Troubleshooting practice questions

A system administrator is troubleshooting a RHEL 9 server that fails to boot and drops into emergency mode. The system console shows an error about mounting /dev/sdb1 on /data. The administrator enters emergency mode, checks /etc/fstab, and sees the line: /dev/sdb1 /data ext4 defaults 0 0. The /data directory exists but /dev/sdb1 is a partition on an external USB drive that was removed. The administrator needs the system to boot normally without the USB drive and plans to fix the mount configuration later. Which course of action should the administrator take?

Trap 1: Remove the line from /etc/fstab and run systemctl daemon-reload,…

Removing the line works, but daemon-reload does not reload fstab; reboot is needed, but the option includes daemon-reload which is unnecessary and incorrect.

Trap 2: Add the nofail option to the fstab line, then reboot.

nofail allows boot to continue, but the mount attempt will still fail silently; the requirement is to prevent the mount entirely, not just ignore failure.

Trap 3: Delete the /data directory and reboot.

Deleting the mount point does not prevent the system from trying to mount the missing device; the failure will still occur.

A
Remove the line from /etc/fstab and run systemctl daemon-reload, then reboot.
Why wrong: Removing the line works, but daemon-reload does not reload fstab; reboot is needed, but the option includes daemon-reload which is unnecessary and incorrect.
B
Add the nofail option to the fstab line, then reboot.
Why wrong: nofail allows boot to continue, but the mount attempt will still fail silently; the requirement is to prevent the mount entirely, not just ignore failure.
C
Delete the /data directory and reboot.
Why wrong: Deleting the mount point does not prevent the system from trying to mount the missing device; the failure will still occur.
D
Use a text editor to insert '#' at the beginning of the /dev/sdb1 line in /etc/fstab, then reboot.
Commenting the line prevents the mount attempt; system will boot normally.

Question 2mediummultiple choice

An administrator wants to temporarily disable the firewalld service for troubleshooting. Which command will stop the service and prevent it from starting on subsequent boots?

Trap 1: systemctl stop --now firewalld

The syntax is incorrect; --now is used with enable/disable only.

Trap 2: systemctl mask firewalld

Masking makes the service completely unavailable, even for manual starts; too aggressive for troubleshooting.

Trap 3: systemctl stop firewalld

Stops the service but does not disable it from starting on boot.

A
systemctl stop --now firewalld
Why wrong: The syntax is incorrect; --now is used with enable/disable only.
B
systemctl mask firewalld
Why wrong: Masking makes the service completely unavailable, even for manual starts; too aggressive for troubleshooting.
C
systemctl stop firewalld
Why wrong: Stops the service but does not disable it from starting on boot.
D
systemctl disable firewalld
Why wrong: Disables the service for boot but does not stop it currently.
E
systemctl disable --now firewalld
Stops and disables the service in one command.

Question 3hardmultiple choice

During boot, a server fails to mount an NFS filesystem listed in /etc/fstab. Which troubleshooting step should be taken first to isolate the issue?

Trap 1: Check the status of nfs-client.target with 'systemctl status…

nfs-client.target is not a standard target; the correct target is remote-fs.target.

Trap 2: Try to manually mount the NFS share with 'mount /mnt/nfs'

That would test the network, but the target status indicates if systemd attempted it.

Trap 3: View kernel messages with 'dmesg | grep -i nfs'

That might show errors, but the first step should be to check the target.

A
Check the status of remote-fs.target with 'systemctl status remote-fs.target'
remote-fs.target is responsible for mounting remote filesystems at boot.
B
Check the status of nfs-client.target with 'systemctl status nfs-client.target'
Why wrong: nfs-client.target is not a standard target; the correct target is remote-fs.target.
C
Try to manually mount the NFS share with 'mount /mnt/nfs'
Why wrong: That would test the network, but the target status indicates if systemd attempted it.
D
View kernel messages with 'dmesg | grep -i nfs'
Why wrong: That might show errors, but the first step should be to check the target.

Question 4hardmultiple choice

A database container crashes repeatedly. The administrator wants to see the last 10 lines of the container's logs before it exited. Which command should be used?

Trap 1: podman logs -f <container>

This follows live logs, not tail.

Trap 2: podman logs --since 10m <container>

Shows logs since last 10 minutes, not tail.

Trap 3: podman inspect <container>

Shows container metadata, not logs.

A
podman logs --tail 10 <container>
Correct. Displays the last 10 lines of logs.
B
podman logs -f <container>
Why wrong: This follows live logs, not tail.
C
podman logs --since 10m <container>
Why wrong: Shows logs since last 10 minutes, not tail.
D
podman inspect <container>
Why wrong: Shows container metadata, not logs.

Question 5hardmultiple choice

A system administrator is troubleshooting a container that fails to start with the error: 'Error: cannot start container: listen tcp4 :80: bind: address already in use'. The container is intended to serve HTTP traffic on port 80. What is the most appropriate first step to resolve this issue?

Trap 1: Add --force to the podman run command

--force is not a valid option for podman run; it is used with podman rm or podman stop to forcefully remove/stop.

Trap 2: Add --replace to the podman run command

--replace is used with podman create and podman run for pods, not for individual containers; it does not resolve port conflicts.

Trap 3: Use --net=host to bypass the port mapping

Using --net=host makes the container share the host's network stack, but if port 80 is already in use on the host, the container will still fail to bind.

A
Add --force to the podman run command
Why wrong: --force is not a valid option for podman run; it is used with podman rm or podman stop to forcefully remove/stop.
B
Check which process is using port 80 and either stop that process or use a different host port
The correct approach is to identify the conflicting process, stop it if possible, or map the container to an unused host port (e.g., -p 8080:80).
C
Add --replace to the podman run command
Why wrong: --replace is used with podman create and podman run for pods, not for individual containers; it does not resolve port conflicts.
D
Use --net=host to bypass the port mapping
Why wrong: Using --net=host makes the container share the host's network stack, but if port 80 is already in use on the host, the container will still fail to bind.

Question 6hardmultiple choice

A system administrator is troubleshooting a cron job that runs a script as root. The script is located at /root/scripts/backup.sh and has permissions 755. The cron job is defined in /etc/crontab with the line: 0 2 * * * root /root/scripts/backup.sh. However, the script does not run at the scheduled time. The administrator checks the cron logs and finds no errors. The administrator then runs the script manually as root and it executes successfully. What is the most likely cause of the cron job not running?

Trap 1: The script is not executable by the root user.

The permissions 755 give execute permission to the owner (root), so this is not the issue.

Trap 2: The cron daemon is not running.

If the cron daemon were not running, no cron jobs would run, but the administrator would likely see errors or no logs. The manual execution success suggests the daemon is running.

Trap 3: The /etc/crontab file does not allow running scripts from /root.

There is no such restriction; crontab can run scripts from any location as long as permissions allow.

A
The cron job line uses absolute path to the script but the script requires an environment variable that is not set in cron's minimal environment.
Cron runs with a sparse environment. The script may depend on variables like PATH or custom variables that are not exported.
B
The script is not executable by the root user.
Why wrong: The permissions 755 give execute permission to the owner (root), so this is not the issue.
C
The cron daemon is not running.
Why wrong: If the cron daemon were not running, no cron jobs would run, but the administrator would likely see errors or no logs. The manual execution success suggests the daemon is running.
D
The /etc/crontab file does not allow running scripts from /root.
Why wrong: There is no such restriction; crontab can run scripts from any location as long as permissions allow.

Question 7hardmultiple choice

A system administrator is troubleshooting a custom service called 'database.service' that fails intermittently. The service is a proprietary database that requires large amounts of memory. The administrator runs systemctl status database and sees 'Active: failed (Result: core-dump)' and the journal shows 'Out of memory: Killed process (database) total-vm:...' The server has 8GB RAM and 2 CPU cores. The service unit file does not contain any memory limits. The application is configured to use up to 4GB. The administrator suspects the systemd service is being killed by the OOM killer. Which action should the administrator take to prevent this issue?

Trap 1: Set MemoryMax=6G in the service unit file.

Incorrect: This limits the cgroup memory but does not prevent OOM kills; if the system runs out of memory, the process may still be killed.

Trap 2: Modify kernel parameters to disable the OOM killer.

Incorrect: Disabling OOM killer system-wide is not recommended and may cause system hangs.

Trap 3: Increase swap space to 16GB.

Incorrect: Increasing swap only delays OOM conditions; the process can still be killed if memory pressure persists.

A
Set MemoryMax=6G in the service unit file.
Why wrong: Incorrect: This limits the cgroup memory but does not prevent OOM kills; if the system runs out of memory, the process may still be killed.
B
Set OOMScoreAdjust=-1000 in the service unit file.
Correct: This makes the process less likely to be selected by the OOM killer.
C
Modify kernel parameters to disable the OOM killer.
Why wrong: Incorrect: Disabling OOM killer system-wide is not recommended and may cause system hangs.
D
Increase swap space to 16GB.
Why wrong: Incorrect: Increasing swap only delays OOM conditions; the process can still be killed if memory pressure persists.