Hard Difficulty Questions

sed -i 's/^staff:.*/&jdoe/' /etc/group

Why it fails: This sed substitution matches the staff line and appends jdoe without touching admin, and editing /etc/group directly bypasses the account database, leaving no admin membership and risking corruption. It is tempting as a quick text edit, but usermod -aG updates group membership through the proper system interface.

usermod -G staff,admin jdoe

Why it fails: usermod -G replaces the entire supplementary group list, so jdoe's existing memberships are discarded — contradicting the requirement to preserve them. The -a (append) flag is needed alongside -G. It is tempting because usermod is the correct tool for modifying an existing account's group membership.

useradd -G staff,admin jdoe

Why it fails: useradd creates new accounts; run against an existing 'jdoe' it fails, so memberships are never modified. It is tempting because -G lists supplementary groups, but that flag only applies at account creation. usermod -aG is required to append groups to an existing user.

blkid /dev/sda

Why it fails: Incorrect: blkid shows filesystem UUID, not partition GUID.

lsblk -f /dev/sda

Why it fails: Incorrect: lsblk shows block devices but not partition type GUIDs.

fdisk -l /dev/sda

Why it fails: Incorrect: fdisk does not support GPT partition UUID display.

Use parted to resize the root partition and then mount it

Why it fails: Resizing the partition with parted does not grow the filesystem itself, and remounting does not resize it; resize2fs must run afterwards. It is tempting because parted is the correct tool for manipulating the partition table when extending a partition into adjacent unallocated space.

Use fdisk to increase the size of /dev/sda1 and then run resize2fs

Why it fails: fdisk writes the partition table but does not inform the running kernel of the new size, so resize2fs would still see the old block device size; partprobe or a reboot is required first. It is tempting because fdisk plus resize2fs is the correct sequence for growing a partition on a disk with free space.

Create a new filesystem on /dev/sda2 and mount it to /

Why it fails: Creating a fresh filesystem on /dev/sda2 and mounting it at / would discard the existing root data and cannot extend the current filesystem in place. It is tempting because adding a separate partition is the correct approach when you need extra storage mounted at a new mount point, such as /data.

The /data mount point does not exist.

Why it fails: If the mount point were missing, the error would be 'mount point does not exist'.

The device /dev/sda1 is not formatted with ext4.

Why it fails: The exhibit does not indicate filesystem type; mount would fail with 'wrong fs type' if that were the case.

The UUID in the fstab entry is incorrect.

Why it fails: The UUID matches the symlink name, so it is likely correct.

set -e

Why it fails: set -e alone aborts the script on command failure but prints nothing; the required tracing comes from set -x. It is tempting because -e is the standard errexit idiom, yet the question demands both behaviours, so set -ex (or set -e plus set -x) is needed.

set -vx

Why it fails: The -v flag prints shell input lines as read, and -x traces expanded commands, but neither aborts execution on failure; that requires -e. Verbose and xtrace options are for debugging script flow, which is the scenario where set -vx would be chosen.

set -ux

Why it fails: The -u flag errors on unset variables and -x traces commands, yet neither terminates the script when a command returns non-zero; only -e does that. Unset-variable checking plus tracing suits scripts where undefined variables are the main hazard, not command failure.

The NTP service is not running.

Why it fails: If ntpd were stopped, ntpq would fail to query the daemon and report no peers at all, rather than listing a peer at stratum 16. The stratum 16 entry shows the daemon is running but the peer is unreachable or unsynchronised, so this misreads the exhibit.

The firewall is blocking UDP port 123.

Why it fails: A blocked UDP port 123 would leave the peer unreachable, yet ntpq would still display the configured peer with stratum 16 and zero values, so this is superficially consistent. However, the exhibit's specific pattern points to the peer being rejected as unsynchronised rather than silently filtered.

The restrict lines are blocking all NTP queries.

Why it fails: Restrict lines govern which hosts may query or modify the local daemon; they do not set a remote peer's stratum to 16. Blocking queries would prevent ntpq itself from returning data, so this misattributes a peer synchronisation failure to local access-control configuration.

iptables -A INPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j DROP

Why it fails: The -d match with -j DROP discards traffic destined for the subnet, which is inverted: the rule must match source addresses and accept them. Correct filtering uses -s 192.168.1.0/24 with -j ACCEPT. Destination matching suits rules protecting a specific host or subnet.

iptables -A OUTPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j ACCEPT

Why it fails: This matches outbound traffic leaving the host, not inbound connections reaching port 3306; the INPUT chain governs traffic destined for the local server. It is tempting because OUTPUT rules with a destination subnet are valid syntax, and would be correct for restricting which remote hosts a local client may connect to.

iptables -A OUTPUT -p tcp --sport 3306 -s 192.168.1.0/24 -j ACCEPT

Why it fails: Specifying --sport 3306 on OUTPUT filters replies sent from the server's source port, not incoming client connections; INPUT with --dport 3306 is required. It is tempting because source-port matching is legitimate for stateful reply filtering, and would suit rules permitting return traffic from an established database session.

It remains the same.

Why it fails: Restarting sshd stops the running daemon and starts a new process, so the kernel allocates a fresh PID rather than preserving the old one. The claim tempts because reloading configuration with SIGHUP keeps the same main PID, which is the correct approach when only sshd_config changes need applying.

1235

Why it fails: Restarting sshd spawns a fresh process, so the new main PID cannot match the pre-restart value; systemd assigns a new PID at each start. 1235 is tempting because it is the PID shown in the exhibit before the restart, and reading the current main PID with `systemctl status sshd` would be correct if no restart had occurred.

1234

Why it fails: A restart terminates the old sshd process and launches a fresh one, so the main PID cannot be a value carried over from the previous instance; 1234 is simply the pre-restart PID shown in the exhibit. Reading the stale exhibit value is tempting, but systemd assigns a new PID on each start.

dpkg -i --force-depends

Why it fails: dpkg -i --force-depends installs a named .deb while ignoring dependency failures, leaving packages unpacked rather than configuring them. It suits forcing a single stubborn package, not repairing the whole system; apt-get -f install is what configures unpacked packages and resolves dependencies.

apt-get autoremove

Why it fails: apt-get autoremove deletes packages installed as dependencies that are no longer required, which can worsen a partial installation by removing needed libraries. It suits routine cleanup after upgrades, not repairing dependencies; apt-get -f install is the command that configures unpacked packages.

apt-get clean

Why it fails: apt-get clean only deletes cached .deb files from /var/cache/apt/archives, freeing disk space; it never touches package state. It is the right choice when the cache is corrupt or full, but it cannot configure unpacked packages or resolve broken dependencies.

The kernel image is not found in /boot.

Why it fails: Incorrect. A missing kernel image would cause a boot failure after GRUB has loaded, not a fallback to the rescue shell.

The BIOS cannot find a bootable device.

Why it fails: Incorrect. If the BIOS cannot find a bootable device, GRUB is never loaded, so no rescue shell is entered.

The initramfs is missing or corrupt.

Why it fails: Incorrect. A missing or corrupt initramfs causes a kernel panic after the kernel is loaded, not a rescue shell fallback.

The /boot/grub/grub.cfg file is missing or corrupt.

Why it fails: Incorrect. A missing or corrupt grub.cfg triggers the GRUB normal shell (command-line prompt), not the rescue shell.

An incomplete TCP handshake.

Why it fails: The handshake completes with the third ACK.

An FTP session.

Why it fails: FTP uses ports 20/21, not 80.

A DNS query and response.

Why it fails: The destination port 80 indicates HTTP, not DNS (53).

Add the internal hostnames to /etc/hosts.

Why it fails: Static hosts entries bypass DNS entirely and cannot resolve arbitrary internal names or respect the internal server's records. It is tempting for a handful of fixed hostnames, where a local override is genuinely appropriate, but it does not assign the internal DNS server to the interface.

Restart systemd-resolved service.

Why it fails: Restarting the service re-reads existing configuration but does not add a per-link DNS server, so the interface still lacks the internal resolver. It is tempting because restarts often clear stale state, and would be correct if the configuration were already correct but the daemon had not applied it.

Edit /etc/resolv.conf and add the internal DNS server.

Why it fails: Editing the symlinked file writes to a runtime-generated stub that systemd-resolved overwrites, and it cannot associate a server with a specific link. It is tempting because hand-editing resolv.conf is the classic fix on non-systemd hosts, where no resolver daemon manages the file.

Set the package version to a non-existent version in /etc/apt/preferences

Why it fails: Pointing the pin at a non-existent version makes APT treat the installed version as the only candidate, but it also blocks manual upgrades to any real version, defeating the requirement. It is used to freeze permanently. A Pin-Priority below 1000 with the installed version allows manual override.

Add the package to /etc/apt/preferences with Pin-Priority: 1000

Why it fails: Pin-Priority 1000 forces installation of that version, the opposite of holding it back, and would let APT upgrade the package automatically. Such high pins are used to mandate a specific version. Preventing automatic upgrades requires a priority below 1000, typically 1 or a negative value.

Remove the package from sources.list

Why it fails: Removing the package from sources.list prevents APT from finding any candidate version, so manual upgrades also become impossible. It is used to exclude an entire repository. The scenario requires holding only automatic upgrades while manual installation stays possible, which apt-mark hold or a preferences pin achieves.

dpkg -l package

Why it fails: dpkg -l lists installed packages and their versions from the local dpkg database, ignoring configured repositories entirely. It is tempting because it reports versions, but it shows what is installed, not the candidate available for upgrade; apt-cache policy or apt list displays the candidate.

apt-show-versions package

Why it fails: apt-show-versions reports installed versions and their distribution status, not the candidate version a repository would supply. It is tempting because it queries APT metadata, but it answers which release a package came from; apt-cache policy or apt list --upgradable shows the candidate.

apt-get -s install package

Why it fails: apt-get -s install simulates installation, showing what would be fetched and changed, but its output does not cleanly present the candidate version field. It is tempting because -s previews actions, yet apt-cache policy or apt list explicitly reports the candidate version from configured repositories.

The home directory does not exist

Why it fails: useradd without -m does not create the home directory, but login still succeeds with a warning and a default shell prompt. Missing home directories are common on minimal systems, making this a plausible but non-blocking cause.

The user's shell is not set

Why it fails: useradd assigns the default shell from /etc/default/useradd, so the shell is set unless explicitly overridden. A missing or invalid shell entry in /etc/passwd would block login, but this is not the default outcome of useradd.

The user is not in the sudoers file

Why it fails: Membership in the sudoers file governs privilege escalation via `sudo`, not authentication itself, so its absence cannot block a login. It is tempting because sudoers controls administrative access, and it would be the right answer if john could authenticate but was denied root commands.

Only messages with facility *.info are forwarded.

Why it fails: The facility is a wildcard, so every facility is matched; the priority after the dot sets the minimum severity, not a facility named info. It is tempting because the syntax places the priority after the dot, which reads like a facility filter if you misremember which side of the dot carries which field.

All syslog messages are forwarded via TCP to the server.

Why it fails: A single '@' forwards over UDP; TCP requires '@@'. The line therefore does not use TCP. It is tempting because forwarding to a remote syslog server is exactly what the line does, and TCP is often assumed for reliable delivery, but the transport is chosen solely by the '@' or '@@' prefix.

Only authentication-related messages are forwarded.

Why it fails: The selector's facility and priority determine which messages match; nothing in the line restricts forwarding to authentication services such as authpriv. It is tempting because authpriv logging is a common rsyslog use case, and a line naming a specific facility would indeed forward only those messages.

755

Why it fails: 755 is octal notation, not a symbolic mode expression. Symbolic modes combine who (u, g, o, a), an operator (+, -, =) and permissions (r, w, x). Octal would be the correct form when setting absolute permission bits directly rather than modifying existing ones.

c+r

Why it fails: c+r uses an invalid who value; symbolic modes accept only u, g, o and a before the operator. It would be correct if the intended class were others, written as o+r. The letter c denotes no permission class in chmod syntax, so the expression is rejected.

Configure RAID 0 across both disks to combine speed.

Why it fails: RAID 0 stripes data across both disks, so every read still touches the HDD and no file is pinned to the SSD; it also removes redundancy. It is tempting because striping improves throughput, but that is sequential bandwidth, not placing frequently accessed files on the faster device.

Use symbolic links to redirect file access to the SSD.

Why it fails: Symbolic links merely point specific paths at the SSD; they require manual per-file administration and never detect or relocate frequently accessed data automatically. They are tempting because they redirect access to chosen files, but that is static redirection, not filesystem-driven hot-file placement.

Use a union mount to overlay the SSD on top of the HDD.

Why it fails: A union mount overlays directories so writes land on the upper layer, but it does not classify or migrate frequently accessed files by access frequency. It is tempting because overlayfs can direct new writes to the SSD, yet that is write redirection, not hot-file placement.

Change the mount point to /mnt/data

Why it fails: Changing the mount point does not affect boot behavior.

Change the filesystem type to auto

Why it fails: Setting filesystem type to 'auto' does not handle missing device; it will still halt if not found.

Add the 'noauto' option

Why it fails: 'noauto' prevents automatic mounting at boot, but the administrator wants it mounted if available, not skipped entirely.

ext4

Why it fails: ext4 lacks native snapshot capability; snapshots require LVM or a volume manager beneath the filesystem, so it does not meet the stated requirement on its own. It is tempting because ext4 is a stable, well-supported default for general-purpose Linux volumes, which suits ordinary database storage without snapshot needs.

NTFS

Why it fails: NTFS is Microsoft's filesystem; Linux cannot mount it natively for a database workload, and it lacks the snapshot integration the scenario demands. It is tempting because NTFS supports snapshots via Volume Shadow Copy on Windows, where it would suit a Windows database host.

XFS

Why it fails: XFS offers high reliability and, via LVM or Btrfs-style tooling, snapshot support on a single large disk, matching the database requirement. It is tempting because XFS excels at large files and parallel I/O, but the question's snapshot emphasis points to a filesystem with native snapshotting.