Troubleshooting practice questions

A system administrator is troubleshooting a server where the /var partition is full, causing services to fail. The administrator deletes old log files in /var/log, but the available space does not increase. Which step should be taken next?

Trap 1: Run 'sync; echo 3 > /proc/sys/vm/drop_caches' to clear cache.

Clearing cache frees memory, not disk space.

Trap 2: Remount the /var partition with the 'noatime' option.

noatime reduces metadata updates but does not free space.

Trap 3: Run 'df -i' to check inode usage.

Inode exhaustion is a different issue; space is still consumed by open file handles.

A
Run 'sync; echo 3 > /proc/sys/vm/drop_caches' to clear cache.
Why wrong: Clearing cache frees memory, not disk space.
B
Remount the /var partition with the 'noatime' option.
Why wrong: noatime reduces metadata updates but does not free space.
C
Use 'lsof /var/log' to find processes holding deleted file handles, then restart those processes.
Deleted files remain until all file handles are closed; lsof identifies the processes.
D
Run 'df -i' to check inode usage.
Why wrong: Inode exhaustion is a different issue; space is still consumed by open file handles.

Question 2mediummultiple choice

A technician is troubleshooting a system that fails to boot with the error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. What is the most likely cause?

Trap 1: The init binary is missing or corrupted.

This error occurs after init is started.

Trap 2: The root filesystem is corrupted and needs fsck.

Corruption would produce a different error, not 'unknown-block'.

Trap 3: The boot loader is not installed correctly.

MBR issues appear before kernel loading.

A
The init binary is missing or corrupted.
Why wrong: This error occurs after init is started.
B
The root filesystem is corrupted and needs fsck.
Why wrong: Corruption would produce a different error, not 'unknown-block'.
C
The kernel lacks the necessary driver for the storage controller.
Kernel cannot access the root device due to missing storage driver.
D
The boot loader is not installed correctly.
Why wrong: MBR issues appear before kernel loading.

Review the full routing breakdown →

Question 3easymultiple choice

A technician is troubleshooting network connectivity. The server's IP is 192.168.1.10/24, and the gateway is 192.168.1.1. The server can ping the gateway but cannot ping 8.8.8.8. Which command is most appropriate to check if the default route is configured?

Trap 1: ifconfig eth0

Shows IP config, not routing.

Trap 2: ping 192.168.1.1

Pings gateway, but they already know gateway reachable.

Trap 3: arp -n

Shows ARP cache.

A
route -n
Shows routing table.
B
ifconfig eth0
Why wrong: Shows IP config, not routing.
C
ping 192.168.1.1
Why wrong: Pings gateway, but they already know gateway reachable.
D
arp -n
Why wrong: Shows ARP cache.

Question 4hardmulti select

A system administrator is troubleshooting a package dependency issue on a Debian system. Which three commands can be used to display dependency information for a package? (Choose three.)

Trap 1: `dpkg --info curl.deb`

Displays info from a .deb file, not the installed package.

Trap 2: `apt-get check`

Checks for broken dependencies system-wide, not for a specific package.

A
`dpkg --info curl.deb`
Why wrong: Displays info from a .deb file, not the installed package.
B
`apt show curl`
Displays package details including dependencies.
C
`apt-cache depends curl`
Shows the dependency tree of a package.
D
`dpkg -s curl`
Shows the status and dependencies of the installed package.
E
`apt-get check`
Why wrong: Checks for broken dependencies system-wide, not for a specific package.

Review the full subnetting walkthrough →

Question 5mediummultiple choice

A sysadmin notices that after modifying iptables rules, the SSH service is unreachable from a specific subnet (192.168.1.0/24). Which command should be used to view the current rules with line numbers for easier identification?

Trap 1: iptables -L

Shows rules but without line numbers.

Trap 2: iptables -t raw -L

Shows raw table, not relevant for SSH filtering.

Trap 3: iptables -t nat -L

Shows NAT table, not filter table for SSH.

A
iptables -L
Why wrong: Shows rules but without line numbers.
B
iptables -L --line-numbers
Shows rules with line numbers for easier editing.
C
iptables -t raw -L
Why wrong: Shows raw table, not relevant for SSH filtering.
D
iptables -t nat -L
Why wrong: Shows NAT table, not filter table for SSH.

Question 6mediumdrag order

Arrange the steps to troubleshoot a service that fails to start.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Examine configuration files, then check service status and logs,…

This is incorrect because you should first check the service status and logs to understand the error, rather than jumping directly to configuration files without knowing the symptoms.

Trap 2: Check service status and logs, then fix the issue, then examine…

This is incorrect because you should examine configuration files before fixing the issue, as the fix often involves correcting a misconfiguration. Fixing without proper investigation may not address the root cause.

Trap 3: Restart the service, then check service status and logs, then…

This is incorrect because restarting the service without diagnosing the problem is futile; you need to first understand why it failed, then apply a fix, then restart.

A
Check service status and logs, then examine configuration files, then fix the issue, then restart the service.
This is the correct order because you first need to diagnose the problem by checking status and logs, then examine configuration files for errors, apply a fix, and finally restart the service to apply changes.
B
Examine configuration files, then check service status and logs, then fix the issue, then restart the service.
Why wrong: This is incorrect because you should first check the service status and logs to understand the error, rather than jumping directly to configuration files without knowing the symptoms.
C
Check service status and logs, then fix the issue, then examine configuration files, then restart the service.
Why wrong: This is incorrect because you should examine configuration files before fixing the issue, as the fix often involves correcting a misconfiguration. Fixing without proper investigation may not address the root cause.
D
Restart the service, then check service status and logs, then examine configuration files, then fix the issue.
Why wrong: This is incorrect because restarting the service without diagnosing the problem is futile; you need to first understand why it failed, then apply a fix, then restart.

Question 7easymultiple choice

A system administrator is troubleshooting a Linux server that fails to boot. The server has a software RAID 1 configuration using mdadm, with the root filesystem located on /dev/md0. During boot, the system halts with the following error: 'VFS: Unable to mount root fs on unknown-block(0,0)'. The admin verifies that the BIOS recognizes all disks and that the RAID array was properly assembled prior to the last shutdown. The system was working after a recent kernel update, but now fails. Which of the following actions is the most likely solution?

Trap 1: Use a live CD to run fsck on /dev/md0.

The device /dev/md0 may not be available in the initramfs; fsck cannot be run on an unmountable device.

Trap 2: Check the /etc/fstab file for incorrect root device.

/etc/fstab is only read after the root filesystem is mounted; the error occurs before that.

Trap 3: Reinstall the bootloader on the MBR.

The bootloader is functioning as it loads the kernel; reinstalling it does not address the missing root device.

A
Use a live CD to run fsck on /dev/md0.
Why wrong: The device /dev/md0 may not be available in the initramfs; fsck cannot be run on an unmountable device.
B
Rebuild the initramfs to include the mdadm module and the RAID metadata.
Rebuilding the initramfs adds the necessary RAID support, allowing the kernel to assemble and mount /dev/md0.
C
Check the /etc/fstab file for incorrect root device.
Why wrong: /etc/fstab is only read after the root filesystem is mounted; the error occurs before that.
D
Reinstall the bootloader on the MBR.
Why wrong: The bootloader is functioning as it loads the kernel; reinstalling it does not address the missing root device.

Question 8mediummultiple choice

A Linux administrator is troubleshooting a server that fails to boot with the error 'Give root password for maintenance (or press Control-D to continue)'. The root filesystem is on /dev/sda2, formatted as ext4. The administrator suspects a filesystem inconsistency. The server is in a remote data center and the administrator has console access via IPMI. Which of the following is the safest procedure to repair the filesystem?

Trap 1: At the maintenance prompt, run 'fsck /dev/sda2' and answer yes to…

Filesystem is mounted; running fsck on a mounted rw filesystem can cause corruption.

Trap 2: At the maintenance prompt, run 'fsck -y /dev/sda2' to force repair.

Filesystem is still mounted rw.

Trap 3: At the maintenance prompt, run 'fsck -a /dev/sda2' to automatically…

Same issue: filesystem is mounted.

A
At the maintenance prompt, run 'mount -o remount,ro /dev/sda2 /' then 'fsck -f /dev/sda2' and then 'reboot'.
Correct: remount read-only, then fsck, then reboot.
B
At the maintenance prompt, run 'fsck /dev/sda2' and answer yes to all prompts.
Why wrong: Filesystem is mounted; running fsck on a mounted rw filesystem can cause corruption.
C
At the maintenance prompt, run 'fsck -y /dev/sda2' to force repair.
Why wrong: Filesystem is still mounted rw.
D
At the maintenance prompt, run 'fsck -a /dev/sda2' to automatically repair.
Why wrong: Same issue: filesystem is mounted.

Review the full routing breakdown →

Question 9easymulti select

Which TWO commands can be used to display the current routing table on a Linux system?

Trap 1: ss -r

Incorrect: ss -r shows routing table? Actually ss does not have -r; it shows socket statistics.

Trap 2: iptables -L

Incorrect: iptables -L lists firewall rules, not the routing table.

Trap 3: ifconfig -r

Incorrect: ifconfig does not have a -r option.

A
ss -r
Why wrong: Incorrect: ss -r shows routing table? Actually ss does not have -r; it shows socket statistics.
B
route -n
Correct: route -n displays the routing table in numeric format.
C
iptables -L
Why wrong: Incorrect: iptables -L lists firewall rules, not the routing table.
D
ifconfig -r
Why wrong: Incorrect: ifconfig does not have a -r option.
E
ip route show
Correct: ip route show displays the routing table.

Read the full DNS explanation →

Question 10hardmultiple choice

An administrator is troubleshooting a DNS issue. The command 'dig @8.8.8.8 example.com' returns a response, but 'host example.com' returns 'Host not found'. Which of the following is the most likely cause?

Trap 1: The network interface is down.

Would affect both commands.

Trap 2: The /etc/hosts file is corrupt.

Corrupt hosts file would affect both similarly.

Trap 3: The DNS server at 8.8.8.8 is not responding.

But dig succeeded, so it is responding.

A
The network interface is down.
Why wrong: Would affect both commands.
B
The /etc/hosts file is corrupt.
Why wrong: Corrupt hosts file would affect both similarly.
C
The DNS server at 8.8.8.8 is not responding.
Why wrong: But dig succeeded, so it is responding.
D
The /etc/resolv.conf file is misconfigured.
'host' uses local resolver, which may have wrong DNS servers.

Question 11mediummultiple choice

You are a Linux administrator for a company that runs a web server on a system with limited disk space. The web server logs are stored in /var/log/httpd/access_log and grow quickly. The operations team requires that the most recent logs be available for troubleshooting, but logs older than 7 days must be compressed to save space. You decide to implement log rotation using logrotate. The logrotate configuration file for httpd currently contains:

/var/log/httpd/*.log { daily rotate 7 compress delaycompress missingok notifempty sharedscripts postrotate /bin/systemctl reload httpd 2>/dev/null || true endscript

After applying this configuration, you notice that log files are being compressed immediately instead of after one rotation. What is the most likely cause and the correct step to fix this?

Trap 1: Remove the 'sharedscripts' directive to ensure the postrotate…

The sharedscripts directive does not affect compression timing; it only controls when the postrotate script runs.

Trap 2: Remove the 'delaycompress' directive to ensure compression occurs…

Removing delaycompress would cause all rotated logs to be compressed immediately, including the most recent, which contradicts the requirement to keep recent logs uncompressed.

Trap 3: Add the 'copytruncate' directive to avoid moving the log file,…

copytruncate does not affect compression timing; it only changes how the log file is rotated.

A
Remove the 'sharedscripts' directive to ensure the postrotate script runs for each log file individually.
Why wrong: The sharedscripts directive does not affect compression timing; it only controls when the postrotate script runs.
B
Change the rotation frequency to 'weekly' so that the most recent week's logs remain uncompressed and older logs are compressed.
With weekly rotation, the most recent rotated log (one week old) remains uncompressed due to delaycompress, while older logs are compressed, meeting the requirement of compressing logs older than 7 days.
C
Remove the 'delaycompress' directive to ensure compression occurs at each rotation.
Why wrong: Removing delaycompress would cause all rotated logs to be compressed immediately, including the most recent, which contradicts the requirement to keep recent logs uncompressed.
D
Add the 'copytruncate' directive to avoid moving the log file, allowing the web server to continue writing to the same file.
Why wrong: copytruncate does not affect compression timing; it only changes how the log file is rotated.

Question 12mediummultiple choice

A Linux administrator is troubleshooting a package dependency issue. When attempting to install package 'foo', the package manager reports a missing dependency 'libbar.so.2'. Which of the following is the most appropriate next step?

Trap 1: Run 'ldconfig' to update the library cache

ldconfig does not install missing libraries.

Trap 2: Reinstall the 'foo' package using 'rpm -i --force foo.rpm'

Force install may break the system.

Trap 3: Run 'rpm -q --whatrequires libbar.so.2'

Shows packages requiring the library, not providing it.

A
Run 'ldconfig' to update the library cache
Why wrong: ldconfig does not install missing libraries.
B
Reinstall the 'foo' package using 'rpm -i --force foo.rpm'
Why wrong: Force install may break the system.
C
Run 'rpm -q --whatrequires libbar.so.2'
Why wrong: Shows packages requiring the library, not providing it.
D
Use 'apt-file search libbar.so.2' or 'dnf provides libbar.so.2' to find the package that contains the file
Identifies the package providing the missing library.

Question 13mediummultiple choice

A Linux system using systemd fails to reach the default target after a recent change. The administrator wants to boot into a minimal environment to troubleshoot. Which kernel parameter should be added at the GRUB prompt?

Trap 1: single

Single is a SysV parameter; on systemd, it maps to rescue.target but is not a kernel parameter.

Trap 2: init=/bin/bash

This bypasses systemd and gives a root shell, but not a proper rescue environment.

Trap 3: systemd.unit=emergency.target

Emergency target mounts root read-only and is too minimal for troubleshooting.

A
single
Why wrong: Single is a SysV parameter; on systemd, it maps to rescue.target but is not a kernel parameter.
B
systemd.unit=rescue.target
Rescue target provides a minimal environment with root read-write and basic services.
C
init=/bin/bash
Why wrong: This bypasses systemd and gives a root shell, but not a proper rescue environment.
D
systemd.unit=emergency.target
Why wrong: Emergency target mounts root read-only and is too minimal for troubleshooting.

Question 14hardmultiple choice

When troubleshooting a problem with a Debian package installation, an administrator wants to see which version of a package would be installed from the configured repositories. Which command displays the candidate version?

Trap 1: dpkg -l package

Shows installed version only.

Trap 2: apt-show-versions package

Shows all available versions but not the candidate.

Trap 3: apt-get -s install package

Simulates install, but does not list candidate explicitly.

A
dpkg -l package
Why wrong: Shows installed version only.
B
apt-show-versions package
Why wrong: Shows all available versions but not the candidate.
C
apt-get -s install package
Why wrong: Simulates install, but does not list candidate explicitly.
D
apt-cache policy package
Shows candidate version and priority.

Question 15mediummultiple choice

A developer is troubleshooting a shell script that uses the variable $HOME but it outputs nothing when the script runs. The script is executed with ./script.sh from an interactive shell. What is the most likely cause?

Trap 1: The script is run with sh instead of bash

Running the script with sh instead of bash would still have HOME set and exported, so this is not the cause of an empty output.

Trap 2: The script is run with sudo

Running with sudo would change the HOME to root's home or the target user's home, but it would not be empty, so this is not the likely cause.

Trap 3: The HOME variable is not exported

This option is misleading because HOME is typically exported in interactive shells; lack of export is unlikely to be the cause.

A
The script is run with sh instead of bash
Why wrong: Running the script with sh instead of bash would still have HOME set and exported, so this is not the cause of an empty output.
B
The script is run with sudo
Why wrong: Running with sudo would change the HOME to root's home or the target user's home, but it would not be empty, so this is not the likely cause.
C
The HOME variable is not exported
Why wrong: This option is misleading because HOME is typically exported in interactive shells; lack of export is unlikely to be the cause.
D
The user has no home directory
If the user has no home directory, the HOME variable may not be set or may be empty, leading to no output when referenced in a script. This is the most likely cause among the options.

Review the full subnetting walkthrough →

Question 16hardmultiple choice

A sysadmin is troubleshooting a connectivity issue between two servers in different subnets. The output of 'traceroute 192.168.2.10' shows packets reaching a router but not the destination. The router's firewall uses iptables. Which rule would prevent the traceroute from completing?

Trap 1: -A INPUT -i lo -j LOG

Logs loopback traffic, does not drop.

Trap 2: -A INPUT -p udp -j ACCEPT

Accepts all UDP, would not block traceroute.

Trap 3: -A INPUT -p tcp --dport 80 -j REJECT

Affects TCP port 80, not traceroute (UDP).

A
-A INPUT -i lo -j LOG
Why wrong: Logs loopback traffic, does not drop.
B
-A INPUT -p udp -j ACCEPT
Why wrong: Accepts all UDP, would not block traceroute.
C
-A INPUT -p tcp --dport 80 -j REJECT
Why wrong: Affects TCP port 80, not traceroute (UDP).
D
-A INPUT -p icmp --icmp-type port-unreachable -j DROP
Blocks ICMP Port Unreachable, which stops traceroute responses.