I85PREP
⌘ K
LFCE study materials
LFCE study resources

LFCE practice questions

One question at a time. Build your LFCE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Linux System Administration

On a systemd host, which command reloads the unit files after you edit a service's unit file so that subsequent start/stop operations use the new configuration?

  1. systemctl reexec
  2. systemctl reload-or-restart
  3. systemctl daemon-reload Correct answer.
  4. systemctl refresh-units

Explanation

systemd caches unit file contents, so after modifying a unit file on disk you must run systemctl daemon-reload to make the manager re-read its configuration. The change takes effect for the next operation on that unit; a running service is not restarted by the reload itself.

Question 2Linux System Administration

A service unit needs to start only after the network is fully online and after a database service. Which directive set achieves this ordering?

  1. After=network-online.target database.service Correct answer.
  2. Requires=network-online.target database.service
  3. Wants=network-online.target database.service
  4. BindsTo=network-online.target database.service

Explanation

After= controls ordering only: the unit starts after the listed units reach their active state. It does not pull in dependencies, so combining it with Wants= or Requires= if you also need them started is a common pattern. For pure ordering, After= is the correct directive.

Question 3Linux System Administration

You want a systemd timer to run a maintenance job every day at 03:30 regardless of when the machine booted. Which timer directive is appropriate?

  1. OnCalendar=*-*-* 03:30:00 Correct answer.
  2. OnUnitActiveSec=24h
  3. OnBootSec=1h
  4. Persistent=true

Explanation

OnCalendar= uses calendar expressions, so the timer fires at a wall-clock time such as 03:30 daily. OnBootSec and OnUnitActiveSec are monotonic timers relative to boot or last activation, which drift with reboots.

Question 4Linux System Administration

Which command shows the journal entries for the sshd unit from the current boot only?

  1. journalctl --list-boots -u sshd
  2. journalctl -u sshd --since=yesterday
  3. journalctl -p err -u sshd
  4. journalctl -u sshd -b Correct answer.

Explanation

The -u flag filters by unit and -b restricts output to the current boot. Together they return only sshd messages logged since the most recent boot.

Question 5Linux System Administration

To make journald retain logs across reboots on a host where /var/log/journal does not yet exist, which action is required?

  1. Set Storage=volatile in journald.conf
  2. Set ForwardToSyslog=yes in journald.conf
  3. Enable the systemd-journald-audit socket
  4. Create /var/log/journal and restart systemd-journald Correct answer.

Explanation

journald writes to persistent storage only when /var/log/journal exists; otherwise it keeps logs in /run and loses them at reboot. Creating the directory (or setting Storage=persistent) and restarting the service enables persistence.

Question 6Linux System Administration

Which command creates an ext4 filesystem on /dev/sdb1 with the label data and a reserved-block percentage of 1?

  1. mkfs.ext4 -L data -m 1 /dev/sdb1 Correct answer.
  2. tune2fs -L data -m 1 /dev/sdb1
  3. mke2fs -L data -b 1 /dev/sdb1
  4. mkfs.ext4 -n data -r 1 /dev/sdb1

Explanation

mkfs.ext4 accepts -L to set the volume label and -m to set the percentage of blocks reserved for root. Both are applied at creation time.

Question 7Linux System Administration

A new /etc/fstab entry must mount /dev/sdc1 at /srv/data as ext4 and be checked by fsck at boot. Which entry is correct?

  1. /dev/sdc1 /srv/data ext4 noauto,pass 0 0
  2. /dev/sdc1 /srv/data ext4 defaults 0 2 Correct answer.
  3. /dev/sdc1 /srv/data ext4 defaults 2 0
  4. /dev/sdc1 /srv/data auto defaults 1 1

Explanation

The fstab dump field is usually 0, and the pass field controls fsck order; non-root ext4 filesystems commonly use 2. The options field must be valid mount options such as defaults.

Question 8Linux System Administration

Which command displays inode and block usage for all mounted filesystems in human-readable form?

  1. du -sh /
  2. df -i
  3. df -h Correct answer.
  4. lsblk -f

Explanation

df -h reports filesystem block usage in human-readable units. Adding -i switches to inode counts instead of blocks.

Question 9Linux System Administration

You need to extend an LVM logical volume and its ext4 filesystem online in one step. Which command does this?

  1. lvextend -L +5G /dev/vg0/lvdata
  2. lvresize -L 5G /dev/vg0/lvdata
  3. lvextend -r -L +5G /dev/vg0/lvdata Correct answer.
  4. vgextend vg0 /dev/sdd1

Explanation

The -r (or --resizefs) option tells lvextend to resize the filesystem along with the logical volume, so ext4 grows online. Without it you must run resize2fs separately.

Question 10Linux System Administration

Which command creates a RAID 1 md array using /dev/sdb1 and /dev/sdc1?

  1. mdadm --assemble /dev/md0 --level=1 /dev/sdb1 /dev/sdc1
  2. mdadm --build /dev/md0 --raid-devices=2 /dev/sdb1 /dev/sdc1
  3. mdadm --create /dev/md0 --level=5 --raid-devices=2 /dev/sdb1 /dev/sdc1
  4. mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1 Correct answer.

Explanation

mdadm --create with --level=1 and the correct device count builds a mirror from the two partitions. After creation you normally write the mdadm.conf and add the array to fstab.

Question 11Linux System Administration

Which file is used to persist md array definitions so the array assembles automatically at boot?

  1. /etc/mdadm/mdadm.conf or /etc/mdadm.conf depending on distribution Correct answer.
  2. /etc/mtab
  3. /proc/mdstat
  4. /etc/raidtab

Explanation

The mdadm configuration file stores array UUIDs and device lists so the initramfs can assemble arrays at boot. Its location varies by distribution, commonly /etc/mdadm/mdadm.conf on Debian-based systems.

Question 12Linux System Administration

What does the sticky bit on a directory such as /tmp accomplish?

  1. Only the file owner, directory owner, or root can delete or rename files in it Correct answer.
  2. Only the file owner can delete files in the directory
  3. Files in the directory are compressed automatically
  4. New files inherit the directory's group ownership

Explanation

The sticky bit restricts deletion and renaming in a shared directory to the file owner, the directory owner, or root. It is commonly set on /tmp so users cannot remove each other's files.

Question 13Linux System Administration

Which command sets the setgid bit on /srv/shared so new files inherit the directory's group?

  1. chmod g+s /srv/shared Correct answer.
  2. chmod o+t /srv/shared
  3. chmod g+t /srv/shared
  4. chmod u+s /srv/shared

Explanation

The setgid bit on a directory causes new files and subdirectories to inherit the directory's group ownership. chmod g+s sets that bit.

Question 14Linux System Administration

A user needs to run a specific administrative command via sudo without a password. Where is this configured?

  1. In /etc/security/limits.conf
  2. In /etc/pam.d/sudo by removing auth lines
  3. In /etc/passwd by clearing the password field
  4. In /etc/sudoers using a NOPASSWD tag on the command Correct answer.

Explanation

sudoers rules can include the NOPASSWD tag for a specific command, allowing passwordless execution. Edits should be made with visudo to avoid syntax errors.

Question 15Linux System Administration

Which command adds user alice to the existing supplementary group developers without removing her other groups?

  1. groupadd -a developers alice
  2. usermod -G developers alice
  3. usermod -aG developers alice Correct answer.
  4. gpasswd -d developers alice

Explanation

usermod -aG appends the group to the user's supplementary group list. Omitting -a replaces the entire list, which can remove existing memberships.

Question 16Linux System Administration

Which file defines the default values applied when useradd creates a new account?

  1. /etc/login.defs
  2. /etc/skel
  3. /etc/default/useradd Correct answer.
  4. /etc/passwd

Explanation

/etc/default/useradd stores defaults such as the default shell, home directory prefix, and skeleton directory used by useradd. /etc/login.defs holds broader login and password aging defaults.

Question 17Linux System Administration

Which command displays the effective firewall rules for the nftables-based firewalld zone currently active on the default interface?

  1. firewall-cmd --get-zones
  2. iptables -L -n
  3. nft list ruleset
  4. firewall-cmd --list-all Correct answer.

Explanation

firewall-cmd --list-all shows the services, ports, and rules for the default zone applied to the active interface. It reflects firewalld's runtime configuration.

Question 18Linux System Administration

Which nftables command adds a rule accepting inbound TCP port 443 to the input chain of the inet filter table?

  1. nft add rule ip filter forward tcp dport 443 drop
  2. nft add rule inet filter input tcp dport 443 accept Correct answer.
  3. nft insert rule inet filter output tcp dport 443 accept
  4. nft add chain inet filter input tcp dport 443 accept

Explanation

The syntax nft add rule family table chain expression appends a rule matching TCP destination port 443 and accepting it in the input chain. Using inet filter input targets inbound traffic.

Question 19Linux System Administration

Which command adds a default route via 192.0.2.1 on interface eth0 persistently using NetworkManager's nmcli?

  1. ip route add default via 192.0.2.1 dev eth0
  2. nmcli connection modify eth0 +ipv4.routes '0.0.0.0/0 192.0.2.1' Correct answer.
  3. nmcli connection modify eth0 ipv4.gateway 192.0.2.1
  4. route add default gw 192.0.2.1

Explanation

Adding a route with +ipv4.routes stores it in the connection profile so it survives reboots. The gateway is specified as the next hop in the route entry.

Question 20Linux System Administration

Which command shows the IP addresses assigned to all interfaces without resolving names?

  1. ss -lntp
  2. ip addr show Correct answer.
  3. ip -n addr show
  4. ip link show

Explanation

ip addr show lists interfaces with their assigned IPv4 and IPv6 addresses. Adding -n suppresses reverse DNS lookups when names would otherwise be resolved.

Question 21Linux System Administration

Which directive in sshd_config disables password authentication while keeping key-based login?

  1. PasswordAuthentication no Correct answer.
  2. UsePAM no
  3. PermitRootLogin no
  4. ChallengeResponseAuthentication no

Explanation

Setting PasswordAuthentication to no rejects password-based logins, so clients must use public key or other non-password methods. Other directives affect different aspects of authentication.

Question 22Linux System Administration

Which command generates an SSH key pair of type ed25519 with a comment and stores it in the default location?

  1. ssh-keygen -t ed25519 -C 'admin@host' Correct answer.
  2. openssl genpkey -algorithm ed25519 -out id_ed25519
  3. ssh-keygen -t rsa -b 4096 -C 'admin@host'
  4. ssh-copy-id -t ed25519 admin@host

Explanation

ssh-keygen -t ed25519 creates an Ed25519 key pair, and -C attaches a comment. Without -f it writes to the default ~/.ssh/id_ed25519 path.

Question 23Linux System Administration

A cron job defined in /etc/cron.d/mytask must run as user backup every day at 02:00. Which line is valid?

  1. 0 2 * * * root backup /usr/local/bin/backup.sh
  2. * 2 * * * backup /usr/local/bin/backup.sh
  3. 0 2 * * backup /usr/local/bin/backup.sh
  4. 0 2 * * * backup /usr/local/bin/backup.sh Correct answer.

Explanation

Files in /etc/cron.d use the system crontab format with an extra user field after the five time fields. The line must have minute, hour, day, month, weekday, then the user, then the command.

Question 24Linux System Administration

Which systemd directive in a service unit ensures the process is restarted automatically if it exits unexpectedly?

  1. Restart=on-failure Correct answer.
  2. RemainAfterExit=yes
  3. KillMode=process
  4. Type=oneshot

Explanation

Restart=on-failure tells systemd to restart the service when it exits with a failure status. Other values such as always or on-abnormal broaden the restart conditions.

Question 25Linux System Administration

On a system using SELinux in enforcing mode, a web server cannot read a file under /srv/www. Which command shows the SELinux context of the file and directory?

  1. getenforce
  2. ls -Z /srv/www Correct answer.
  3. semanage fcontext -l
  4. chcon -R httpd_sys_content_t /srv/www

Explanation

ls -Z displays the SELinux user, role, type, and level associated with files. Comparing the file's type with the directory's expected type helps diagnose denials.

Question 26Linux System Administration

Which command displays the current SELinux mode (Enforcing, Permissive, or Disabled) along with the loaded policy name?

  1. sestatus Correct answer.
  2. setsebool -l
  3. selinuxenabled
  4. getenforce -v

Explanation

sestatus prints the SELinux status, the current mode, the policy from which it was loaded, and the policy version. It is the standard tool for a full status summary. getenforce alone shows only the mode, and selinuxenabled only returns an exit code.

Question 27Linux System Administration

A systemd service unit must start only after the network is fully online and must not be started if the network fails. Which pair of directives accomplishes this?

  1. Requires=network-online.target and After=network-online.target Correct answer.
  2. Wants=network.target and Conflicts=network-online.target
  3. After=network-online.target and Wants=network-online.target
  4. BindsTo=network.target and Before=network-online.target

Explanation

Requires= makes the dependency mandatory, so the unit fails to start if network-online.target cannot be reached. After= only orders startup and does not pull the target in, so it must be paired with a requirement or want directive. Together they enforce both ordering and a hard dependency.

Question 28Linux System Administration

Which command displays the default route and the interface used for it on a system where the iproute2 tools are installed?

  1. ip route show default Correct answer.
  2. netstat -rn
  3. ifconfig -a
  4. route -n

Explanation

ip route show default filters the routing table to entries with destination default, showing the gateway and the outgoing device. The ip command is the current iproute2 toolset and is present on modern distributions. The legacy tools route and netstat come from net-tools, which is often not installed.

Question 29Linux System Administration

A service must be prevented from starting at boot while still being startable manually. Which command accomplishes this?

  1. systemctl stop servicename
  2. systemctl disable servicename Correct answer.
  3. systemctl kill servicename
  4. systemctl mask servicename

Explanation

systemctl disable removes the unit's symlinks from the target's wants directory, so it is not pulled in at boot but can still be started on demand. Masking, by contrast, links the unit to /dev/null and prevents any start. Stopping only affects the current runtime state.

Question 30Linux System Administration

Which command changes the UUID of an ext4 filesystem on /dev/sdb2 to a newly generated random value?

  1. dumpe2fs -u /dev/sdb2
  2. tune2fs -U random /dev/sdb2 Correct answer.
  3. blkid -U random /dev/sdb2
  4. e2fsck -U /dev/sdb2

Explanation

tune2fs -U sets the filesystem UUID, and the special value random generates a new one. This is useful when cloning a disk produces duplicate UUIDs that confuse mount-by-UUID entries. The filesystem must be unmounted or remounted for the change to take effect reliably.

Question 31Linux System Administration

An administrator needs to grant a group write access to a directory via an ACL without changing the traditional permission bits. Which command sets the group ACL entry?

  1. getfacl -m g:devs:rwx /srv/project
  2. setfacl -m g:devs:rwx /srv/project Correct answer.
  3. chmod g+w /srv/project
  4. chgrp devs /srv/project

Explanation

setfacl -m adds or modifies an ACL entry; the g: prefix specifies a named group entry with the given permissions. This grants access to the devs group without altering the owning group bits. getfacl only displays ACLs, and chgrp changes ownership rather than granting permissions.

Question 32Linux System Administration

Which file must be edited to change the default umask applied to interactive login shells on a typical RHEL-based system?

  1. /etc/pam.d/umask
  2. /etc/bashrc
  3. /etc/profile
  4. /etc/login.defs Correct answer.

Explanation

On RHEL-based systems the login.defs file contains the UMASK directive that PAM's pam_umask module reads to set the default umask for login sessions. Changing it affects all users created afterward and login shells. Shell startup files like profile and bashrc can override the umask per shell, but login.defs is the system default.

Question 33Linux System Administration

Which command displays the contents of the kernel ring buffer, including boot-time hardware messages, on a systemd distribution?

  1. sysctl -a
  2. journalctl -b -k
  3. dmesg Correct answer.
  4. cat /var/log/messages

Explanation

dmesg reads the kernel ring buffer directly, showing boot-time hardware and driver messages. journalctl -b -k shows kernel messages from the current boot via the journal, which is similar but not the ring buffer itself. The question asks specifically for the ring buffer contents.

Question 34Linux System Administration

A server must resolve its own hostname to 127.0.0.1 before consulting DNS. Which file provides this static mapping?

  1. /etc/nsswitch.conf
  2. /etc/resolv.conf
  3. /etc/hostname
  4. /etc/hosts Correct answer.

Explanation

/etc/hosts is the static hostname-to-address table consulted by the resolver before DNS, depending on nsswitch.conf ordering. Adding an entry there resolves the name locally without a DNS query. resolv.conf lists DNS servers, and nsswitch.conf controls lookup order.

Question 35Linux System Administration

Which command creates a new LVM volume group named vgdata using physical volumes /dev/sdb and /dev/sdc?

  1. pvcreate vgdata /dev/sdb /dev/sdc
  2. lvcreate -n vgdata /dev/sdb /dev/sdc
  3. vgscan vgdata /dev/sdb /dev/sdc
  4. vgcreate vgdata /dev/sdb /dev/sdc Correct answer.

Explanation

vgcreate initializes the named volume group from one or more physical volumes, which must have been prepared with pvcreate beforehand. It records the group metadata and makes the space available for logical volumes. lvcreate creates logical volumes within an existing group.

Question 36Linux System Administration

Which command resizes an XFS filesystem on /dev/vg/lv to fill the underlying logical volume after the LV has been extended?

  1. xfs_repair /dev/vg/lv
  2. xfs_growfs /mountpoint Correct answer.
  3. mkfs.xfs -f /dev/vg/lv
  4. resize2fs /dev/vg/lv

Explanation

xfs_growfs grows an XFS filesystem and is invoked with the mount point of the mounted filesystem, not the device path. XFS supports online growth but not shrinking. resize2fs works only on ext-family filesystems.

Question 37Linux System Administration

A system must boot from a degraded software RAID 1 array without manual intervention. Which file should contain the array definition so initramfs can assemble it?

  1. /etc/mdadm.conf Correct answer.
  2. /etc/fstab
  3. /etc/raidtab
  4. /proc/mdstat

Explanation

mdadm.conf records array UUIDs and device lists so the initramfs and mdadm can assemble arrays automatically at boot, including degraded ones. The dracut or initramfs tooling reads it when building the image. fstab mounts filesystems but does not assemble arrays.

Question 38Linux System Administration

Which command tests whether a user can run a specific command under sudo without actually executing it?

  1. sudo -v
  2. sudo -S -u root id
  3. sudo -l -U alice Correct answer.
  4. sudo -k

Explanation

sudo -l -U alice lists the sudo rules that apply to the named user, showing which commands are permitted. The -U option selects the target user to query. sudo -v only refreshes the caller's timestamp, and sudo -k invalidates it.

Question 39Linux System Administration

Which command displays the capabilities assigned to the file /usr/bin/ping?

  1. getfattr -d /usr/bin/ping
  2. getcap /usr/bin/ping Correct answer.
  3. lsattr /usr/bin/ping
  4. capsh --print

Explanation

getcap queries the extended attributes that store Linux file capabilities and prints the capability set for the given file. File capabilities are stored in the security.capability extended attribute. capsh --print shows the shell's own capabilities, not a file's.

Question 40Linux System Administration

A system's clock drifts slowly despite chronyd running. Which command shows whether chronyd has synchronized and which source it is using?

  1. date -u
  2. chronyc sources -v Correct answer.
  3. timedatectl
  4. hwclock -r

Explanation

chronyc sources -v lists configured time sources, their reachability, and the selected source, which is the key diagnostic for synchronization. timedatectl shows the system time and NTP status summary but not per-source detail. hwclock and date only show clock values.

Question 41Networking

A Linux server must forward IPv4 packets between two interfaces, but the setting is not persistent across reboots. Which sysctl key should be written to a file under /etc/sysctl.d/ to enable forwarding permanently?

  1. net.ipv4.ip_nonlocal_bind
  2. net.ipv4.conf.all.rp_filter
  3. net.ipv4.ip_forward Correct answer.
  4. net.ipv4.conf.default.forwarding

Explanation

IPv4 packet forwarding is controlled by the net.ipv4.ip_forward sysctl; setting it to 1 makes the kernel route packets between interfaces. Files placed in /etc/sysctl.d/ ending in .conf are loaded at boot by systemd-sysctl, making the change persistent.

Question 42Networking

Which iproute2 command adds a secondary IPv4 address 192.0.2.50/24 to interface eth0 without removing the existing address?

  1. ip addr set 192.0.2.50/24 eth0
  2. ip route add 192.0.2.50/24 dev eth0
  3. ip addr add 192.0.2.50/24 dev eth0 Correct answer.
  4. ifconfig eth0 192.0.2.50 netmask 255.255.255.0

Explanation

The ip addr add subcommand attaches an additional address to an interface and leaves existing addresses in place. It is the modern iproute2 replacement for the legacy ifconfig alias syntax.

Question 43Networking

A host needs a default route via 203.0.113.1 on eth0. Which command installs it?

  1. ip route add default via 203.0.113.1 dev eth0 Correct answer.
  2. route default gateway 203.0.113.1
  3. ip route add 0.0.0.0/0 src 203.0.113.1
  4. ip addr add default via 203.0.113.1

Explanation

A default route is expressed as the destination default (or 0.0.0.0/0) with a via gateway and an egress device. ip route add is the standard iproute2 syntax for installing it.

Question 44Networking

Which file on a Debian/Ubuntu system traditionally holds static interface configuration read by ifupdown?

  1. /etc/netplan/50-cloud-init.yaml
  2. /etc/sysconfig/network-scripts/ifcfg-eth0
  3. /etc/NetworkManager/system-connections/eth0.nmconnection
  4. /etc/network/interfaces Correct answer.

Explanation

ifupdown reads /etc/network/interfaces to bring interfaces up and down. The other paths belong to Red Hat ifcfg scripts, Netplan, and NetworkManager keyfiles respectively.

Question 45Networking

Which command displays the kernel routing table for IPv6 only?

  1. ip -6 addr show
  2. ip -6 route show Correct answer.
  3. ip route show -4
  4. ip link show type v6

Explanation

The -6 flag selects the IPv6 address family, and route show prints the IPv6 routing table. Combining the family flag with the object is the reliable way to scope output.

Question 46Networking

Which tool sends ICMP echo requests and reports per-hop round-trip time along the path to a destination?

  1. tcpdump
  2. ss
  3. arp
  4. traceroute Correct answer.

Explanation

traceroute discovers each hop by incrementing the TTL and collecting ICMP Time Exceeded replies, reporting latency per hop. ss shows sockets, arp shows neighbor cache, and tcpdump captures packets.

Question 47Networking

Which directive in an unbound configuration enables it to answer recursive queries for local clients?

  1. access-control: 192.168.0.0/16 allow Correct answer.
  2. interface: recurse
  3. forward-zone: allow
  4. do-not-query-localhost: yes

Explanation

Unbound uses access-control statements to decide which clients may issue recursive queries. Without a matching allow rule, requests from that subnet are refused.

Question 48Networking

On a system using firewalld, which command permanently opens TCP port 8080 in the public zone?

  1. firewall-cmd --permanent --zone=public --add-port=8080/tcp Correct answer.
  2. iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
  3. firewall-cmd --zone=public --open=8080
  4. firewall-cmd --permanent --add-service=8080

Explanation

Ports are opened with --add-port in the form port/protocol, and --permanent writes the change to the zone configuration. A reload is then needed to activate the permanent rule.

Question 49Networking

A host has address 10.0.0.10/24 but cannot reach 10.0.1.20/24. Which check most directly confirms whether a route to the remote subnet exists?

  1. ss -tn state established
  2. ping -c1 10.0.0.1
  3. ip route get 10.0.1.20 Correct answer.
  4. ip neigh show 10.0.1.20

Explanation

ip route get performs a route lookup for a destination and reports the chosen route and source address. If it falls back to the default route or fails, the missing subnet route is confirmed.

Question 50Networking

Two hosts on the same /24 cannot communicate, and the neighbor table shows an incomplete entry. Which action most directly addresses a suspected ARP resolution failure?

  1. Disable the rp_filter sysctl on the router
  2. Verify both hosts are in the same broadcast domain and check for VLAN or switch port isolation Correct answer.
  3. Add a static default route on both hosts
  4. Change the MTU on both hosts to 9000

Explanation

ARP resolution requires both hosts to share a broadcast domain; VLAN separation or port isolation prevents the ARP request from reaching the peer. Confirming L2 adjacency is the correct first step before touching routing or sysctl settings.