LFCS sample questions with answers

LFCS sample questions

Linux Foundation Certified System Administrator (LFCS), The Linux Foundation.

1. Question 1

   Domain: Operations Deployment

   Which command switches SELinux to permissive mode until the next reboot?

   1. getenforce 0
   2. sestatus --permissive
   3. setenforce 0
   4. setsebool enforcing off
   Show the answer

   Answer: C. setenforce 0

   setenforce 0 changes the running mode to permissive, where denials are logged but not enforced; it lasts until reboot. The persistent mode is set with SELINUX= in /etc/selinux/config. setsebool is a tempting look-alike but it changes individual policy booleans, not the global enforcing mode.

   Checked against: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/changing-selinux-states-and-modes_using-selinux

2. Question 2

   Domain: Operations Deployment

   Which single command starts the nginx service now and also configures it to start automatically at boot?

   1. systemctl start --enable nginx
   2. systemctl enable nginx
   3. systemctl reenable nginx
   4. systemctl enable --now nginx
   Show the answer

   Answer: D. systemctl enable --now nginx

   enable creates the [Install] symlinks for boot, and --now also starts the unit right away. Plain systemctl enable is the tempting partial answer: it only affects future boots and leaves the service stopped until you start it or reboot.

   Checked against: https://www.freedesktop.org/software/systemd/man/latest/systemctl.html

3. Question 3

   Domain: Operations Deployment

   A guest named db01 is hung and does not respond to virsh shutdown. A colleague hesitates to run virsh destroy db01 because of its name.

   What does virsh destroy db01 actually do?

   1. Removes the guest's definition from libvirt and deletes its disk images
   2. Forces the running guest off at once but keeps its definition and disks
   3. Sends the guest an ACPI shutdown request and waits for it to power off
   4. Removes the guest's definition from libvirt but leaves its disk images
   Show the answer

   Answer: B. Forces the running guest off at once but keeps its definition and disks

   destroy is an immediate, ungraceful stop, like pulling the power cord; the domain stays defined and its storage is untouched. Removing the definition is done with virsh undefine, and a graceful ACPI shutdown is virsh shutdown, which is the distractor people most often confuse with destroy.

   Checked against: https://www.libvirt.org/manpages/virsh.html

4. Question 4

   Domain: Networking

   Which Linux bonding mode uses IEEE 802.3ad (LACP) and therefore needs matching configuration on the switch?

   1. 802.3ad (mode 4)
   2. active-backup (mode 1)
   3. balance-rr (mode 0)
   4. balance-alb (mode 6)
   Show the answer

   Answer: A. 802.3ad (mode 4)

   Mode 4 creates aggregation groups by negotiating LACP with the switch, so the switch ports must be configured for LACP. active-backup is the common confusion: it keeps only one link active and fails over, which needs no switch support at all.

   Checked against: https://docs.kernel.org/networking/bonding.html

5. Question 5

   Domain: Networking

   Which command lists listening TCP sockets with numeric ports and the processes that own them?

   1. ss -uanp
   2. ip -s link
   3. ss -tlnp
   4. netstat -r
   Show the answer

   Answer: C. ss -tlnp

   For ss, -t selects TCP, -l shows listening sockets, -n prints numeric addresses and ports, and -p shows the owning process (root is needed to see other users' processes). ss -uanp is the close distractor but it selects UDP sockets in every state, not listening TCP sockets.

   Checked against: https://man7.org/linux/man-pages/man8/ss.8.html

6. Question 6

   Domain: Storage

   iostat shows a data disk constantly busy, and you need to identify which process is responsible.

   Which command shows disk read and write rates per process, sampled every second?

   1. iostat -p 1
   2. pidstat -d 1
   3. mpstat -P ALL 1
   4. free -s 1
   Show the answer

   Answer: B. pidstat -d 1

   pidstat -d reports I/O statistics (kB read and written per second) for each task. iostat -p is tempting, but it breaks statistics down by device and partition, not by process, so it cannot tell you which program is responsible.

   Checked against: https://man7.org/linux/man-pages/man1/pidstat.1.html

7. Question 7

   Domain: Storage

   Which lvcreate option allocates all remaining free space in the volume group to the new logical volume?

   1. --size 100%FREE
   2. -L max
   3. --size all
   4. -l 100%FREE
   Show the answer

   Answer: D. -l 100%FREE

   -l (--extents) accepts a count of extents or a percentage such as 100%FREE of the VG's free space. --size 100%FREE is the tempting mistake, because -L/--size expects an absolute size such as 10G, not a percentage.

   Checked against: https://man7.org/linux/man-pages/man8/lvcreate.8.html

8. Question 8

   Domain: Essential Commands

   A custom queue worker occasionally crashes. It should come back automatically after a crash, but when it exits cleanly with status 0 it should stay down.

   Which [Service] settings restart the daemon after it crashes but not after a clean stop, waiting 5 seconds first?

   1. Restart=on-failure and RestartSec=5
   2. Restart=always and TimeoutStopSec=5
   3. Restart=on-success and RestartSec=5
   4. RemainAfterExit=yes and RestartSec=5
   Show the answer

   Answer: A. Restart=on-failure and RestartSec=5

   Restart=on-failure restarts on a non-zero exit code, a fatal signal, a timeout or a watchdog failure, but not after a clean exit, and RestartSec sets the delay. Restart=always is tempting, but it also restarts after clean exits, and TimeoutStopSec concerns stop timeouts, not the delay before restarting.

   Checked against: https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html

9. Question 9

   Domain: Essential Commands

   On Ubuntu, curl fails with 'unable to get local issuer certificate' when calling an internal service whose certificate is signed by your company's root CA, which you have as a PEM file.

   How should the CA certificate be added to the system trust store?

   1. Copy it into /etc/ssl/private/ and run c_rehash /etc/ssl/private to index it
   2. Append the certificate to /etc/hosts.allow and restart systemd-networkd
   3. Copy it into /usr/local/share/ca-certificates/ as company-ca.crt and run update-ca-certificates
   4. Copy it into /usr/local/share/ca-certificates/ as company-ca.pem and then reboot so it is loaded
   Show the answer

   Answer: C. Copy it into /usr/local/share/ca-certificates/ as company-ca.crt and run update-ca-certificates

   update-ca-certificates adds certificates found in /usr/local/share/ca-certificates, which must have the .crt extension, to /etc/ssl/certs and the combined bundle. The .pem filename is the tempting near-miss: files without the .crt extension in that directory are ignored, and rebooting does not regenerate the bundle.

   Checked against: https://manpages.ubuntu.com/manpages/jammy/man8/update-ca-certificates.8.html

10. Question 10

    Domain: Users and Groups

    For bash, which file is read by interactive non-login shells, such as a new terminal window in a desktop session?

    1. ~/.bash_profile
    2. ~/.bashrc
    3. /etc/profile
    4. ~/.bash_logout
    Show the answer

    Answer: B. ~/.bashrc

    Bash reads ~/.bashrc for interactive shells that are not login shells. ~/.bash_profile is the tempting choice, but it is read only by login shells, which is why many distributions make it source ~/.bashrc.

    Checked against: https://www.gnu.org/software/bash/manual/html_node/Bash-Startup-Files.html