Troubleshooting practice questions

Read the full DNS explanation →

Arrange the steps to troubleshoot a service that fails to start.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2hardmultiple choice

An administrator is troubleshooting a DNS issue. The command 'dig @8.8.8.8 example.com' returns a response, but 'host example.com' returns 'Host not found'. Which of the following is the most likely cause?

Trap 1: The network interface is down.

Would affect both commands.

Trap 2: The /etc/hosts file is corrupt.

Corrupt hosts file would affect both similarly.

Trap 3: The DNS server at 8.8.8.8 is not responding.

But dig succeeded, so it is responding.

A
The network interface is down.
Why wrong: Would affect both commands.
B
The /etc/hosts file is corrupt.
Why wrong: Corrupt hosts file would affect both similarly.
C
The DNS server at 8.8.8.8 is not responding.
Why wrong: But dig succeeded, so it is responding.
D
The /etc/resolv.conf file is misconfigured.
'host' uses local resolver, which may have wrong DNS servers.

Question 3mediummultiple choice

A technician is troubleshooting a system that fails to boot with the error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. What is the most likely cause?

Trap 1: The init binary is missing or corrupted.

This error occurs after init is started.

Trap 2: The root filesystem is corrupted and needs fsck.

Corruption would produce a different error, not 'unknown-block'.

Trap 3: The boot loader is not installed correctly.

MBR issues appear before kernel loading.

A
The init binary is missing or corrupted.
Why wrong: This error occurs after init is started.
B
The root filesystem is corrupted and needs fsck.
Why wrong: Corruption would produce a different error, not 'unknown-block'.
C
The kernel lacks the necessary driver for the storage controller.
Kernel cannot access the root device due to missing storage driver.
D
The boot loader is not installed correctly.
Why wrong: MBR issues appear before kernel loading.

Question 4mediummultiple choice

A Linux administrator is troubleshooting a package dependency issue. When attempting to install package 'foo', the package manager reports a missing dependency 'libbar.so.2'. Which of the following is the most appropriate next step?

Trap 1: Run 'ldconfig' to update the library cache

ldconfig does not install missing libraries.

Trap 2: Reinstall the 'foo' package using 'rpm -i --force foo.rpm'

Force install may break the system.

Trap 3: Run 'rpm -q --whatrequires libbar.so.2'

Shows packages requiring the library, not providing it.

A
Run 'ldconfig' to update the library cache
Why wrong: ldconfig does not install missing libraries.
B
Reinstall the 'foo' package using 'rpm -i --force foo.rpm'
Why wrong: Force install may break the system.
C
Run 'rpm -q --whatrequires libbar.so.2'
Why wrong: Shows packages requiring the library, not providing it.
D
Use 'apt-file search libbar.so.2' or 'dnf provides libbar.so.2' to find the package that contains the file
Identifies the package providing the missing library.

Question 5mediummatching

Match each networking tool to its primary use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Test network connectivity to a host

Display network connections, routing tables, etc.

Capture and analyze network packets

Query DNS for domain name or IP

Configure network interfaces and routing

Question 6easymultiple choice

A system administrator is troubleshooting a Linux server that fails to boot. The server has a software RAID 1 configuration using mdadm, with the root filesystem located on /dev/md0. During boot, the system halts with the following error: 'VFS: Unable to mount root fs on unknown-block(0,0)'. The admin verifies that the BIOS recognizes all disks and that the RAID array was properly assembled prior to the last shutdown. The system was working after a recent kernel update, but now fails. Which of the following actions is the most likely solution?

Trap 1: Use a live CD to run fsck on /dev/md0.

The device /dev/md0 may not be available in the initramfs; fsck cannot be run on an unmountable device.

Trap 2: Check the /etc/fstab file for incorrect root device.

/etc/fstab is only read after the root filesystem is mounted; the error occurs before that.

Trap 3: Reinstall the bootloader on the MBR.

The bootloader is functioning as it loads the kernel; reinstalling it does not address the missing root device.

A
Use a live CD to run fsck on /dev/md0.
Why wrong: The device /dev/md0 may not be available in the initramfs; fsck cannot be run on an unmountable device.
B
Rebuild the initramfs to include the mdadm module and the RAID metadata.
Rebuilding the initramfs adds the necessary RAID support, allowing the kernel to assemble and mount /dev/md0.
C
Check the /etc/fstab file for incorrect root device.
Why wrong: /etc/fstab is only read after the root filesystem is mounted; the error occurs before that.
D
Reinstall the bootloader on the MBR.
Why wrong: The bootloader is functioning as it loads the kernel; reinstalling it does not address the missing root device.

Question 7mediummultiple choice

A developer is troubleshooting a shell script that uses the variable $HOME but it outputs nothing when the script runs. The script is executed with ./script.sh from an interactive shell. What is the most likely cause?

Trap 1: The script is run with sh instead of bash

HOME is usually set in sh as well.

Trap 2: The script is run with sudo

sudo may preserve HOME depending on configuration, but it's not the most likely cause.

Trap 3: The user has no home directory

All users typically have a home directory.

A
The script is run with sh instead of bash
Why wrong: HOME is usually set in sh as well.
B
The script is run with sudo
Why wrong: sudo may preserve HOME depending on configuration, but it's not the most likely cause.
C
The HOME variable is not exported
Variables must be exported to be available in child processes; interactive shells export HOME, but scripts invoked with ./ may not inherit if the parent shell is non-interactive.
D
The user has no home directory
Why wrong: All users typically have a home directory.

Question 8hardmultiple choice

When troubleshooting a problem with a Debian package installation, an administrator wants to see which version of a package would be installed from the configured repositories. Which command displays the candidate version?

Trap 1: dpkg -l package

Shows installed version only.

Trap 2: apt-show-versions package

Shows all available versions but not the candidate.

Trap 3: apt-get -s install package

Simulates install, but does not list candidate explicitly.

A
dpkg -l package
Why wrong: Shows installed version only.
B
apt-show-versions package
Why wrong: Shows all available versions but not the candidate.
C
apt-get -s install package
Why wrong: Simulates install, but does not list candidate explicitly.
D
apt-cache policy package
Shows candidate version and priority.

Question 9hardmulti select

A system administrator is troubleshooting a package dependency issue on a Debian system. Which three commands can be used to display dependency information for a package? (Choose three.)

Trap 1: `dpkg --info curl.deb`

Displays info from a .deb file, not the installed package.

Trap 2: `apt-get check`

Checks for broken dependencies system-wide, not for a specific package.

A
`dpkg --info curl.deb`
Why wrong: Displays info from a .deb file, not the installed package.
B
`apt show curl`
Displays package details including dependencies.
C
`apt-cache depends curl`
Shows the dependency tree of a package.
D
`dpkg -s curl`
Shows the status and dependencies of the installed package.
E
`apt-get check`
Why wrong: Checks for broken dependencies system-wide, not for a specific package.

Read the full NAT/PAT explanation →

Question 10hardmultiple choice

A sysadmin is troubleshooting a connectivity issue between two servers in different subnets. The output of 'traceroute 192.168.2.10' shows packets reaching a router but not the destination. The router's firewall uses iptables. Which rule would prevent the traceroute from completing?

Trap 1: -A INPUT -i lo -j LOG

Logs loopback traffic, does not drop.

Trap 2: -A INPUT -p udp -j ACCEPT

Accepts all UDP, would not block traceroute.

Trap 3: -A INPUT -p tcp --dport 80 -j REJECT

Affects TCP port 80, not traceroute (UDP).

A
-A INPUT -i lo -j LOG
Why wrong: Logs loopback traffic, does not drop.
B
-A INPUT -p udp -j ACCEPT
Why wrong: Accepts all UDP, would not block traceroute.
C
-A INPUT -p tcp --dport 80 -j REJECT
Why wrong: Affects TCP port 80, not traceroute (UDP).
D
-A INPUT -p icmp --icmp-type port-unreachable -j DROP
Blocks ICMP Port Unreachable, which stops traceroute responses.

Review the full routing breakdown →

Question 11easymultiple choice

A technician is troubleshooting network connectivity. The server's IP is 192.168.1.10/24, and the gateway is 192.168.1.1. The server can ping the gateway but cannot ping 8.8.8.8. Which command is most appropriate to check if the default route is configured?

Trap 1: ifconfig eth0

Shows IP config, not routing.

Trap 2: ping 192.168.1.1

Pings gateway, but they already know gateway reachable.

Trap 3: arp -n

Shows ARP cache.

A
route -n
Shows routing table.
B
ifconfig eth0
Why wrong: Shows IP config, not routing.
C
ping 192.168.1.1
Why wrong: Pings gateway, but they already know gateway reachable.
D
arp -n
Why wrong: Shows ARP cache.

Question 12hardmultiple choice

A system administrator is troubleshooting a server where the /var partition is full, causing services to fail. The administrator deletes old log files in /var/log, but the available space does not increase. Which step should be taken next?

Trap 1: Run 'sync; echo 3 > /proc/sys/vm/drop_caches' to clear cache.

Clearing cache frees memory, not disk space.

Trap 2: Remount the /var partition with the 'noatime' option.

noatime reduces metadata updates but does not free space.

Trap 3: Run 'df -i' to check inode usage.

Inode exhaustion is a different issue; space is still consumed by open file handles.

A
Run 'sync; echo 3 > /proc/sys/vm/drop_caches' to clear cache.
Why wrong: Clearing cache frees memory, not disk space.
B
Remount the /var partition with the 'noatime' option.
Why wrong: noatime reduces metadata updates but does not free space.
C
Use 'lsof /var/log' to find processes holding deleted file handles, then restart those processes.
Deleted files remain until all file handles are closed; lsof identifies the processes.
D
Run 'df -i' to check inode usage.
Why wrong: Inode exhaustion is a different issue; space is still consumed by open file handles.

Question 13mediummultiple choice

A Linux administrator is troubleshooting a server that fails to boot with the error 'Give root password for maintenance (or press Control-D to continue)'. The root filesystem is on /dev/sda2, formatted as ext4. The administrator suspects a filesystem inconsistency. The server is in a remote data center and the administrator has console access via IPMI. Which of the following is the safest procedure to repair the filesystem?

Trap 1: At the maintenance prompt, run 'fsck /dev/sda2' and answer yes to…

Filesystem is mounted; running fsck on a mounted rw filesystem can cause corruption.

Trap 2: At the maintenance prompt, run 'fsck -y /dev/sda2' to force repair.

Filesystem is still mounted rw.

Trap 3: At the maintenance prompt, run 'fsck -a /dev/sda2' to automatically…

Same issue: filesystem is mounted.

A
At the maintenance prompt, run 'mount -o remount,ro /dev/sda2 /' then 'fsck -f /dev/sda2' and then 'reboot'.
Correct: remount read-only, then fsck, then reboot.
B
At the maintenance prompt, run 'fsck /dev/sda2' and answer yes to all prompts.
Why wrong: Filesystem is mounted; running fsck on a mounted rw filesystem can cause corruption.
C
At the maintenance prompt, run 'fsck -y /dev/sda2' to force repair.
Why wrong: Filesystem is still mounted rw.
D
At the maintenance prompt, run 'fsck -a /dev/sda2' to automatically repair.
Why wrong: Same issue: filesystem is mounted.

Question 14mediummultiple choice

You are a Linux administrator for a company that runs a web server on a system with limited disk space. The web server logs are stored in /var/log/httpd/access_log and grow quickly. The operations team requires that the most recent logs be available for troubleshooting, but logs older than 7 days must be compressed to save space. You decide to implement log rotation using logrotate. The logrotate configuration file for httpd currently contains:

/var/log/httpd/*.log { daily rotate 7 compress delaycompress missingok notifempty sharedscripts postrotate /bin/systemctl reload httpd 2>/dev/null || true endscript

After applying this configuration, you notice that log files are being compressed immediately instead of after one rotation. What is the most likely cause and the correct step to fix this?

Trap 1: Remove the 'sharedscripts' directive to ensure the postrotate…

The sharedscripts directive does not affect compression timing; it only controls when the postrotate script runs.

Trap 2: Remove the 'delaycompress' directive to ensure compression occurs…

Removing delaycompress would cause all rotated logs to be compressed immediately, including the most recent, which contradicts the requirement to keep recent logs uncompressed.

Trap 3: Add the 'copytruncate' directive to avoid moving the log file,…

copytruncate does not affect compression timing; it only changes how the log file is rotated.

A
Remove the 'sharedscripts' directive to ensure the postrotate script runs for each log file individually.
Why wrong: The sharedscripts directive does not affect compression timing; it only controls when the postrotate script runs.
B
Change the rotation frequency to 'weekly' so that the most recent week's logs remain uncompressed and older logs are compressed.
With weekly rotation, the most recent rotated log (one week old) remains uncompressed due to delaycompress, while older logs are compressed, meeting the requirement of compressing logs older than 7 days.
C
Remove the 'delaycompress' directive to ensure compression occurs at each rotation.
Why wrong: Removing delaycompress would cause all rotated logs to be compressed immediately, including the most recent, which contradicts the requirement to keep recent logs uncompressed.
D
Add the 'copytruncate' directive to avoid moving the log file, allowing the web server to continue writing to the same file.
Why wrong: copytruncate does not affect compression timing; it only changes how the log file is rotated.