First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.
Continue in the practice tool above to load more questions, 50 at a time.
Question 1Unix/Linux System and Network Fundamentals
On a Linux system, which directory is conventionally used as the mount point for removable media such as USB drives?
- /media Correct answer.
- /srv
- /opt
- /mnt
Explanation
The Filesystem Hierarchy Standard reserves /media for removable media mount points, and desktop environments typically auto-mount USB devices under /media/<user>/<label>. /mnt exists for temporary manual mounts, while /srv and /opt serve service data and add-on software respectively.
Question 2Unix/Linux System and Network Fundamentals
A file has permissions -rw-r----- and is owned by alice with group staff. Which statement describes who can read the file?
- Only alice can read it
- Only root can read it
- alice and any member of staff can read it Correct answer.
- Any user on the system can read it
Explanation
The permission string shows read and write for the owner (alice), read for the group (staff), and nothing for others. Therefore alice and members of the staff group may read the file, while all other users are denied.
Question 3Unix/Linux System and Network Fundamentals
Which command displays the manual page for the passwd command?
- doc passwd
- help passwd
- info passwd
- man passwd Correct answer.
Explanation
man is the standard interface for reading the system manual pages, and man passwd opens section 1 (or the first matching section) for that command. The other names are not standard manual-page readers on Linux.
Question 4Unix/Linux System and Network Fundamentals
Which command shows the current working directory in a shell?
- dir
- cd
- pwd Correct answer.
- ls
Explanation
pwd prints the absolute pathname of the current working directory. cd changes the directory instead of reporting it, and ls lists directory contents.
Question 5Unix/Linux System and Network Fundamentals
Which command sends the signal SIGTERM to the process with PID 4242?
- kill -9 4242
- kill 4242 Correct answer.
- killall 4242
- kill -l 4242
Explanation
kill with only a PID sends SIGTERM (signal 15) by default, which requests graceful termination. The -9 form sends SIGKILL instead, and -l lists signal names rather than signalling a process.
Question 6Unix/Linux System and Network Fundamentals
Which file on a typical Linux system maps hostnames to IP addresses for local resolution before DNS is queried?
- /etc/hosts Correct answer.
- /etc/nsswitch.conf
- /etc/hostname
- /etc/resolv.conf
Explanation
/etc/hosts contains static hostname-to-address mappings that the resolver consults, usually before DNS. /etc/resolv.conf instead lists the DNS servers to query, and /etc/nsswitch.conf controls the lookup order.
Question 7Unix/Linux System and Network Fundamentals
Which command displays the IP addresses assigned to all network interfaces on a modern Linux system?
- ip addr show Correct answer.
- netstat -i
- ifconfig -a
- route -n
Explanation
The ip command from iproute2 is the current standard, and ip addr show prints addresses for every interface. ifconfig is deprecated on many distributions, and netstat and route report different information.
Question 8Unix/Linux System and Network Fundamentals
Which of the following is a private IPv4 address range as defined in RFC 1918?
- 11.0.0.0/8
- 224.0.0.0/4
- 172.16.0.0/12 Correct answer.
- 192.169.0.0/16
Explanation
RFC 1918 defines three private ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The 172.16.0.0/12 block covers 172.16.0.0 through 172.31.255.255 and is not routable on the public Internet.
Question 9Unix/Linux System and Network Fundamentals
A user runs chmod 640 report.txt. Which access does the file's group receive?
- No access
- Read only Correct answer.
- Write only
- Read and write
Explanation
The octal mode 640 breaks into 6 for the owner (read and write), 4 for the group (read only), and 0 for others (no access). The group therefore receives read permission but cannot modify the file.
Question 10Unix/Linux System and Network Fundamentals
An administrator needs to change the owner of /data/report to user bob and group audit in a single command. Which command accomplishes this?
- chown bob:audit /data/report Correct answer.
- chgrp bob:audit /data/report
- usermod bob:audit /data/report
- chmod bob:audit /data/report
Explanation
chown accepts owner:group syntax, so chown bob:audit sets both the owner and the group at once. chmod changes permission bits, chgrp changes only the group, and usermod modifies account attributes.
Question 11Unix/Linux System and Network Fundamentals
Which command displays the default route from the kernel routing table on a system using iproute2?
- ip link show default
- ip rule show default
- ip neigh show default
- ip route show default Correct answer.
Explanation
ip route show default filters the routing table for the default entry, typically shown as default via <gateway> dev <interface>. The link, neigh, and rule objects display interfaces, neighbour cache, and policy rules rather than routes.
Question 12Unix/Linux System and Network Fundamentals
A process named backup is consuming excessive CPU. Which command sends SIGTERM to every process whose name matches backup?
- ps backup
- kill -l backup
- pkill backup Correct answer.
- kill backup
Explanation
pkill matches processes by name and delivers SIGTERM by default. The plain kill command expects a PID, and ps only reports processes without signalling them.
Question 13Unix/Linux System and Network Fundamentals
Which command shows the listening TCP ports together with the process that owns each socket, using the ss utility?
- ss -uanp
- ss -s
- ss -tlnp Correct answer.
- ss -r
Explanation
The flags -t, -l, -n, and -p select TCP sockets, listening state, numeric output, and the owning process respectively. Combining them lists listening TCP ports with their process information.
Question 14Unix/Linux System and Network Fundamentals
A file /home/alice/notes.txt has mode 644. Which command lets only the owner add execute permission while leaving all other bits unchanged?
- chmod o+x /home/alice/notes.txt
- chmod a+x /home/alice/notes.txt
- chmod g+x /home/alice/notes.txt
- chmod u+x /home/alice/notes.txt Correct answer.
Explanation
Symbolic mode u+x adds execute permission for the user (owner) class only, so the resulting mode becomes 744. The a, o, and g prefixes target all classes, others, and group respectively.
Question 15Unix/Linux System and Network Fundamentals
Which entry in /etc/fstab mounts the device /dev/sdb1 at /data with the ext4 filesystem?
- /dev/sdb1 ext4 /data defaults 0 2
- /data /dev/sdb1 ext4 defaults 0 2
- ext4 /dev/sdb1 /data defaults 0 2
- /dev/sdb1 /data ext4 defaults 0 2 Correct answer.
Explanation
Each fstab line lists the device, the mount point, the filesystem type, options, dump flag, and fsck pass order. Only the first option follows that order with /dev/sdb1 as the device and /data as the mount point.
Question 16Unix/Linux System and Network Fundamentals
Which command displays the DNS servers that the resolver will query on a system using glibc?
- cat /etc/services
- cat /etc/hosts
- cat /etc/resolv.conf Correct answer.
- cat /etc/protocols
Explanation
/etc/resolv.conf contains nameserver lines that give the IP addresses of the DNS resolvers consulted by the system resolver. The other files hold static host mappings, port assignments, and protocol numbers.
Question 17Unix/Linux System and Network Fundamentals
A subnet uses the mask 255.255.255.192. How many usable host addresses does each subnet provide?
- 30
- 62 Correct answer.
- 126
- 64
Explanation
The mask 255.255.255.192 corresponds to /26, leaving 6 host bits and 2^6 = 64 total addresses. Subtracting the network and broadcast addresses leaves 62 usable host addresses.
Question 18Unix/Linux System and Network Fundamentals
Which command creates a compressed tar archive named logs.tar.gz from the directory /var/log/app?
- tar -cjf logs.tar.gz /var/log/app
- tar -xzf logs.tar.gz /var/log/app
- tar -tzf logs.tar.gz /var/log/app
- tar -czf logs.tar.gz /var/log/app Correct answer.
Explanation
The flags c, z, and f create an archive, compress it with gzip, and name the output file. Supplying the directory path as the final argument adds its contents to the archive.
Question 19Unix/Linux System and Network Fundamentals
Which command displays the last ten lines of /var/log/syslog and keeps following new entries as they are appended?
- tail -n 10 -f /var/log/syslog Correct answer.
- head -n 10 -f /var/log/syslog
- cat -n 10 /var/log/syslog
- less +10 /var/log/syslog
Explanation
tail prints the end of a file, and the -f option keeps the file open and prints appended data, which is standard for watching logs. head instead reads from the beginning, and cat and less do not follow appended lines.
Question 20Unix/Linux System and Network Fundamentals
A directory has mode 777 and contains a file owned by alice with mode 600. Which user can read that file?
- Any user, because the directory is world-writable
- No user other than root
- Any member of alice's group
- Only alice and root Correct answer.
Explanation
Directory permissions govern traversal and entry creation, not the access granted by a file's own mode bits. Because the file mode is 600, only its owner alice and the superuser root can read it.
Question 21Unix/Linux System and Network Fundamentals
A server's default route points to 10.0.0.1, but hosts on 192.168.50.0/24 are reachable only through 10.0.0.2. Which command adds the required route?
- ip link add 192.168.50.0/24 via 10.0.0.2
- ip route add default via 10.0.0.2
- ip addr add 192.168.50.0/24 via 10.0.0.2
- ip route add 192.168.50.0/24 via 10.0.0.2 Correct answer.
Explanation
A route for a specific destination network is added with ip route add <prefix> via <gateway>. This more specific /24 route takes precedence over the default route for traffic to that network.
Question 22Unix/Linux System and Network Fundamentals
A script run by a user cannot resolve the hostname db.internal even though the entry exists in /etc/hosts. Which investigation is most likely to reveal the cause?
- Checking /etc/hostname for the local machine name
- Checking /etc/services for a db.internal entry
- Checking /etc/nsswitch.conf to confirm that files is consulted before dns Correct answer.
- Checking /etc/protocols for a matching protocol line
Explanation
The hosts line in /etc/nsswitch.conf determines the order of name service sources. If files is missing or placed after a source that fails authoritatively, the static /etc/hosts entry may be bypassed.
Question 23Unix/Linux System and Network Fundamentals
A process is stopped in state T after receiving SIGSTOP. Which action resumes it?
- Sending SIGHUP to the process
- Sending SIGKILL to the process
- Sending SIGTERM to the process
- Sending SIGCONT to the process Correct answer.
Explanation
SIGSTOP suspends a process and cannot be caught, but SIGCONT resumes a stopped process without terminating it. The other signals either terminate or request reinitialisation rather than resuming execution.
Question 24Unix/Linux System and Network Fundamentals
A file has mode 4755 and is owned by root. What is the effect of this mode when an ordinary user executes it?
- The file becomes writable by all users
- The program cannot be executed by non-owners
- The program runs with the effective user ID of root Correct answer.
- The program runs with the effective group ID of root
Explanation
The leading 4 sets the setuid bit, so an executable runs with the effective user ID of its owner, here root. This is why setuid-root binaries must be audited carefully for privilege-escalation risks.
Question 25Unix/Linux System and Network Fundamentals
A host has address 192.168.10.130 with mask 255.255.255.192. Which address is the broadcast address of its subnet?
- 192.168.10.255
- 192.168.10.191 Correct answer.
- 192.168.10.129
- 192.168.10.128
Explanation
The mask /26 creates blocks of 64 addresses. The block containing 130 starts at 192.168.10.128, so its broadcast address is 192.168.10.191.
Question 26Unix/Linux System and Network Fundamentals
On a Linux system, which file conventionally defines the order in which name service sources such as files, dns, and nis are consulted by the resolver?
- /etc/nsswitch.conf Correct answer.
- /etc/hosts
- /etc/host.conf
- /etc/resolv.conf
Explanation
The Name Service Switch configuration in /etc/nsswitch.conf contains lines such as 'hosts: files dns', which tell glibc which sources to query and in what order for a given database. It governs the lookup mechanism itself rather than storing any address data.
Question 27Unix/Linux System and Network Fundamentals
An administrator wants to see, for the eth0 interface only, the kernel's statistics on dropped and errored packets. Which command reports those counters for that interface?
- ip addr show eth0
- ifconfig eth0 up
- ip -s link show eth0 Correct answer.
- ethtool eth0
Explanation
Adding -s to 'ip link show' makes the kernel print the RX and TX statistics blocks, including errors and dropped counts, for the named interface. Running it with the interface name limits output to eth0.
Question 28Unix/Linux System and Network Fundamentals
A user's shell reports 'Permission denied' when running ./deploy.sh, and ls -l shows -rw-r--r-- for that file. Which command most directly fixes the problem for all users while granting no permission beyond what is needed?
- chmod a-w deploy.sh
- chmod 777 deploy.sh
- chmod u+x deploy.sh
- chmod a+x deploy.sh Correct answer.
Explanation
Executing a script requires the execute bit on the file, which the current mode lacks for every class. 'chmod a+x' adds execute for user, group, and other while leaving the existing read and write bits untouched.
Question 29Unix/Linux System and Network Fundamentals
A server must forward packets between two internal subnets, but hosts on one subnet cannot reach the other. The interfaces are up and addresses are correct. Which setting must be enabled for the kernel to route between them?
- net.ipv4.icmp_echo_ignore_all
- net.ipv4.conf.all.rp_filter
- net.ipv4.ip_forward Correct answer.
- net.ipv4.tcp_syncookies
Explanation
A Linux host drops transit traffic by default because IP forwarding is disabled; setting net.ipv4.ip_forward to 1 makes the kernel act as a router between interfaces. The other parameters tune filtering, ICMP replies, or SYN flood handling and do not enable forwarding.
Question 30Unix/Linux System and Network Fundamentals
A client connects to a service on port 443 of host 10.20.30.40. The server's netstat-style output shows a socket in state SYN_RECV that never completes the handshake, and the client's own connection attempt eventually times out. Assuming the SYN reaches the server, which explanation is most consistent with this observation?
- The client's ephemeral source port is already in use by another connection to the same server.
- The service is bound only to the loopback address on the server.
- The server has no route to the client's network and therefore sends an ICMP redirect.
- The server's reply is being filtered or dropped on the return path, so the client never receives the SYN-ACK. Correct answer.
Explanation
A socket lingering in SYN_RECV means the server received the SYN and answered with SYN-ACK but never received the final ACK, which is typical when the SYN-ACK is blocked by a firewall or lost on the return path. The client then retransmits and eventually times out.
Question 31Network Architecture, Protocols, and the TCP/IP Stack
Which layer of the TCP/IP model is responsible for logical addressing and routing of packets between networks?
- Transport layer
- Internet layer Correct answer.
- Application layer
- Network access layer
Explanation
The Internet layer (often called the network layer) handles logical addressing with IP addresses and determines the best path for packets across interconnected networks using routing protocols. The transport layer provides end-to-end communication, the application layer supports user services, and the network access layer deals with physical transmission and local link framing.
Question 32Network Architecture, Protocols, and the TCP/IP Stack
A network administrator needs to identify the protocol that provides reliable, connection-oriented delivery of a byte stream between two hosts. Which protocol should be selected?
- UDP
- TCP Correct answer.
- ARP
- ICMP
Explanation
TCP establishes a connection through a three-way handshake and guarantees ordered, reliable delivery of a byte stream using acknowledgments and retransmissions. UDP is connectionless and unreliable, ICMP is used for diagnostics and error reporting, and ARP resolves IP addresses to MAC addresses on a local link.
Question 33Network Architecture, Protocols, and the TCP/IP Stack
Which IPv4 address range is reserved for private use and is not routable on the public Internet?
- 224.0.0.0/4
- 192.0.2.0/24
- 172.16.0.0/12 Correct answer.
- 169.254.0.0/16
Explanation
RFC 1918 defines the private IPv4 address blocks 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Addresses in 172.16.0.0/12 are not globally routable and are commonly used inside enterprise networks behind NAT.
Question 34Network Architecture, Protocols, and the TCP/IP Stack
What is the primary purpose of the Address Resolution Protocol (ARP) on an IPv4 network?
- To map a known IPv4 address to its corresponding MAC address Correct answer.
- To assign a default gateway to a host dynamically
- To discover the maximum transmission unit of a path
- To translate private IPv4 addresses to public addresses
Explanation
ARP broadcasts a request asking which device owns a specific IPv4 address; the owner replies with its MAC address so that frames can be encapsulated for local delivery. It does not assign gateways, perform NAT, or discover path MTU.
Question 35Network Architecture, Protocols, and the TCP/IP Stack
Which field in the IPv4 header prevents packets from looping indefinitely in a network?
- Fragment Offset
- Header Checksum
- Time to Live (TTL) Correct answer.
- Identification
Explanation
The TTL field is decremented by each router; when it reaches zero the packet is discarded and an ICMP Time Exceeded message is returned, preventing endless loops. Identification and Fragment Offset support fragmentation, and the Header Checksum verifies header integrity.
Question 36Network Architecture, Protocols, and the TCP/IP Stack
Which TCP mechanism ensures that a receiver is not overwhelmed by data arriving faster than it can process?
- Flow control using the receive window Correct answer.
- Slow start
- Selective acknowledgment
- Congestion avoidance
Explanation
TCP flow control uses the receive window advertised by the receiver to limit how much unacknowledged data the sender may have in flight, preventing buffer overrun. Slow start and congestion avoidance manage network congestion, while selective acknowledgment improves retransmission efficiency.
Question 37Network Architecture, Protocols, and the TCP/IP Stack
A host with IP address 192.168.10.130 and subnet mask 255.255.255.192 needs to send a packet to 192.168.10.190. What will the host do?
- Forward the packet to its default gateway
- Send the packet directly to the destination using ARP for 192.168.10.190 Correct answer.
- Send an ICMP redirect to the destination
- Drop the packet because the destination is on a different subnet
Explanation
The mask 255.255.255.192 creates subnets of 64 addresses. The host's subnet is 192.168.10.128/26, and 192.168.10.190 also falls within that range, so the destination is on-link and the host resolves its MAC address with ARP and sends the frame directly.
Question 38Network Architecture, Protocols, and the TCP/IP Stack
Which statement accurately describes the difference between a collision domain and a broadcast domain?
- A collision domain is bounded by routers, while a broadcast domain is bounded by switches
- A collision domain exists only in routed networks, while a broadcast domain exists only in switched networks
- A collision domain is the set of devices whose frames can collide, while a broadcast domain is the set of devices that receive each other's broadcast frames Correct answer.
- A collision domain includes all devices that can receive a broadcast, while a broadcast domain includes devices that share a collision
Explanation
A collision domain consists of devices sharing a segment where simultaneous transmissions can collide; switches create separate collision domains per port. A broadcast domain consists of devices that receive a broadcast frame; routers, and VLAN boundaries on switches, separate broadcast domains.
Question 39Network Architecture, Protocols, and the TCP/IP Stack
Which protocol uses a three-way handshake to establish a connection before data transfer?
- ICMP
- TCP Correct answer.
- UDP
- DHCP
Explanation
TCP uses SYN, SYN-ACK, and ACK segments to synchronize sequence numbers and confirm both endpoints are ready before data flows. UDP, ICMP, and DHCP do not establish connections in this manner.
Question 40Network Architecture, Protocols, and the TCP/IP Stack
A network engineer observes that a host configured with DHCP has assigned itself an address in the 169.254.0.0/16 range. What is the most likely cause?
- The host could not reach a DHCP server and used link-local autoconfiguration Correct answer.
- The host is using a static address from the private range
- The host received a valid lease from a DHCP server
- The host has been assigned an anycast address
Explanation
When DHCP fails, IPv4 hosts may self-assign a link-local address from 169.254.0.0/16 through APIPA, which allows limited local communication but usually indicates a DHCP reachability problem. A valid DHCP lease would come from the server's configured pool, not this reserved range.
Question 41Network Architecture, Protocols, and the TCP/IP Stack
Which DNS record type maps a domain name to an IPv6 address?
- MX
- A
- CNAME
- AAAA Correct answer.
Explanation
An AAAA record (quad-A) maps a hostname to a 128-bit IPv6 address, while an A record maps to a 32-bit IPv4 address. CNAME creates an alias to another name, and MX identifies mail exchangers for a domain.
Question 42Network Architecture, Protocols, and the TCP/IP Stack
Which ICMP message type is used by the traceroute utility to identify intermediate routers along a path?
- Echo Request
- Redirect
- Time Exceeded Correct answer.
- Destination Unreachable
Explanation
Traceroute sends packets with incrementing TTL values; each router that decrements the TTL to zero discards the packet and returns an ICMP Time Exceeded message, revealing its address. Echo Request is used by ping, Destination Unreachable reports delivery failures, and Redirect informs hosts of a better gateway.
Question 43Network Architecture, Protocols, and the TCP/IP Stack
What is the primary function of the Address Resolution Protocol (ARP) in an IPv4 network?
- To resolve a MAC address to an IPv4 address
- To resolve an IPv4 address to a MAC address Correct answer.
- To resolve an IPv4 address to a port number
- To resolve a domain name to an IPv4 address
Explanation
ARP resolves a known IPv4 address to the corresponding MAC address so that a frame can be delivered on the local link. Reverse ARP performs the opposite mapping, DNS resolves names to addresses, and port numbers are handled by transport-layer protocols.
Question 44Network Architecture, Protocols, and the TCP/IP Stack
A TCP sender has a congestion window (cwnd) of 8 MSS and the receiver advertises a window of 4 MSS. How much unacknowledged data may the sender have in flight?
- 12 MSS
- 4 MSS Correct answer.
- 32 MSS
- 8 MSS
Explanation
The effective send window is the minimum of the congestion window and the receiver's advertised window. Here min(8 MSS, 4 MSS) equals 4 MSS, so the sender is limited to 4 MSS of unacknowledged data.
Question 45Network Architecture, Protocols, and the TCP/IP Stack
Which statement best explains why UDP is often preferred over TCP for real-time voice and video traffic?
- UDP avoids retransmission delays and connection overhead, which suits latency-sensitive streams Correct answer.
- UDP performs congestion control that improves voice quality
- UDP encrypts payloads by default, protecting media streams
- UDP guarantees packet delivery, which real-time applications require
Explanation
Real-time media tolerates some loss but not delay, so UDP's connectionless, no-retransmission behavior avoids head-of-line blocking and handshake overhead. Applications add their own jitter buffers and error concealment instead of relying on TCP reliability.
Question 46Network Architecture, Protocols, and the TCP/IP Stack
Which address block is reserved for IPv4 link-local autoconfiguration when a DHCP server is unavailable?
- 10.0.0.0/8
- 169.254.0.0/16 Correct answer.
- 127.0.0.0/8
- 192.168.0.0/16
Explanation
The 169.254.0.0/16 range is set aside for link-local addressing under APIPA, allowing hosts to communicate on a local segment when DHCP fails. The other ranges serve private networking or loopback purposes.
Question 47Network Architecture, Protocols, and the TCP/IP Stack
What is the main purpose of the DiffServ (Differentiated Services) field in the IPv4 header?
- To provide a checksum for the entire IP payload
- To specify the fragmentation offset of a datagram
- To classify packets into behavior aggregates for per-hop QoS treatment Correct answer.
- To carry the source and destination port numbers
Explanation
The DS field, formerly the Type of Service byte, carries a DSCP value that routers use to classify packets into behavior aggregates and apply per-hop queuing and scheduling policies. It does not perform fragmentation, carry port numbers, or checksum the payload.
Question 48Network Architecture, Protocols, and the TCP/IP Stack
A network uses NAT overload (PAT) on a border router. Which statement describes how return traffic is delivered to the correct internal host?
- The router tracks source port numbers in its translation table to map replies back to the originating internal host Correct answer.
- The router rewrites the destination IP address based on a static one-to-one mapping
- The router uses the IP identification field to identify the internal host
- The router broadcasts replies to all internal hosts and relies on ARP for delivery
Explanation
PAT translates many internal addresses to one public address and uses unique source port numbers to distinguish sessions. The router maintains a translation table so that returning packets, identified by destination port, are forwarded to the correct internal host.
Question 49Network Architecture, Protocols, and the TCP/IP Stack
Which IPv6 address type is used for one-to-many communication where a single packet is delivered to multiple interested receivers?
- Unicast
- Multicast Correct answer.
- Anycast
- Broadcast
Explanation
IPv6 multicast delivers one packet to all interfaces that have joined a multicast group, identified by addresses with the ff00::/8 prefix. IPv6 does not use broadcast; unicast targets one interface and anycast targets the nearest member of a group.
Question 50Network Architecture, Protocols, and the TCP/IP Stack
Which routing protocol is classified as a link-state interior gateway protocol that uses the Dijkstra shortest-path algorithm?
- RIP
- BGP
- EIGRP
- OSPF Correct answer.
Explanation
OSPF is a link-state IGP in which routers flood link-state advertisements and each computes shortest paths with Dijkstra's algorithm. RIP is distance-vector, BGP is an exterior gateway protocol using path-vector logic, and EIGRP is an advanced distance-vector protocol.