I85PREP
⌘ K
CS AO study materials
CS AO study resources

CS AO practice questions

One question at a time. Build your CS AO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1System Administration Fundamentals

On a Linux system, which directory is conventionally used to store variable data such as logs, spool files, and mail queues?

  1. /etc
  2. /opt
  3. /usr
  4. /var Correct answer.

Explanation

The Filesystem Hierarchy Standard reserves /var for variable data that changes during normal operation, including log files, print spools, and mail queues. Static configuration belongs in /etc, and optional third-party software packages typically go under /opt.

Question 2System Administration Fundamentals

A user reports that a hostname resolves correctly on their workstation but not from the server. Which file should an administrator check first on the server to see the resolver search order?

  1. /etc/resolv.conf
  2. /etc/hosts
  3. /etc/hostname
  4. /etc/nsswitch.conf Correct answer.

Explanation

/etc/nsswitch.conf defines the order in which name service sources such as files, dns, and nis are consulted for host lookups. If files precedes dns there, a stale /etc/hosts entry can override DNS answers, which explains host-specific resolution differences.

Question 3System Administration Fundamentals

Which command shows the current runlevel target and the units that failed to start on a systemd-based server?

  1. journalctl -b
  2. systemd-analyze blame
  3. systemctl list-units --state=failed Correct answer.
  4. systemctl status

Explanation

systemctl list-units --state=failed filters the unit list to only units in a failed state, which is the standard way to find services that did not start. Combining it with systemctl get-default or systemctl status gives the current target context.

Question 4System Administration Fundamentals

An administrator needs to give a new local account a home directory and a specific login shell in one step. Which command accomplishes this?

  1. groupadd alice
  2. passwd alice
  3. useradd -m -s /bin/bash alice Correct answer.
  4. usermod -L alice

Explanation

useradd with -m creates the home directory and with -s sets the login shell at account creation time. passwd only sets a password, usermod -L locks an account, and groupadd creates a group rather than a user.

Question 5System Administration Fundamentals

What is the primary effect of the setgid bit on a shared directory such as /srv/project?

  1. New files are created with execute permission for all users
  2. New files inherit the directory's group ownership Correct answer.
  3. Only the owner may delete files in the directory
  4. The directory contents become read-only for all users

Explanation

When setgid is set on a directory, files and subdirectories created inside inherit the group of that directory rather than the creator's primary group. This supports collaborative shared directories where group access must remain consistent.

Question 6System Administration Fundamentals

A file has permissions -rw-r----- and is owned by alice:staff. User bob is a member of staff but not the owner. What access does bob have?

  1. Read and write
  2. Read only Correct answer.
  3. Write only
  4. No access

Explanation

The group permission triad is r--, so members of the owning group can read the file but cannot write or execute it. Because bob is not the owner, the group triad applies to him rather than the owner triad.

Question 7System Administration Fundamentals

Which command displays real-time per-process CPU and memory usage sorted by resource consumption in a terminal?

  1. du -sh
  2. top Correct answer.
  3. df -h
  4. free -m

Explanation

top presents a continuously refreshed view of running processes with CPU and memory columns, and it can sort by those fields interactively. df and du report filesystem usage, while free reports memory totals rather than per-process data.

Question 8System Administration Fundamentals

A background process started from a shell keeps running after logout. Which mechanism allows it to continue after the controlling terminal closes?

  1. It received SIGSTOP
  2. It was disowned or started with nohup, detaching it from the terminal Correct answer.
  3. It was reniced to a higher priority value
  4. It was placed in the foreground with fg

Explanation

Processes tied to a terminal receive SIGHUP when that terminal goes away. Using nohup or disown removes that dependency so the process survives logout, which is why long-running jobs are started this way.

Question 9System Administration Fundamentals

An administrator wants to schedule a script to run every day at 02:30 for all users on a Linux server. Which approach uses the standard system-wide cron mechanism?

  1. Place the script in /etc/profile.d
  2. Create a systemd timer only, since cron cannot run at fixed daily times
  3. Add the entry to the user's ~/.bashrc
  4. Add a line to /etc/crontab with the user field set to root Correct answer.

Explanation

The system crontab at /etc/crontab includes a user field, so an entry there specifies which account runs the job. The schedule fields 30 2 * * * express 02:30 daily, and root is the conventional account for system maintenance jobs.

Question 10System Administration Fundamentals

Which tool is designed to manage packages on a Debian-based system while resolving dependencies automatically?

  1. pkg_add
  2. pacman
  3. apt Correct answer.
  4. rpm

Explanation

apt is the high-level package manager for Debian and its derivatives, and it resolves dependencies when installing or upgrading packages. rpm, pacman, and pkg_add belong to other distributions' package ecosystems.

Question 11System Administration Fundamentals

After editing a configuration file, an administrator runs a syntax check before restarting the service. Which practice best reduces the risk of an outage from a bad configuration?

  1. Restart the service immediately and watch for errors in the console
  2. Copy the file to a backup and restart without validation
  3. Edit the file directly in production and rely on rollback
  4. Validate the configuration with the service's test mode, then reload rather than restart Correct answer.

Explanation

Many daemons offer a configuration test mode, such as nginx -t or sshd -t, that parses the file without applying it. Validating first and then reloading preserves existing connections and avoids taking the service down with a syntax error.

Question 12System Administration Fundamentals

Which command displays the routing table on a modern Linux host?

  1. netstat -a
  2. ip route Correct answer.
  3. arp -a
  4. ifconfig

Explanation

ip route prints the kernel routing table, including default gateways and connected networks. ifconfig configures interfaces, netstat -a lists sockets, and arp -a shows the neighbor cache.

Question 13System Administration Fundamentals

A server can reach hosts on its local subnet but not the internet. Which configuration element is the most likely cause?

  1. The DNS search domain is unset
  2. The hostname is set incorrectly
  3. The loopback interface is down
  4. The default gateway is missing or incorrect Correct answer.

Explanation

Local subnet traffic uses directly connected routes, while off-subnet traffic must be sent to a default gateway. If the default route is absent or points to the wrong address, remote destinations become unreachable while local ones still work.

Question 14System Administration Fundamentals

Which firewall tool provides a persistent, zone-based front end to nftables on many current Linux distributions?

  1. tcpdump
  2. iptables-legacy
  3. firewalld Correct answer.
  4. ss

Explanation

firewalld manages rules by assigning interfaces to zones and uses nftables as its backend on current distributions. It persists configuration across reboots, unlike ad hoc rule insertion with raw iptables commands.

Question 15System Administration Fundamentals

Which command displays the listening TCP ports along with the process that owns each socket?

  1. dig example.com
  2. ss -tlnp Correct answer.
  3. ping -c 4 localhost
  4. traceroute example.com

Explanation

ss with -tlnp limits output to TCP listeners, numeric ports, and the owning process. This is the standard way to identify which service holds a given port on a Linux host.

Question 16System Administration Fundamentals

An administrator needs to back up a directory tree while preserving permissions, ownership, and timestamps. Which approach is most appropriate?

  1. Use cat to concatenate the files
  2. Use cp without options
  3. Use mv to move the directory to a backup disk
  4. Use rsync -a or tar with the -p option Correct answer.

Explanation

Archive mode in rsync and the -p option in tar preserve permission bits, ownership where permitted, and modification times. Plain cp applies the current umask and often changes timestamps, and mv removes the original rather than copying it.

Question 17System Administration Fundamentals

What does a system administrator check first when a disk reports no free space but df shows plenty available?

  1. Whether the swap file is enabled
  2. Whether the DNS resolver is reachable
  3. Whether deleted files are still held open by running processes Correct answer.
  4. Whether the CPU is throttled

Explanation

A process that keeps a deleted file open continues to hold its blocks, so df can show free space while the filesystem is effectively full. Tools such as lsof reveal these held descriptors, and restarting the process releases the space.

Question 18System Administration Fundamentals

Which file normally defines the default umask applied to interactive login shells on a Linux system?

  1. /etc/fstab
  2. /etc/mtab
  3. /etc/services
  4. /etc/profile or a script in /etc/profile.d Correct answer.

Explanation

Login shells read /etc/profile and the scripts in /etc/profile.d, which commonly set the system default umask before user-specific files are read. The other files describe mounts and well-known port assignments.

Question 19System Administration Fundamentals

Which command changes the hostname of a running systemd host persistently?

  1. hostnamectl set-hostname web01 Correct answer.
  2. echo web01 > /proc/sys/kernel/hostname
  3. ifconfig eth0 web01
  4. hostname web01

Explanation

hostnamectl set-hostname writes the new name to the systemd configuration and applies it immediately, so it survives a reboot. Setting the name through hostname or /proc changes only the running kernel value and is lost on restart.

Question 20System Administration Fundamentals

An administrator must grant a user the ability to run specific administrative commands via sudo without a password. Where is this configured?

  1. In /etc/group by adding the user to a group
  2. In the user's ~/.ssh/authorized_keys
  3. In /etc/passwd by clearing the password field
  4. In a file under /etc/sudoers.d using a NOPASSWD rule Correct answer.

Explanation

sudo rules are defined with visudo or in drop-in files under /etc/sudoers.d, where the NOPASSWD tag exempts specified commands from the password prompt. Editing sudoers through visudo protects against syntax errors that could lock out administration.

Question 21System Administration Fundamentals

What is the purpose of a sticky bit on a world-writable directory such as /tmp?

  1. The directory cannot be listed by non-owners
  2. Files created there are automatically encrypted
  3. Only the file owner, directory owner, or root may delete a file Correct answer.
  4. All users may read every file in the directory

Explanation

The sticky bit on a directory restricts deletion so that only the file's owner, the directory's owner, or root can remove or rename an entry. This prevents users from deleting each other's files in shared writable locations like /tmp.

Question 22System Administration Fundamentals

Which log facility and tool combination is used to review authentication events on a systemd host?

  1. /var/log/dpkg.log
  2. lastb only, since it records all logins
  3. journalctl with the auth or authpriv identifiers, or /var/log/auth.log on Debian systems Correct answer.
  4. dmesg filtered by kernel ring buffer

Explanation

Authentication messages are tagged with auth or authpriv facilities and are queried through journalctl or the distribution's auth log. dmesg covers kernel messages, and dpkg.log records package operations.

Question 23System Administration Fundamentals

A service fails to start after a reboot, but it started manually before the reboot. Which condition most likely explains this?

  1. The service binary is missing execute permission
  2. The unit is not enabled, so it does not start at boot Correct answer.
  3. The unit file has a syntax error that appears only at runtime
  4. The service requires a newer kernel

Explanation

A unit that starts manually but not after reboot is usually not enabled, meaning no symlink exists in the target's wants directory. Running systemctl enable creates that link so the service starts automatically at boot.

Question 24System Administration Fundamentals

Which command recursively changes ownership of /srv/data to user alice and group staff?

  1. chown -R alice:staff /srv/data Correct answer.
  2. chmod -R alice:staff /srv/data
  3. umask alice:staff /srv/data
  4. chgrp -R alice /srv/data

Explanation

chown accepts user:group syntax and the -R flag applies the change recursively through the tree. chmod alters permission bits, chgrp changes only the group, and umask is not used to assign ownership.

Question 25System Administration Fundamentals

Which statement best describes the role of a reverse proxy in front of internal application servers?

  1. It resolves DNS names for internal hosts
  2. It encrypts files at rest on the backend servers
  3. It assigns IP addresses to clients on the local network
  4. It terminates client connections and forwards requests to backend servers Correct answer.

Explanation

A reverse proxy accepts client connections on behalf of backend servers and forwards requests to them, which enables TLS termination, load balancing, and hiding internal topology. Address assignment and name resolution are separate network services.

Question 26System Administration Fundamentals

Which directory hierarchy on a Linux system is intended to hold variable data such as logs, spool files, and databases that change during normal operation?

  1. /etc
  2. /usr
  3. /opt
  4. /var Correct answer.

Explanation

The Filesystem Hierarchy Standard reserves /var for variable data whose contents change at runtime, including logs under /var/log and mail and print spools. Static program files belong in /usr, host configuration in /etc, and add-on software in /opt.

Question 27System Administration Fundamentals

An administrator needs a single command that shows the kernel's most recent boot messages, including hardware detection output produced before the regular logging daemon was running. Which command is most appropriate?

  1. uptime
  2. last
  3. who
  4. dmesg Correct answer.

Explanation

dmesg reads the kernel ring buffer, which captures hardware probing and driver messages generated during boot before user-space logging starts. The other commands report login history, system load and uptime, or current sessions rather than kernel messages.

Question 28System Administration Fundamentals

A user reports that a newly created file in their home directory has permissions -rw-r--r--. The administrator wants new files for that user to default to -rw------- without changing the files already present. Which setting achieves this?

  1. Set umask 077 in the user's shell startup configuration Correct answer.
  2. Set the setgid bit on the user's home directory
  3. Add the user to a group with restrictive permissions
  4. Run chmod 600 on the user's home directory

Explanation

The umask is subtracted from the base creation mode, so a umask of 077 removes all group and other bits and yields 600 for regular files. It affects only files created afterward, leaving existing files unchanged.

Question 29System Administration Fundamentals

A process is consuming excessive CPU and the administrator wants to lower its scheduling priority so other work proceeds normally, without terminating it. Which command accomplishes this?

  1. nice -n 10 <PID>
  2. renice +10 -p <PID> Correct answer.
  3. kill -9 <PID>
  4. kill -STOP <PID>

Explanation

renice adjusts the nice value of an already running process, and a higher nice value means lower scheduling priority. It requires appropriate privileges to raise priority beyond what the owner may set.

Question 30System Administration Fundamentals

An administrator must ensure a service starts automatically at boot and is restarted if it crashes, using systemd. Which pair of settings in the unit file accomplishes this?

  1. Requires= and After=
  2. User= and Group=
  3. WantedBy=multi-user.target and Restart=on-failure Correct answer.
  4. ExecStart= and ExecStop=

Explanation

The WantedBy entry in the [Install] section, applied via systemctl enable, creates the dependency that starts the unit at boot. Restart=on-failure in the [Service] section directs systemd to relaunch the process after an unclean exit.

Question 31System Administration Fundamentals

A user's account must be disabled immediately while preserving the account and its files for a later audit. Which action best meets this requirement?

  1. Remove the user from all supplementary groups
  2. Change the user's login shell to /sbin/nologin only
  3. Delete the account with userdel -r
  4. Lock the password with usermod -L and expire the account with chage -E 0 Correct answer.

Explanation

Locking the password prevents password-based logins while leaving the account record and home directory intact for audit. Setting an expiry date in the past with chage blocks the account entirely, and both changes are reversible.

Question 32System Administration Fundamentals

Which command produces a compressed archive of /srv/www while preserving ownership, permissions, and directory structure for later restoration on another host?

  1. dd if=/srv/www of=www.img
  2. tar -czvf www.tar.gz /srv/www Correct answer.
  3. rsync -av /srv/www /backup/www
  4. cp -a /srv/www www_copy

Explanation

tar with the create, gzip, verbose, and file options builds a single compressed archive that records ownership, permissions, and paths, which can be extracted elsewhere with matching attributes when run as root.

Question 33System Administration Fundamentals

A server's clock drifts several minutes per day and the administrator wants it synchronized automatically against network time sources. Which service should be configured?

  1. systemd-resolved
  2. chronyd or systemd-timesyncd Correct answer.
  3. cron
  4. nscd

Explanation

chronyd and systemd-timesyncd implement NTP client behavior that continuously disciplines the system clock against configured time servers. Name service and resolver daemons handle naming, and cron only schedules jobs.

Question 34System Administration Fundamentals

An administrator wants to confirm which process is listening on TCP port 443 on a host. Which command answers this directly?

  1. ss -ltnp Correct answer.
  2. lsof /etc/hosts
  3. ip addr show
  4. netstat -r

Explanation

ss with the listening, TCP, numeric, and process options lists listening TCP sockets together with the owning process, which identifies what holds port 443. The other commands show routes, interface addresses, or open files unrelated to the question.

Question 35System Administration Fundamentals

An administrator adds a new name server to a host's resolver configuration, but queries still go to the old server. Which step most likely resolves the problem?

  1. Reboot the entire server to clear the DNS cache
  2. Flush the routing table with ip route flush cache
  3. Restart or reload the resolver service and verify the active configuration file it reads Correct answer.
  4. Reinstall the DNS client package

Explanation

Many systems run a local resolver stub such as systemd-resolved that reads its own configuration, so editing /etc/resolv.conf alone may have no effect if that file is generated or overridden. Reloading the service and confirming the effective configuration ensures the new server is actually used.

Question 36System Administration Fundamentals

A filesystem is reported as full, but du on the mount point shows far less usage than df reports. Which condition most commonly explains the discrepancy?

  1. An incorrect umask on the mount point
  2. A missing /etc/fstab entry for the mount
  3. A stale entry in the ARP cache
  4. Deleted files still held open by running processes Correct answer.

Explanation

When a process keeps a deleted file open, the blocks remain allocated until the file descriptor closes, so df counts them while du cannot see the unlinked path. Finding and restarting the holding process releases the space.

Question 37System Administration Fundamentals

An administrator needs to inspect the contents of a package before installing it, including the files it would place on the system. Which approach works on a Debian-based host with a downloaded .deb file?

  1. dpkg-deb -c package.deb Correct answer.
  2. apt-cache show package
  3. dpkg -l package
  4. apt-get install --dry-run package.deb

Explanation

dpkg-deb -c lists the archive contents, showing the file paths and attributes the package would install. This inspects the file without modifying the system.

Question 38System Administration Fundamentals

A web server must present a valid certificate for several different hostnames on the same IP address and port. Which mechanism allows the server to select the correct certificate per connection?

  1. Server Name Indication during the TLS handshake Correct answer.
  2. HTTP redirects to a canonical hostname
  3. A shared self-signed certificate for all names
  4. A wildcard DNS record for the zone

Explanation

SNI lets the client send the requested hostname in the TLS handshake, so the server can choose the matching certificate before completing the connection. DNS records and HTTP redirects operate at other layers and cannot select a certificate.

Question 39System Administration Fundamentals

Which file on a Linux host is the conventional place to declare static filesystem mounts that should be available after every boot?

  1. /etc/crypttab
  2. /etc/mtab
  3. /etc/fstab Correct answer.
  4. /proc/mounts

Explanation

/etc/fstab lists filesystems, their mount points, options, and dump and fsck order, and the boot process reads it to mount them. The other files describe current mounts or encrypted volumes rather than persistent mount declarations.

Question 40System Administration Fundamentals

A shell script run from cron behaves differently than when run manually by the same user. Which difference most commonly explains this?

  1. cron provides a minimal environment with a restricted PATH and no interactive profile Correct answer.
  2. cron runs scripts without access to the filesystem
  3. cron executes scripts with root privileges regardless of the crontab owner
  4. cron strips all file permissions from the script before execution

Explanation

Jobs started by cron inherit a sparse environment, so commands found via an interactive PATH or variables set in profile files may not resolve. Using absolute paths or defining PATH inside the script makes behavior consistent.

Question 41Installation, Configuration, and Deployment

A team wants to deploy an AWS CloudFormation stack that creates an EC2 instance which must fetch a database password at boot without storing it in the template. Which mechanism should they use?

  1. Store the password in the instance's UserData as plain text
  2. Reference an AWS Secrets Manager secret using a dynamic reference in the template Correct answer.
  3. Hardcode the password in the template's Mappings section
  4. Pass the password as a CloudFormation parameter with the NoEcho attribute

Explanation

Dynamic references such as {{resolve:secretsmanager:...}} let CloudFormation retrieve the secret value at stack operation time without persisting it in the template. This keeps the credential out of template source control and stack metadata. NoEcho only masks parameter values in the console and API output.

Question 42Installation, Configuration, and Deployment

Which AWS service provides a managed, versioned repository for storing container images that Amazon ECS tasks pull at runtime?

  1. AWS Systems Manager Parameter Store
  2. Amazon Elastic Container Registry Correct answer.
  3. AWS CodeArtifact
  4. Amazon S3 Glacier

Explanation

Amazon ECR is the managed container image registry integrated with ECS and EKS for image pulls. CodeArtifact stores package-manager artifacts such as npm and Maven, not container images. S3 Glacier and Parameter Store are not image registries.

Question 43Installation, Configuration, and Deployment

An application running on EC2 must call AWS APIs without embedding long-term access keys on the instance. What is the correct configuration?

  1. Attach an IAM role to the instance through an instance profile Correct answer.
  2. Store the access key in the AMI and rotate it monthly
  3. Disable the instance metadata service and use a shared credentials file
  4. Create an IAM user and place the access key in an environment variable

Explanation

An instance profile delivers temporary role credentials to the instance through the metadata service, so no long-term keys are stored. The SDKs automatically retrieve and rotate these credentials. Embedding keys in AMIs or environment variables creates persistent exposure.

Question 44Installation, Configuration, and Deployment

Which statement describes the purpose of a CloudFormation change set?

  1. It automatically rolls back a failed stack update
  2. It previews how proposed changes would modify existing stack resources Correct answer.
  3. It exports stack outputs to another region
  4. It validates template syntax before the stack is created

Explanation

A change set computes the difference between the current stack and a proposed template, showing which resources will be added, modified, or removed. Reviewers can inspect impact before executing. Syntax validation and rollback are separate behaviors.

Question 45Installation, Configuration, and Deployment

A company needs a repeatable, version-controlled way to provision identical VPCs across three AWS accounts. Which approach best fits infrastructure as code principles?

  1. Use a CloudFormation template stored in version control and deploy it to each account Correct answer.
  2. Create the VPC once and share it using VPC peering
  3. Rely on AWS Support to replicate the configuration
  4. Manually create the VPC in each account and document the steps

Explanation

Storing templates in version control and deploying them repeatedly gives idempotent, auditable provisioning across accounts. Manual steps drift and are not reproducible. Peering shares connectivity but does not provision equivalent VPCs.

Question 46Installation, Configuration, and Deployment

Which Elastic Beanstalk deployment policy replaces all instances at once and causes downtime during the swap?

  1. Traffic splitting
  2. All at once Correct answer.
  3. Immutable
  4. Rolling with additional batch

Explanation

The all-at-once policy deploys the new version to all instances simultaneously, so the environment is briefly unavailable. Rolling and immutable policies maintain capacity during deployment. Traffic splitting is used with canary-style testing.

Question 47Installation, Configuration, and Deployment

An administrator must ensure an EC2 Auto Scaling group always keeps at least two instances running while allowing scaling up to ten. Which configuration achieves this?

  1. Set minimum capacity to 2 and maximum capacity to 10 Correct answer.
  2. Set desired capacity to 2 and disable scaling policies
  3. Set minimum capacity to 10 and maximum capacity to 2
  4. Set desired capacity to 10 and minimum capacity to 0

Explanation

Minimum capacity enforces the floor of running instances and maximum capacity caps the ceiling. Setting minimum to 2 and maximum to 10 satisfies both constraints. Desired capacity alone does not guarantee a floor under scale-in.

Question 48Installation, Configuration, and Deployment

Which artifact does AWS CodeDeploy use to define the files to install and the lifecycle hooks for an EC2 deployment?

  1. A buildspec.yml file
  2. An appspec.yml file Correct answer.
  3. A Dockerfile
  4. A serverless.yml file

Explanation

CodeDeploy reads the AppSpec file to determine which files to copy and which lifecycle event hooks to run on each instance. buildspec.yml is used by CodeBuild, and serverless.yml belongs to the Serverless Framework. A Dockerfile builds images rather than orchestrating CodeDeploy hooks.

Question 49Installation, Configuration, and Deployment

A Lambda function must read configuration values that change occasionally and be notified when they change, without redeploying code. Which approach is most appropriate?

  1. Store the values in environment variables and update the function configuration
  2. Bake the values into the deployment package
  3. Hardcode the values in the function's source and rebuild
  4. Store the values in AWS AppConfig and have the function retrieve them at runtime Correct answer.

Explanation

AWS AppConfig stores configuration separately and supports validation and deployment strategies, allowing updates without code changes. Environment variables require updating the function configuration, which is a deployment. Hardcoding values forces rebuilds.

Question 50Installation, Configuration, and Deployment

Which statement about Amazon Machine Images (AMIs) is accurate for deployment planning?

  1. An AMI stores only the operating system, never application software
  2. An AMI can be launched in any region without copying
  3. An AMI is region-specific and must be copied to other regions before use there Correct answer.
  4. An AMI cannot be shared with other AWS accounts

Explanation

AMIs are regional resources; to launch in another region the image must be copied there first. AMIs can include application software and can be shared with specific accounts or made public. This regional scope is a key deployment consideration.