LFCS practice questions and answers

Correct answer: A — nc -zv example.com 443

netcat in zero-I/O mode attempts the TCP connection and reports success or failure. ping uses ICMP and says nothing about a specific port, dig queries DNS, and traceroute maps the path rather than testing a port.

Correct answer: A, B — id username · groups username

id prints UID, GID, and all group memberships, and groups prints the membership list. who and w show current logins and last shows login history.

Correct answer: A — systemctl daemon-reload

daemon-reload makes systemd re-read unit files from disk so the new configuration is used. Rebooting works but is disproportionate, isolate switches targets, and masking disables the unit entirely.

Correct answer: A — Run it under a terminal multiplexer such as tmux or screen, or start it as a systemd service

A multiplexer keeps the session alive independently of the SSH connection, and a systemd service is supervised by init entirely. Nice values affect scheduling, redirecting output does not detach the process, and a subshell still belongs to the same session.

Correct answer: A — net.ipv4.ip_forward = 1 in a file under /etc/sysctl.d/

A sysctl configuration file is applied at boot, making the setting persistent. Writing directly to /proc changes the running kernel only, and hosts entries and shell aliases are unrelated.

Correct answer: A — systemctl --failed

The --failed option filters units in the failed state, which is the fastest triage step after a boot problem. list-timers shows scheduled timers, get-default prints the default target, and show dumps unit properties.

Correct answer: A — history | grep systemctl

history prints the shell's command history and grep filters it. Searching passwd is unrelated, and which and type report where the command lives rather than how it was used.

Correct answer: A — UUID

A UUID is stored in the filesystem itself and is stable regardless of enumeration order, unlike kernel device names. Inode numbers identify files within a filesystem, and the mount point is where it is attached rather than what is attached.

Correct answer: A — systemctl enable --now nginx

enable creates the boot-time symlink and --now starts the unit in the same command. start alone does not persist across reboot, status only reports, and mask prevents the unit from being started at all.

Correct answer: A — ip route add default via 192.168.1.1

ip route add default via installs the default route through the given next hop. ip addr assigns an address, ip link brings an interface up, and ip neigh manipulates the ARP cache.

Correct answer: A — find /var -type f -size +100M

find with the size test filters by file size directly, and +100M means larger than 100 mebibytes. grep searches file contents, du summarises directory usage rather than listing individual large files, and a recursive ls is not filtered by size.

Correct answer: A — pkill nginx

pkill matches processes by name or other attributes and signals them. kill requires a PID, while nice and renice adjust scheduling priority.

Correct answer: A, B — command > out.log 2>&1 · command &> out.log

Redirecting stdout to the file and then duplicating stderr onto it captures both, and the shorthand form does the same in bash. Redirecting only stdout or only stderr misses one stream, and piping to a filename is invalid.

Correct answer: A — ss -ltnp | grep :8080

ss with listening, TCP, numeric, and process options reports the socket and the owning process. ping tests reachability, ip addr shows interface addresses, and df reports disk usage.

Correct answer: A — lsof +D /mnt or fuser -vm /mnt

lsof and fuser both identify processes holding open files or working directories under a mount point. df reports usage, blkid shows device identifiers, and sync flushes buffers without releasing anything.

Correct answer: A, B — It refers to the same inode as the original file · It cannot span filesystems

Hard links are additional directory entries for the same inode, so they are confined to a single filesystem. Deleting one name leaves the data intact while another link remains, directories cannot normally be hard linked, and storing a path as text describes a symbolic link.

Correct answer: A — A systemd timer unit paired with a service unit

Timer units schedule an associated service and integrate with the journal, dependencies, and options such as RandomizedDelaySec. The message of the day, shell loops from a login file, and aliases are not scheduling mechanisms.

Correct answer: A — systemctl get-default

get-default prints the target that default.target links to, typically multi-user or graphical. runlevel reports legacy compatibility values, list-sockets shows socket units, and uname prints kernel information.

Correct answer: A — tar -czf /backup/etc.tar.gz /etc

c creates, z applies gzip compression, and f names the archive file. The x flag extracts rather than creates, gzip compresses individual files rather than directory trees, and zip produces a zip archive with a misleading name here.

Correct answer: A — journalctl -u myservice -n 50 --no-pager

journalctl -u filters the journal to a specific unit, which is where systemd records start-up failures. dmesg shows kernel messages, list-units enumerates units without their logs, and ps only shows whether a process is running.

Correct answer: A — /etc/shadow

shadow holds password hashes and ageing fields and is readable only by root. passwd holds account attributes without hashes on modern systems, group lists group membership, and login.defs holds default policy values.

Correct answer: A, B — pvcreate /dev/sdb · vgcreate vg0 /dev/sdb

pvcreate initialises the physical volume and vgcreate builds a volume group from it, which are the first two LVM steps. mkswap formats swap space, resize2fs resizes an existing ext filesystem, and blkid only reports identifiers.

Correct answer: A — ulimit -a

ulimit -a lists all soft limits such as open files and maximum processes for the current shell. free reports memory, uptime shows load averages, and vmstat samples system activity.

Correct answer: A — mount -a followed by checking for errors

mount -a attempts every fstab entry not already mounted and reports failures, which catches typos before they break the boot. Rebooting to find out risks an unbootable system, umount -a unmounts filesystems, and running fsck on a mounted read-write filesystem can corrupt it.

Correct answer: A — ln -s /opt/app/v2 current

The -s flag creates a symbolic link, which can span filesystems and point at directories. Without -s you get a hard link, which cannot normally target a directory, while cp copies and mv relocates.

Correct answer: A — sed -i 's/debug/info/g' config.txt

The -i flag edits in place and the g modifier replaces every occurrence on each line. Without -i the result only goes to standard output, without g only the first match per line changes, grep filters lines, and that awk program prints the first field.

Correct answer: A — chmod 700 script.sh

700 grants read, write, and execute to the owner and nothing to group or others. 777 grants everything to everyone, 644 removes execute and grants read to others, and chown changes ownership rather than permissions.

Correct answer: A — A file under /etc/profile.d/ ending in .sh

Scripts in /etc/profile.d are sourced by login shells for all users, which is the maintainable way to set system-wide variables. A user's bashrc affects only that user, hosts maps names to addresses, and fstab describes filesystems.

Correct answer: A, B — The public key is placed in the remote user's ~/.ssh/authorized_keys · The private key stays on the client and should be protected by a passphrase

Only the public key belongs on the server, and the private key stays with the client, ideally passphrase protected. Copying the private key defeats the model, permissive permissions on authorized_keys cause sshd to refuse it, and password authentication can and usually should be disabled.

Correct answer: A — usermod -aG docker bob

The -a flag appends to the supplementary group list, and omitting it replaces the entire list. groupadd creates groups rather than assigning membership, and chgrp changes file group ownership.

Correct answer: A, B — pwd · cd -

pwd prints the working directory and cd with a hyphen returns to the previous one. cd with a tilde goes to the home directory, ls lists contents, and dirname manipulates a path string.

Correct answer: A — traceroute example.com

traceroute reports each router along the path with round-trip times. ss lists sockets, ip link shows interface state, and hostnamectl displays and sets the system hostname.

Correct answer: A — In a drop-in file under /etc/systemd/system/<unit>.d/override.conf

Drop-in files under /etc/systemd/system take precedence over vendor units and survive package upgrades, and systemctl edit creates them. Editing the vendor unit under /usr/lib is overwritten on update, and /tmp and home directories are not unit search paths for system services.

Correct answer: A — systemctl reload nginx

reload signals the running process to re-read its configuration, which for a unit with ExecReload defined avoids restarting and dropping connections. restart stops and starts the process, kill sends a signal to terminate it, and disable only removes the boot-time symlink.

Correct answer: A — du -sh /var/* | sort -h -r

du summarises each entry and sort -h -r orders human-readable sizes descending. df reports filesystem-level usage, ls shows directory entry sizes rather than recursive totals, and stat shows metadata for one path.

Correct answer: A — useradd -m -s /bin/bash alice

The -m flag creates the home directory and -s sets the login shell. Plain useradd may skip the home directory depending on defaults, usermod modifies an existing account, and groupadd creates a group.

Correct answer: A — tail -n 50 -f /var/log/syslog

tail with -n selects how many lines to show and -f follows the file for new output. head shows the beginning, cat prints once and exits, and less pages through the file without following by default.

Correct answer: A — journalctl -b -1

The -b flag with an offset selects a specific boot, and -1 means the previous one, which requires persistent journal storage. -f follows new entries, disk-usage reports size, and vacuum-size trims the journal.

Correct answer: A — ip addr show

ip addr lists interfaces with their assigned addresses. ip route shows the routing table, ss -s summarises socket statistics, and arp shows the neighbour cache.

Correct answer: A — firewall-cmd --permanent --add-service=https then firewall-cmd --reload

The permanent flag writes the rule to the configuration and reload activates it, so it survives restarts. Without permanent the change is lost on reload, and stopping the firewall or flushing iptables removes protection entirely.

Correct answer: A — file report.dat

The file command inspects magic bytes and reports the content type. stat shows inode metadata, ls shows permissions and size, and wc counts bytes.

Correct answer: A — hostnamectl set-hostname web01

hostnamectl writes /etc/hostname and updates the running value, so the change survives a reboot. The hostname command, an exported variable, and a direct /proc write all affect only the current session or boot.

Correct answer: A — awk -F: '{print $3}' file

awk with -F sets the field separator and $3 selects the third field. cut -c3 selects a character position, sed -n '3p' prints the third line, and head prints the first three lines.

Correct answer: A — grep -c ERROR access.log

grep -c prints the number of matching lines. The -v flag inverts the match, wc -l counts every line in the file, and sort with uniq deduplicates without counting matches.

Correct answer: A — /etc/resolv.conf

resolv.conf lists nameservers and search domains used by the resolver library, though it is often managed by systemd-resolved or NetworkManager. hostname holds the system name, and services and protocols map names to port and protocol numbers.

Correct answer: A — Set PermitRootLogin no and PasswordAuthentication no, relying on keys

Disabling direct root login and password authentication removes the two most commonly brute-forced paths. Empty passwords are catastrophic, root login with a password is still guessable, and disabling host key checking weakens the client against interception.

Correct answer: A — Inode exhaustion, using df -i

A filesystem can run out of inodes while blocks remain free, typically after creating enormous numbers of small files, and df -i reveals this. Memory, CPU load, and socket counts do not cause this error.

Correct answer: A, B — Add After=network-online.target to the unit · Add Wants=network-online.target to the unit

After orders the unit and Wants pulls the target in, and both are needed for the ordering to actually be meaningful. Sleeping is a fragile guess, manual starting defeats automation, and disabling restarts does not address ordering.

Correct answer: A, B — dig example.com A · getent hosts example.com

dig queries DNS directly and getent exercises the system's full name service switch path, which together distinguish a DNS server problem from a local configuration problem. df, lsblk, and free report storage and memory.

Correct answer: A, B — nmcli connection modify with ipv4.method manual and ipv4.addresses set · A NetworkManager keyfile under /etc/NetworkManager/system-connections/

nmcli edits the stored connection profile and the keyfile is where that profile lives, so both persist across reboots. A login profile only runs for interactive shells, hosts maps names to addresses, and resolv.conf configures DNS.

Correct answer: A — fallocate -l 2G /swapfile, chmod 600 /swapfile, mkswap /swapfile, swapon /swapfile

The file must be allocated, permission-restricted, formatted as swap, and then enabled, in that order. Creating an ext4 filesystem is wrong for swap, an empty file has no swap signature, and swap is enabled with swapon rather than mount.

Correct answer: A — noexec

noexec blocks executing binaries from that mount, which is a common hardening measure alongside nosuid and nodev. ro makes the mount read-only, sync forces synchronous writes, and noatime skips access time updates for performance.

Correct answer: A — passwd -l username

passwd -l prefixes the hash with an exclamation mark so no password matches. The -d option deletes the password entirely, which can allow passwordless login, chage -l lists ageing information, and id shows UID and group membership.

Correct answer: A — blkid

blkid reports the UUID, label, and filesystem type for each device, which is what you copy into fstab. mount lists what is currently mounted, fdisk -l shows partition tables without UUIDs, and sync flushes write buffers.

Correct answer: A — lsblk

lsblk shows disks, partitions, and logical volumes hierarchically with sizes and mount points. df -i reports inode usage of mounted filesystems, du sums directory sizes, and mount -a mounts everything listed in fstab.

Correct answer: A — lvextend -L +5G /dev/vg0/lv_data then resize2fs /dev/vg0/lv_data

The logical volume must grow first so the filesystem has room to expand into, then resize2fs grows the filesystem. Resizing the filesystem first would fail, pvcreate plus mkfs would destroy data, and vgreduce with lvremove removes storage.

Correct answer: A — A file under /etc/sudoers.d containing %ops ALL=(ALL) ALL, edited with visudo

A drop-in sudoers file validated by visudo grants the group sudo access with an audit trail and without touching the main file. Root group membership does not grant sudo, a setuid shell is a severe vulnerability, and sharing the root password destroys accountability.

Correct answer: A — ss -tanp state established

ss filters by socket state and the p option attributes each socket to a process. ip route get shows which route would be used, nmcli reports NetworkManager device state, and ethtool queries link-level driver settings.

Correct answer: A — rsync -avz /data/ user@host:/data/

rsync in archive mode preserves attributes and transfers only differences, with compression from -z. scp copies everything each time, sftp is interactive, and curl is not appropriate for a directory tree over SSH here.

Correct answer: A, B — apt-get install -y nginx · dpkg -l nginx

apt-get installs from configured repositories and dpkg -l queries the local package database on Debian systems. yum and rpm belong to Red Hat family systems and zypper to SUSE.