is wrong because `tar -xzf archive.tar.gz` extracts the archive (the `-x` flag means extract), not lists its contents. Option B is wrong because `tar -cvf archive.tar.gz` creates a new archive (the `-c` flag means create) from files, which would overwrite the existing file or fail, and does not list contents. Option C is wrong because `gzip -d archive.tar.gz | tar -t` attempts to decompress the file and pipe the output to `tar -t`, but `gzip -d` without `-c` (or `--stdout`) writes the decompressed data to a file (removing the .gz extension) instead of sending it to stdout, so the pipe receives no data and tar fails; even if corrected with `gzip -dc`, it is unnecessarily complex since tar handles decompression natively.

Practice this question →
14
MCQmedium

Refer to the exhibit. Which file has a special permission that allows a user to execute the file with the privileges of the file owner?

A./usr/bin/myapp
B./tmp/shared
C./usr/bin/su
D.None of the above
AnswerC

Has setuid bit (rws).

Why this answer

The /usr/bin/su command has the SUID (Set User ID) special permission set (typically mode 4755). This allows any user who executes the file to run it with the effective user ID of the file owner (root), enabling privilege escalation to perform administrative tasks. The SUID bit is represented by an 's' in the owner's execute position when viewed with ls -l.

Exam trap

The trap here is that candidates often confuse the SUID permission with the SGID or sticky bit, or assume that any executable file in /usr/bin has special permissions, when in fact only specific system binaries like su, sudo, and passwd are configured with SUID for security reasons.

How to eliminate wrong answers

Option A is wrong because /usr/bin/myapp is a generic application file that does not inherently have the SUID permission set; without the SUID bit, it executes with the privileges of the user who runs it, not the file owner. Option B is wrong because /tmp/shared is a directory (or a regular file without SUID), and directories use the SGID or sticky bit for different purposes (e.g., group inheritance or preventing file deletion by non-owners), not for executing with the file owner's privileges. Option D is wrong because /usr/bin/su does have the special permission described, so 'None of the above' is incorrect.

Practice this question →
15
MCQmedium

An administrator needs to copy a directory hierarchy from one server to another over SSH, preserving permissions, ownership, and timestamps. Which command is most appropriate?

A.cp -a /source /mnt/remote
B.tar cf - /source | ssh user@dest "tar xf - -C /target"
C.scp -rp /source user@dest:/target
D.rsync -avz /source user@dest:/target
AnswerB

Preserves all metadata and works over SSH.

Why this answer

It uses `tar` to create an archive of the source directory, pipes it over SSH, and extracts it on the remote server with `tar xf - -C /target`. This method preserves all file metadata (permissions, ownership, timestamps) because `tar` captures and restores these attributes by default, and the pipe over SSH transfers the raw archive without any transformation. Unlike `scp` or `rsync` (without root privileges), this approach can preserve ownership even when the user is not root, as long as the remote `tar` runs with appropriate privileges.

Exam trap

The trap here is that candidates often choose `rsync -avz` (Option D) because it is commonly used for backups, but they overlook that preserving ownership over SSH requires root privileges and the `--numeric-ids` flag, which is not specified in the option, making `tar` the more reliable choice for this specific requirement.

How to eliminate wrong answers

Option A is wrong because `cp -a /source /mnt/remote` assumes the remote directory is mounted locally (e.g., via NFS or SSHFS), not over SSH directly; it does not use SSH for transport and would fail if the remote server is not mounted. Option C is wrong because `scp -rp` does not preserve ownership (it resets ownership to the connecting user) and may not preserve all timestamps in all cases; it also lacks the ability to preserve extended attributes or ACLs that `tar` can handle. Option D is wrong because `rsync -avz` without `--numeric-ids` and running as root on both sides will not preserve ownership (it maps UIDs/GIDs based on the remote user's permissions), and it may alter timestamps if the remote filesystem does not support nanosecond precision; additionally, `rsync` over SSH requires the remote user to have write permissions to the target, and ownership preservation typically requires root privileges.

Practice this question →
16
Drag & Dropmedium

Arrange the steps to configure a static IP address on a Linux system using the command line.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Static IP configuration requires editing the appropriate config file, then restarting networking to apply changes.

Practice this question →
17
MCQmedium

Refer to the exhibit. A user runs 'python --version' and gets 'Python 3.9.1'. Which command would run Python 2 instead?

A.python --version2
B.python2
C.python3
D.python2 --version
AnswerB

python2 is a separate executable and will run Python 2.

Why this answer

On many Linux distributions, Python 2 and Python 3 are installed side by side, with the `python` command typically linked to Python 2 (or sometimes Python 3, depending on the distribution). However, in this scenario, `python --version` returns 'Python 3.9.1', indicating that `python` is linked to Python 3. To explicitly run Python 2, you must use the `python2` command, which is the standard binary name for Python 2.x installations.

Exam trap

The trap here is that candidates may assume `python` always refers to Python 2, but the question shows it is Python 3, so they must recognize that `python2` is the explicit command for Python 2, not `python3` or a version flag.

How to eliminate wrong answers

Option A is wrong because `--version2` is not a valid flag for Python; it would cause an error or be ignored. Option C is wrong because `python3` would run Python 3, not Python 2, and the question asks for Python 2. Option D is wrong because while `python2 --version` would display the version of Python 2, the question asks for the command that would run Python 2, not just display its version; the correct command to run Python 2 is simply `python2`.

Practice this question →
18
MCQhard

An administrator runs the command 'find / -name "*.conf" 2>/dev/null | head -n 10' and notices that the command returns very quickly. Which statement best describes what happened?

A.It scans the entire filesystem but stops after sending the first 10 lines to head due to a broken pipe.
B.It lists 10 .conf files only from the current directory because the path is /.
C.It lists all .conf files in the filesystem because head only affects output, not find.
D.It lists only the first 10 .conf files found in the filesystem.
AnswerA

Find continues until it tries to write after head closes, then stops.

Why this answer

The `find` command starts scanning the entire filesystem from root (`/`), but its output is piped to `head -n 10`, which reads only the first 10 lines and then closes the pipe. When `head` closes the pipe, `find` receives a SIGPIPE signal (broken pipe) and terminates early, so the command returns very quickly without scanning the entire filesystem.

Exam trap

The trap here is that candidates often think `head` simply filters output after the command finishes, not realizing that pipe-induced SIGPIPE causes the upstream command to terminate early, which is why the command returns quickly.

How to eliminate wrong answers

Option B is wrong because the path `/` specifies the root directory, not the current directory; `find /` starts the search from the root of the filesystem, not from the current working directory. Option C is wrong because `head` does affect the `find` command via the pipe: when `head` exits after reading 10 lines, it closes the pipe, causing `find` to receive a broken pipe signal and stop. Option D is wrong because it implies `find` completes its full scan and then `head` selects the first 10 lines, but in reality `find` stops early due to the broken pipe, which is why the command returns quickly.

Practice this question →
19
MCQhard

Refer to the exhibit. The /var partition is nearly full. Which of the following is the most appropriate first step to free up space?

A.Move some files from /var to / and create a symbolic link.
B.Delete old log files in /var/log and clear package cache.
C.Increase the size of /dev/sdb2 using resize2fs.
D.Add a new disk and mount it to /var.
AnswerB

Log files and cached packages often consume large space and can be safely removed.

Why this answer

The most common cause of a full /var partition is accumulated log files in /var/log and cached package data. Deleting old logs (e.g., via logrotate or manual cleanup) and clearing the package manager cache (e.g., apt-get clean or yum clean all) directly reclaims space without requiring disk resizing or additional hardware. This is the safest and fastest first step before considering more invasive actions.

Exam trap

The trap here is that candidates often jump to resizing the partition or adding a disk (options C and D) because they think the problem requires a hardware or filesystem-level solution, when in fact the simplest and most appropriate first step is to clean up temporary and log files that can be safely removed.

How to eliminate wrong answers

Option A is wrong because moving files from /var to / and creating a symbolic link may break system services that expect specific paths under /var, and it does not address the root cause of space usage; it also risks filling the root partition. Option C is wrong because resize2fs can only increase the size of an ext2/ext3/ext4 filesystem if there is unallocated space on the underlying block device (e.g., after resizing the partition with fdisk or parted), and simply running resize2fs without first expanding the partition will fail or do nothing. Option D is wrong because adding a new disk and mounting it to /var is an overly complex and disruptive first step; it requires repartitioning, formatting, and moving data, which is unnecessary when simple cleanup can free space immediately.

Practice this question →
20
MCQmedium

A system administrator notices that the system's syslog messages are not being written to /var/log/messages. The rsyslog service is running. The administrator wants to check the configuration syntax of rsyslog. Which command should be used?

A.rsyslogd -d
B.rsyslogd -f
C.rsyslogd -N
D.rsyslogd -v
AnswerC

-N performs a syntax check on the configuration file.

Why this answer

The correct command is `rsyslogd -N` because the `-N` option performs a configuration syntax check without starting or restarting the rsyslog daemon. This allows the administrator to validate the rsyslog configuration file for errors before applying changes, ensuring that syslog messages will be written correctly to /var/log/messages.

Exam trap

The trap here is that candidates may confuse `-N` with `-d` (debug mode) or `-f` (config file path), assuming that running the daemon with a verbose flag or specifying a file will reveal syntax errors, whereas only `-N` performs a dedicated syntax check without executing the daemon.

How to eliminate wrong answers

Option A is wrong because `rsyslogd -d` runs rsyslogd in debug mode, which outputs verbose debugging information to the terminal but does not specifically check configuration syntax. Option B is wrong because `rsyslogd -f` specifies an alternative configuration file to use, not a syntax check; it would load and use that file, potentially causing issues if the syntax is invalid. Option D is wrong because `rsyslogd -v` displays the version information of rsyslogd and does not perform any configuration validation.

Practice this question →
21
Multi-Selecteasy

Which TWO commands can be used to view the contents of a compressed file named archive.tar.gz without extracting it to disk?

Select 2 answers
A.gzip -d archive.tar.gz
B.bunzip2 -c archive.tar.gz | tar -t
C.tar -tzf archive.tar.gz
D.gunzip -l archive.tar.gz
E.zcat archive.tar.gz | tar -t
AnswersC, E

Correct: tar -t lists table of contents; -z handles gzip; -f specifies file.

Why this answer

The `tar -tzf` command lists the contents of a tar archive compressed with gzip without extracting it. The `-t` flag tells tar to list the table of contents, `-z` handles the gzip decompression on the fly, and `-f` specifies the archive file. This is the standard, single-command method for viewing the contents of a `.tar.gz` file without writing any files to disk.

Exam trap

The trap here is that candidates often confuse `gunzip -l` (which shows compression metadata) with listing the actual file contents, or they mistakenly apply bzip2 tools to gzip archives, forgetting that each compression format requires its own specific decompression utility.

Practice this question →
22
MCQhard

A script uses 'set -e' and then executes 'grep pattern file'. If the pattern is not found, the script exits. Which of the following modifications would prevent the script from exiting while still allowing detection of the pattern's absence?

A.grep -q pattern file || true
B.set +e; grep pattern file; exit_code=$?; set -e
C.grep pattern file; exit_code=$?
D.grep pattern file | head -1
AnswerB

Temporarily disables exit-on-error, captures exit code, then re-enables.

Why this answer

It temporarily disables 'set -e' with 'set +e', runs the grep command, captures its exit code in a variable, then re-enables 'set -e'. This allows the script to continue executing after a non-zero exit from grep, while still preserving the exit code for later conditional checks. The other options either fail to preserve the exit code or do not prevent the script from exiting under 'set -e'.

Exam trap

The trap here is that candidates often think '|| true' or piping to another command will both prevent exit and preserve the exit code, but they fail to realize that these constructs either discard the exit code or do not reliably prevent exit under all shell configurations.

How to eliminate wrong answers

Option A is wrong because 'grep -q pattern file || true' prevents the script from exiting (due to the '|| true' ensuring a zero exit status), but it does not capture the exit code of grep, so the absence of the pattern cannot be detected later. Option C is wrong because simply running 'grep pattern file; exit_code=$?' without first disabling 'set -e' will cause the script to exit immediately if grep returns non-zero, so the exit code is never captured. Option D is wrong because 'grep pattern file | head -1' uses a pipe, and under 'set -e' the script will exit if grep fails (since the pipe's exit status is the exit status of the last command, which is head, but the shell's 'set -e' behavior can still cause exit if grep fails in some shells; more importantly, the exit code of grep is lost because only the exit code of the pipeline is available, and head typically succeeds even if grep fails).

Practice this question →
23
MCQeasy

A system administrator wants to list all files in a directory that have been modified in the last 24 hours. Which command would be most appropriate?

A.ls -l --time=mod
B.find . -mmin 1440
C.ls -lt
D.find . -mtime -1
AnswerD

-mtime -1 finds files modified less than 1 day ago, which is the last 24 hours.

Why this answer

The `find` command with `-mtime -1` searches for files whose modification time is less than 1 day ago (i.e., within the last 24 hours). The minus sign before the number means 'less than' that many days, so `-mtime -1` matches files modified in the last 24 hours. This is the standard, precise way to list files by modification time in a directory tree.

Exam trap

The trap here is that candidates confuse `-mtime` with `-mmin` and forget that the minus sign in `-mtime -1` is required to mean 'less than', or they mistakenly think `ls -lt` filters by time when it only sorts.

How to eliminate wrong answers

Option A is wrong because `ls -l --time=mod` lists files with their modification time displayed, but it does not filter files by age; it shows all files in the directory. Option B is wrong because `find . -mmin 1440` uses minutes (1440 minutes = 24 hours), but the syntax `-mmin` expects an integer without a sign; `-mmin 1440` matches files modified exactly 1440 minutes ago, not within the last 24 hours (the correct syntax would be `-mmin -1440`). Option C is wrong because `ls -lt` lists files sorted by modification time (newest first), but it does not filter; it shows all files in the directory, regardless of age.

Practice this question →
24
Multi-Selectmedium

Which TWO commands can be used to display the contents of a compressed file without decompressing it to disk? (Choose two.)

Select 2 answers
A.zcat file.gz
B.gzip -d file.gz
C.tar -xzf file.tar.gz
D.bzcat file.bz2
E.uncompress file.Z
AnswersA, D

Equivalent to gunzip -c; outputs to stdout.

Why this answer

A is correct because `zcat` reads a gzip-compressed file and writes its decompressed content to standard output without saving the decompressed data to disk. This allows you to view the contents of `file.gz` directly in the terminal or pipe it to other commands.

Exam trap

The trap here is that candidates confuse commands that decompress to stdout (like `zcat` and `bzcat`) with commands that decompress to disk (like `gzip -d` or `uncompress`), or they mistakenly think `tar -xzf` only displays the archive contents when it actually extracts them.

Practice this question →
25
MCQmedium

Refer to the exhibit. What will be the default permissions of a newly created file using the touch command?

A.-rw-r--r--
B.-rw-rw-rw-
C.-rwxr-xr-x
D.-rw-rw-r--
AnswerA

Correct: 666 - 022 = 644, giving owner read/write, group read, others read.

Why this answer

The `touch` command creates a file with default permissions determined by the current umask value. On most Linux systems, the default umask is 0022, which subtracts write permissions for group and others from the base permissions of 0666 (rw-rw-rw-), resulting in 0644 (rw-r--r--). Thus, option A is correct.

Exam trap

The trap here is that candidates often confuse the base permissions (0666) with the final permissions, forgetting to apply the umask, or they mistakenly think touch sets execute bits like a directory creation would.

How to eliminate wrong answers

Option B is wrong because -rw-rw-rw- (0666) would require a umask of 0000, which is not the default; it represents the base permissions before umask is applied. Option C is wrong because -rwxr-xr-x (0755) is a typical permission set for directories or executable files, not for a new file created by touch, which never sets execute bits by default. Option D is wrong because -rw-rw-r-- (0664) would result from a umask of 0002, common in some environments but not the default umask of 0022 on most Linux distributions.

Practice this question →
26
Multi-Selecthard

Which THREE of the following are valid symbolic mode expressions for the chmod command?

Select 3 answers
A.u+x
B.755
C.a+rwx
D.c+r
E.g-w
AnswersA, C, E

Adds execute permission for the user.

Why this answer

'u+x' is a valid symbolic mode expression for chmod, where 'u' stands for the user (owner), '+' adds a permission, and 'x' is the execute permission. This syntax follows the POSIX standard for symbolic modes, allowing precise modification of file permissions without specifying an absolute octal value.

Exam trap

The trap here is that candidates may confuse numeric (octal) modes with symbolic modes, or assume that any single-letter class like 'c' is valid, when only u, g, o, and a are recognized by the chmod command.

Practice this question →
27
MCQhard

A web server runs Apache and generates extensive access logs. To conserve disk space, an administrator sets up a cron job that runs nightly at 2:00 AM. The job executes a shell script located at /usr/local/bin/rotate_logs.sh. The script is intended to find all .log files in /var/log/apache2/ that are older than 7 days, compress them with gzip, and move the compressed files to /var/log/archive/. However, after several days, the administrator notices that the /var/log partition is nearly full and the logs are not being compressed. The cron log shows the job ran at the scheduled time but produced no terminal output (stdout or stderr). The script itself contains no explicit echo statements or error handling. The administrator has root access and wants to diagnose the problem without disrupting the running web server. Which of the following is the most appropriate first step to identify the failure?

A.Run the script manually with 'bash -x /usr/local/bin/rotate_logs.sh' to observe command execution.
B.Use 'ps -ef | grep compress' to check if the cron job spawned any child processes.
C.Check the file permissions of the archive directory with 'ls -ld /var/log/archive'.
D.Review the system logs in /var/log/syslog for any entries related to gzip or the script.
AnswerA

The -x flag shows each command as it runs, exposing any errors.

Why this answer

Running the script with 'bash -x' enables execution tracing, which prints each command and its arguments as they are executed. This will reveal exactly where the script fails—whether due to a missing file, permission error, or incorrect path—without modifying the script or disrupting the running web server. Since the cron job produced no output, the script likely encountered a silent failure, and 'bash -x' is the most direct way to diagnose it.

Exam trap

The trap here is that candidates may jump to checking permissions or system logs because they assume a permission or system-level error, but the most efficient first step is to reproduce the script's execution with tracing enabled to see exactly what commands run and where they fail.

How to eliminate wrong answers

Option B is wrong because 'ps -ef | grep compress' only checks for currently running processes named 'compress'; the cron job has already finished, so no child processes would exist, and this does not help diagnose why the script failed. Option C is wrong because checking permissions of /var/log/archive is a secondary step; the script may fail before even attempting to move files (e.g., due to a missing source directory or incorrect find command), and permissions alone cannot reveal the root cause of a silent failure. Option D is wrong because reviewing system logs like /var/log/syslog may show gzip-related errors only if the script actually ran gzip and logged errors; since the script has no error handling and produced no output, there may be no relevant entries, making this an inefficient first step.

Practice this question →
28
MCQmedium

You are a Linux administrator for a company that runs a web server on a system with limited disk space. The web server logs are stored in /var/log/httpd/access_log and grow quickly. The operations team requires that the most recent logs be available for troubleshooting, but logs older than 7 days must be compressed to save space. You decide to implement log rotation using logrotate. The logrotate configuration file for httpd currently contains: /var/log/httpd/*.log { daily rotate 7 compress delaycompress missingok notifempty sharedscripts postrotate /bin/systemctl reload httpd 2>/dev/null || true endscript } After applying this configuration, you notice that log files are being compressed immediately instead of after one rotation. What is the most likely cause and the correct step to fix this?

A.Remove the 'sharedscripts' directive to ensure the postrotate script runs for each log file individually.
B.Change the rotation frequency to 'weekly' so that the most recent week's logs remain uncompressed and older logs are compressed.
C.Remove the 'delaycompress' directive to ensure compression occurs at each rotation.
D.Add the 'copytruncate' directive to avoid moving the log file, allowing the web server to continue writing to the same file.
AnswerB

With weekly rotation, the most recent rotated log (one week old) remains uncompressed due to delaycompress, while older logs are compressed, meeting the requirement of compressing logs older than 7 days.

Why this answer

The issue is that with daily rotation, the delaycompress directive delays compression by only one rotation (one day). This means that rotated logs are compressed after one day, not after the desired 7 days. To meet the requirement that logs older than 7 days are compressed, the rotation frequency should be changed to weekly.

With weekly rotation, delaycompress delays compression by one week, so logs younger than 7 days remain uncompressed and the most recent week's logs are available for troubleshooting.

Exam trap

The trap here is that candidates may misinterpret 'delaycompress' as causing immediate compression, when in fact it delays compression by one rotation, and the issue is actually the rotation frequency being too short relative to the retention period.

How to eliminate wrong answers

Option A is wrong because 'sharedscripts' is not related to compression timing; it controls whether the postrotate script runs once for all logs or per log file. Option C is wrong because removing 'delaycompress' would cause compression to occur at each rotation, which is the opposite of the desired behavior (logs older than 7 days should be compressed, not the most recent). Option D is wrong because 'copytruncate' is used when the application cannot be signaled to close and reopen its log file; it does not affect compression timing and would not solve the immediate compression issue.

Practice this question →
29
MCQhard

Refer to the exhibit. The system fails to boot with an error 'UUID=e5f6g7h8 not found'. Which is the most likely cause?

A.The fstab entry for /boot is incorrect.
B.The root filesystem is corrupted.
C.The initramfs does not contain the necessary filesystem modules.
D.The disk order changed, so /dev/sda2 is no longer the correct device.
AnswerC

If the initramfs lacks the driver for the root filesystem, the UUID cannot be resolved.

Why this answer

The error 'UUID=e5f6g7h8 not found' indicates that the kernel, during early boot, cannot locate a device with that UUID. This typically occurs when the initramfs (initial RAM filesystem) lacks the necessary kernel modules (e.g., for the storage controller or filesystem driver) to access the root device. The initramfs is responsible for loading these modules before mounting the real root filesystem; if it is missing or incomplete, the kernel cannot resolve the UUID and fails to boot.

Exam trap

The trap here is that candidates often confuse a missing UUID error with a corrupted filesystem or incorrect fstab entry, but the error occurs before the root filesystem is mounted, making it a kernel/initramfs issue rather than a filesystem or configuration problem.

How to eliminate wrong answers

Option A is wrong because the fstab entry for /boot is not involved in the UUID lookup during early boot — the error occurs before the root filesystem is mounted, and fstab is processed later by the init system. Option B is wrong because a corrupted root filesystem would typically produce a different error (e.g., 'mount: /: can't read superblock' or I/O errors), not a 'UUID not found' message, which points to a missing device rather than filesystem damage. Option D is wrong because if the disk order changed, the kernel would still find the device by its UUID (which is persistent and independent of device names like /dev/sda2); the error specifically says the UUID is not found, meaning the device itself is inaccessible, not that its name changed.

Practice this question →
30
MCQhard

Refer to the exhibit. An administrator needs to edit /etc/example.conf to change setting1 to 'production' and add a new line 'setting2=value' after the include line. The file must be edited in place without creating a backup. Which command sequence achieves this?

A.sed -i 's/setting1=default/setting1=production/' /etc/example.conf; sed -i '/^include /a\nsetting2=value' /etc/example.conf
B.sed -i 's/setting1=default/setting1=production/' /etc/example.conf; sed -i '/^include /i\nsetting2=value' /etc/example.conf
C.sed -i.bak 's/setting1=default/setting1=production/' /etc/example.conf; sed -i.bak '/^include /a\nsetting2=value' /etc/example.conf
D.sed -i.bak 's/setting1=default/setting1=production/' /etc/example.conf; sed -i.bak '/^include /a\nsetting2=value' /etc/example.conf
AnswerA

Correct: -i without argument edits in place; first command changes the setting; second appends after the include line.

Why this answer

The first sed command uses the -i flag to edit the file in place without a backup, and the substitution 's/setting1=default/setting1=production/' changes the existing setting. The second sed command uses the 'a' (append) command after the line matching '^include ' to add the new line 'setting2=value' after it, also with -i to avoid creating a backup.

Exam trap

The trap here is that candidates often confuse the 'a' (append) and 'i' (insert) sed commands, or overlook the requirement to avoid backups by choosing options with -i.bak instead of plain -i.

How to eliminate wrong answers

Option B is wrong because it uses the 'i' (insert) command instead of 'a' (append), which would add the new line before the include line, not after it as required. Option C is wrong because it uses '-i.bak' which creates a backup file with a .bak extension, violating the requirement to edit in place without creating a backup. Option D is wrong for the same reason as Option C — it uses '-i.bak' to create backups, and also uses the correct 'a' command but still fails the no-backup requirement.

Practice this question →
31
MCQmedium

Refer to the exhibit. Which users are allowed to use the 'at' command?

A.No one
B.root and user1
C.All users except user2 and user3
D.Only root
AnswerB

If at.allow exists, only users listed in it can use at.

Why this answer

The 'at' command is controlled by the /etc/at.allow and /etc/at.deny files. If /etc/at.allow exists, only users listed in it (plus root) can use 'at'. The exhibit shows /etc/at.allow contains 'root' and 'user1', so both are allowed.

If /etc/at.allow does not exist, /etc/at.deny is checked; but here the allow file takes precedence.

Exam trap

The key trap is that when /etc/at.allow exists, it takes precedence over /etc/at.deny entirely. Only users listed in the allow file (plus root) are permitted, regardless of any deny file. Many candidates mistakenly think that all users not in a deny list are allowed.

How to eliminate wrong answers

Option A is wrong because root and user1 are explicitly listed in /etc/at.allow, so some users are allowed. Option C is wrong because user2 and user3 are not in /etc/at.allow, and if /etc/at.allow exists, only users in that file (plus root) are permitted; user2 and user3 are denied, but the statement 'All users except user2 and user3' incorrectly implies all other users are allowed, which is false. Option D is wrong because user1 is also listed in /etc/at.allow, so not only root is allowed.

Practice this question →
32
Multi-Selecteasy

Which TWO of the following commands output the total number of lines in a file?

Select 2 answers
A.grep -c '.'
B.nl
C.head -n 1
D.sed -n '$='
E.wc -l
AnswersD, E

sed -n '$=' prints the line number of the last line, equivalent to the total line count.

Why this answer

The `sed -n '$='` command prints the line number of the last line of the file, which is equivalent to the total number of lines. The `wc -l` command counts the number of newline characters, which directly gives the total line count. Both commands output the total number of lines in a file.

Exam trap

The trap here is that candidates may think `grep -c '.'` counts all lines, but it actually excludes empty lines, while `nl` outputs numbered lines rather than a single total count.

Practice this question →
33
MCQhard

Refer to the exhibit. The remount command fails. What is the most likely cause?

A.The filesystem type is wrong.
B.The fstab entry lacks the 'noauto' option but the device is not currently mounted.
C.The filesystem is not mounted.
D.The mount point /data does not exist.
AnswerC

The filesystem is not mounted, and 'mount -o remount' requires the filesystem to be already mounted. This is the most likely cause of the failure.

Why this answer

The remount command fails because the filesystem is not mounted. 'mount -o remount' only works on filesystems that are already mounted. The lack of the 'noauto' option in the fstab entry is irrelevant; it only affects automatic mounting at boot and does not influence whether a remount can be performed on an unmounted filesystem. Candidates may incorrectly believe that the missing 'noauto' is the cause, but the real issue is that the filesystem needs to be mounted first.

Exam trap

The trap is that candidates may focus on the missing 'noauto' option and think it is the cause of the failure. In reality, the remount command requires the filesystem to be already mounted; the 'noauto' option is irrelevant to the remount operation's success.

How to eliminate wrong answers

Option A is wrong because the filesystem type is typically specified in the fstab entry and, if incorrect, would cause a different error (e.g., 'wrong fs type') rather than a remount failure due to an unmounted device. Option C is wrong because the filesystem is not mounted, which is the direct cause of the remount failure, but this is a symptom, not the root cause described in the fstab entry's missing 'noauto' option. Option D is wrong because if the mount point /data did not exist, the mount command would fail with a 'mount point does not exist' error, not a remount-specific failure.

Practice this question →
34
MCQhard

A developer wants to change the ownership of all files in a directory tree to the user 'www-data' and group 'www-data', but only files that are currently owned by user 'nobody'. Which command accomplishes this?

A.chown --from=nobody www-data:www-data /path
B.find /path -user nobody -exec chown www-data:www-data {} \;
C.chown -R --from=nobody www-data:www-data /path
D.chown -R www-data:www-data /path
AnswerC

Correctly uses recursive mode and the --from option to limit changes to files owned by nobody.

Why this answer

The `chown -R --from=nobody www-data:www-data /path` command recursively changes ownership of files and directories only if they are currently owned by the user 'nobody'. The `--from` option specifies the current owner (and optionally group) to match before applying the change, and `-R` ensures recursion into subdirectories. This exactly meets the requirement to change ownership only for files owned by 'nobody'.

Exam trap

The trap here is that candidates often forget the `-R` flag for recursion or overlook the `--from` option, leading them to choose a brute-force approach like `chown -R` (option D) that changes all files regardless of current ownership, or a more complex `find`-based solution (option B) that works but is not the most direct command tested.

How to eliminate wrong answers

Option A is wrong because it lacks the `-R` flag, so it only changes ownership of the top-level directory `/path` itself, not files within the directory tree. Option B is wrong because while it uses `find` to locate files owned by 'nobody' and executes `chown`, it does not use the `--from` option and would change ownership of all files found, but the command is syntactically correct; however, it is less efficient and not the single command the question expects, and the question asks for 'which command accomplishes this' with the implication of a direct `chown` approach. Option D is wrong because it changes ownership of all files in the directory tree to 'www-data:www-data' regardless of the current owner, not only those owned by 'nobody'.

Practice this question →
35
MCQhard

Refer to the exhibit. Which of the following is true about SSH access to this server?

A.User 'charlie' is denied access regardless of authentication method.
B.User 'alice' can authenticate using a password.
C.Password authentication is disabled for all users.
D.Root can log in with a password.
AnswerA

DenyUsers charlie explicitly denies access to user charlie.

Why this answer

The exhibit shows an SSH configuration with a `DenyUsers charlie` directive, which explicitly blocks user 'charlie' from any SSH access regardless of the authentication method (password, public key, etc.). This directive takes precedence over any other authentication settings, making option A correct.

Exam trap

The trap here is that candidates assume `PasswordAuthentication no` blocks all access, but `DenyUsers` is a separate, pre-authentication block that overrides other settings for specific users.

How to eliminate wrong answers

Option B is wrong because the configuration includes `PasswordAuthentication no`, which disables password-based login for all users, including 'alice'. Option C is wrong because while password authentication is disabled, other methods like public key authentication may still be allowed, so it is not disabled for all users in the sense of total SSH access. Option D is wrong because `PermitRootLogin no` explicitly prevents root from logging in via SSH, regardless of authentication method.

Practice this question →
36
MCQmedium

A developer is troubleshooting a shell script that uses the variable $HOME but it outputs nothing when the script runs. The script is executed with ./script.sh from an interactive shell. What is the most likely cause?

A.The script is run with sh instead of bash
B.The script is run with sudo
C.The HOME variable is not exported
D.The user has no home directory
AnswerD

If the user has no home directory, the HOME variable may not be set or may be empty, leading to no output when referenced in a script. This is the most likely cause among the options.

Why this answer

In an interactive shell, the HOME variable is typically exported by the login process and inherited by child processes. The most likely cause for $HOME being empty is that the user has no home directory defined in the password database (or the directory doesn't exist), which can cause the variable to be empty or unset in some configurations. Options A and B would not cause $HOME to be empty; using sh instead of bash or running with sudo would still provide a HOME value (possibly different) or set it to root's home.

Exam trap

Candidates often mistakenly think HOME must be exported, but in interactive shells it is already exported. The real pitfall is that a missing home directory entry can leave HOME unset.

How to eliminate wrong answers

Option A is wrong because running with sh instead of bash does not affect the HOME variable; HOME is a standard environment variable set by the system regardless of the shell. Option B is wrong because running with sudo does not clear HOME by default; sudo preserves the HOME variable unless explicitly configured with env_reset or the -H flag. Option D is wrong because if the user had no home directory, the HOME variable would still be set to the default (e.g., /) or the system would assign a fallback; the variable would not be empty.

Practice this question →
37
MCQeasy

A user reports that when they run 'ls -l' in their home directory, they see files but all files have permissions like '-rwxrwxrwx', which is unexpected. The system administrator checks and finds that the user's umask is set to 000. The user wants all new files to be created with default permissions of -rw-r--r-- (644) and directories that are drwxr-xr-x (755). What should the user set their umask to?

A.007
B.022
C.002
D.027
AnswerB

022 gives files 644 and directories 755.

Why this answer

The umask is a three-digit octal value that is subtracted from the default base permissions (666 for files, 777 for directories) to determine the default permissions for newly created files and directories. To achieve file permissions of 644 (rw-r--r--) and directory permissions of 755 (rwxr-xr-x), the umask must be 022. This is because 666 - 022 = 644 for files, and 777 - 022 = 755 for directories.

Exam trap

The trap here is that candidates often mistakenly think the umask is added to or directly specifies the permissions, rather than understanding it is subtracted from the default base permissions (666 for files, 777 for directories).

How to eliminate wrong answers

Option A (007) is wrong because it would result in file permissions of 660 (rw-rw----) and directory permissions of 770 (rwxrwx---), which are too restrictive for the desired 644/755. Option C (002) is wrong because it would yield file permissions of 664 (rw-rw-r--) and directory permissions of 775 (rwxrwxr-x), giving group write access, which is not the requested 644/755. Option D (027) is wrong because it would produce file permissions of 640 (rw-r-----) and directory permissions of 750 (rwxr-x---), which are too restrictive for both files and directories.

Practice this question →
38
MCQmedium

Refer to the exhibit. What is the expected outcome of the kill command?

A.Only the parent process (PID 12345) is terminated.
B.Only child processes are restarted.
C.The parent process reloads its configuration, and child processes continue serving.
D.All httpd processes are terminated immediately.
AnswerC

SIGHUP tells Apache to reload configuration without stopping.

Why this answer

The kill command with SIGHUP (signal 1) sent to the parent httpd process (PID 12345) instructs the parent to reload its configuration files and gracefully restart its child worker processes. This is the standard behavior for Apache httpd and many other daemons: the parent process rereads configuration, spawns new children, and terminates old ones without dropping existing connections.

Exam trap

A common misconception is that SIGHUP always terminates a process, when in fact it is the standard signal for daemon configuration reloads and graceful restarts.

How to eliminate wrong answers

Option A is wrong because sending SIGHUP to the parent process does not terminate it; instead, it triggers a graceful reload. Option B is wrong because child processes are not restarted independently; they are replaced by new children after the parent reloads configuration. Option D is wrong because SIGHUP does not immediately terminate all httpd processes; that would require SIGTERM (signal 15) or SIGKILL (signal 9).

Practice this question →
39
MCQhard

Refer to the exhibit. What type of traffic is being captured?

A.A successful TCP three-way handshake followed by a data transfer.
B.An incomplete TCP handshake.
C.An FTP session.
D.A DNS query and response.
AnswerA

Packets show SYN, SYN-ACK, ACK (handshake), then PUSH-ACK with data.

Why this answer

The exhibit shows a TCP three-way handshake (SYN, SYN-ACK, ACK) followed by a data transfer segment (PSH, ACK). This sequence indicates a successful connection establishment and subsequent data exchange, which matches the description of a successful TCP three-way handshake followed by data transfer.

Exam trap

The trap here is that candidates may confuse a successful TCP handshake with an incomplete one by overlooking the final ACK, or they may misinterpret the PSH flag as application-layer protocol traffic (like FTP or DNS) without checking port numbers or protocol-specific payloads.

How to eliminate wrong answers

Option B is wrong because an incomplete TCP handshake would show only SYN and SYN-ACK (or SYN and RST) without the final ACK, but the exhibit includes the ACK completing the handshake. Option C is wrong because FTP uses TCP ports 20 and 21, and the exhibit does not show any FTP-specific commands (e.g., USER, PASS, RETR) or port numbers; it only shows generic TCP segments. Option D is wrong because DNS uses UDP (or TCP for zone transfers) on port 53, and the exhibit shows TCP segments with no DNS query/response structure (e.g., transaction IDs, question/answer sections).

Practice this question →
40
MCQmedium

Refer to the exhibit. Which statement is true about SSH root login on this server?

A.Root can log in only from localhost.
B.Root cannot log in at all.
C.Root can log in using a public key.
D.Root can log in with a password.
AnswerC

PermitRootLogin prohibit-password allows key-based login.

Why this answer

The exhibit shows that `PermitRootLogin` is set to `prohibit-password` in the SSH server configuration. This setting explicitly disables password-based authentication for root, but allows root login using public key authentication. Therefore, root can log in only by presenting a valid private key that matches an authorized public key, making option C correct.

Exam trap

The trap here is that candidates often misinterpret `prohibit-password` as a complete ban on root login, when in fact it only blocks password-based authentication and still allows key-based login.

How to eliminate wrong answers

Option A is wrong because `PermitRootLogin prohibit-password` does not restrict root to localhost; it only prohibits password authentication, not key-based authentication from any host. Option B is wrong because root can still log in using public key authentication, so a complete login ban is not in effect. Option D is wrong because `prohibit-password` explicitly disables password-based login for root, so root cannot log in with a password.

Practice this question →
41
MCQhard

A company runs a legacy application on a Linux server. The application fails to start after a reboot, claiming a 'cannot open shared object file' error. The system administrator checks the library path and finds that the required library is present in /usr/local/lib but the application cannot find it. The administrator has verified that the library file exists and is readable. Which of the following is the most likely cause and solution?

A.The library has insufficient execute permissions; add execute bit.
B.The application is setuid root and the library path is ignored; use $LD_LIBRARY_PATH.
C.The library path is not in /etc/ld.so.conf; run ldconfig after adding it.
D.The library is compiled for a different architecture; recompile the library.
AnswerC

ldconfig updates the linker cache to include paths from /etc/ld.so.conf.

Why this answer

The dynamic linker/loader (ld.so) uses the cache file /etc/ld.so.cache to resolve shared library dependencies at runtime. Although the library exists in /usr/local/lib, that path is not listed in /etc/ld.so.conf (or a file included by it), so the linker never scans it. Running ldconfig rebuilds the cache and makes the library discoverable, which resolves the 'cannot open shared object file' error.

Exam trap

The trap here is that candidates assume a library found in a standard-looking path like /usr/local/lib is automatically searched, but the dynamic linker only uses paths explicitly listed in /etc/ld.so.conf (or its included files) after running ldconfig.

How to eliminate wrong answers

Option A is wrong because shared object files require read permission, not execute permission, for the dynamic linker to load them; execute permission is irrelevant for libraries. Option B is wrong because setuid binaries do ignore LD_LIBRARY_PATH for security reasons, but the proper solution is to add the path to /etc/ld.so.conf and run ldconfig, not to rely on LD_LIBRARY_PATH which is insecure and not persistent. Option D is wrong because a library compiled for a different architecture would cause a different error (e.g., 'wrong ELF class' or 'cannot load shared object file: No such file or directory' due to ABI mismatch), not a simple 'cannot open' error when the file exists and is readable.

Practice this question →
42
MCQeasy

A systems administrator needs to find all files in /var/log that were modified in the last 24 hours and contain the word 'error'. Which command accomplishes this?

A.grep -r 'error' /var/log -mtime 0
B.find /var/log -mtime 0 -exec grep -l 'error' {} \;
C.find /var/log -mmin 1440 -exec grep 'error' {}
D.ls -l /var/log | grep error
AnswerB

Correctly uses find to filter by modification time and grep to search content.

Why this answer

It uses `find` with `-mtime 0` to locate files modified within the last 24 hours, then pipes each found file to `grep -l` to print only filenames containing 'error'. The `-exec` option runs `grep` on each file individually, and `-l` ensures only matching filenames are output, not the matching lines.

Exam trap

The trap here is that candidates often confuse `grep` options with `find` options (like `-mtime`) or forget that `grep` alone cannot filter by file modification time, leading them to choose Option A or C without recognizing the missing `-l` flag or syntax errors.

How to eliminate wrong answers

Option A is wrong because `grep -r` recursively searches file contents but does not filter by modification time; `-mtime 0` is not a valid `grep` option (it belongs to `find`), so the command would fail or behave unexpectedly. Option C is wrong because `-mmin 1440` correctly finds files modified in the last 1440 minutes (24 hours), but `-exec grep 'error' {}` lacks the `-l` flag, causing it to print matching lines instead of filenames, and it does not use `+` or `;` correctly (missing `\;` or `+`), which may lead to syntax errors or unintended behavior. Option D is wrong because `ls -l /var/log | grep error` only lists filenames in `/var/log` that contain 'error' in their name (or metadata line), not files whose content contains the word 'error', and it ignores modification time filtering entirely.

Practice this question →
43
MCQeasy

An administrator wants to change the ownership of a file to user 'jane' and group 'staff'. Which command should be used?

A.chown jane.staff file
B.chgrp jane staff file
C.chown jane:staff file
D.chown jane staff file
AnswerC

Correct syntax: user:group.

Why this answer

The `chown` command with the syntax `chown user:group file` changes both the user and group ownership of a file in a single command. This is the standard POSIX syntax, where a colon separates the user and group names, allowing the administrator to set ownership to user 'jane' and group 'staff' atomically.

Exam trap

The trap here is that candidates often confuse the colon (:) with a period (.) as the separator, or incorrectly assume that `chown` can accept two separate arguments for user and group, leading them to choose option A or D instead of the correct colon syntax.

How to eliminate wrong answers

Option A is wrong because `chown jane.staff file` uses a period (dot) as a separator, which is an obsolete and non-portable syntax; modern systems interpret the dot as part of the username, not as a user:group delimiter, and may fail or produce unexpected results. Option B is wrong because `chgrp jane staff file` is invalid syntax—`chgrp` changes only the group, and its correct usage is `chgrp group file`; passing two arguments (jane and staff) before the file name is incorrect and will cause a command error. Option D is wrong because `chown jane staff file` treats 'staff' as a second file argument, not as a group; `chown` expects either a user alone or a user:group pair, so this will attempt to change ownership to user 'jane' on two files ('staff' and 'file'), which is not the intended operation.

Practice this question →

Ready to test yourself?

Try a timed practice session using only GNU and Unix Commands questions.

Start 20-question session