I85PREP
⌘ K
LPIC-1 101-500 study materials
LPIC-1 101-500 study resources

LPIC-1 101-500 practice questions

One question at a time. Build your LPIC-1 101-500 understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1System Architecture

Where does a modern PC normally keep firmware settings such as the boot device order and whether virtualization extensions are enabled?

  1. In the /boot/grub/grub.cfg file
  2. In the first sector of the boot disk
  3. In NVRAM on the motherboard Correct answer.
  4. In the kernel image itself

Explanation

Settings that belong to the platform firmware, such as boot order, clock configuration and CPU feature toggles, are stored in non-volatile memory on the mainboard and edited through the firmware setup screen. The boot loader configuration and the kernel image are files on disk and play no part in storing those settings.

Question 2System Architecture

Which directory of the virtual filesystem presents the kernel's device, bus and driver model as a tree of directories and attribute files?

  1. /var
  2. /dev
  3. /sys Correct answer.
  4. /etc

Explanation

sysfs, mounted at /sys, exports the kernel object model so that every device, bus and driver appears as a directory with readable and sometimes writable attributes. /dev instead contains device nodes that programs open, not the kernel's internal device hierarchy.

Question 3System Architecture

Which command prints the contents of the kernel ring buffer, including hardware detection messages from the last boot?

  1. journalctl --list-boots
  2. dmesg Correct answer.
  3. cat /var/log/syslog
  4. lsmod

Explanation

The kernel writes boot and driver messages into an in-memory ring buffer, and dmesg is the tool that prints it. Log files and journal queries show what a logging daemon captured, which is not the same as reading the buffer directly.

Question 4System Architecture

In a SysV init system, which runlevel provides full multi-user operation with networking but without a graphical login?

  1. Runlevel 0
  2. Runlevel 1
  3. Runlevel 6
  4. Runlevel 3 Correct answer.

Explanation

The traditional numbering reserves 0 for halt, 1 for single-user mode, 6 for reboot, and 3 for the normal networked text console. Runlevel 5 is used on many distributions for the graphical environment.

Question 5System Architecture

Which systemd target corresponds to the traditional runlevel 3, that is, a networked multi-user system without a display manager?

  1. poweroff.target
  2. rescue.target
  3. multi-user.target Correct answer.
  4. network-online.target

Explanation

systemd maps the old runlevels onto targets: multi-user.target is the normal text-mode system with networking, while graphical.target adds the display manager. The other targets serve narrower special purposes.

Question 6System Architecture

What is the main purpose of an initramfs image?

  1. To provide an early userspace with drivers needed to mount root Correct answer.
  2. To collect kernel boot messages for later analysis by an administrator
  3. To keep the kernel configuration available for later reference
  4. To store a compressed copy of the boot loader configuration

Explanation

The initramfs is a small archive unpacked into memory by the kernel; it contains modules and tools such as LVM, RAID or encryption helpers that are needed to find and mount the real root filesystem before switching to it. After the switch it is normally discarded.

Question 7System Architecture

Which MBR partition type identifier marks a partition as Linux swap space?

  1. 0x83
  2. 0x82 Correct answer.
  3. 0x07
  4. 0x8e

Explanation

In a classic MBR partition table the single-byte type field distinguishes partition content: 0x82 means Linux swap, 0x83 plain Linux, 0x8e Linux LVM and 0x07 NTFS or exFAT. Tools such as fdisk show these values when printing the table.

Question 8System Architecture

Which command installs the GRUB boot loader into the boot area of /dev/sda on a BIOS-based system?

  1. grub-mkrescue /dev/sda
  2. update-grub /dev/sda
  3. grub-mkconfig -o /boot/grub/grub.cfg
  4. grub-install /dev/sda Correct answer.

Explanation

grub-install copies the boot loader stages to the target disk, using the MBR gap on BIOS systems or the EFI System Partition on UEFI systems. Generating menu entries is a separate step performed by grub-mkconfig.

Question 9System Architecture

Which file holds the variable GRUB_CMDLINE_LINUX, which grub-mkconfig adds to every generated kernel entry?

  1. /boot/grub/grub.cfg
  2. /etc/fstab
  3. /etc/default/grub Correct answer.
  4. /etc/grub.d/40_custom

Explanation

grub-mkconfig reads /etc/default/grub for user settings such as the timeout and the default kernel command line, then combines them with the templates in /etc/grub.d to write the final configuration. Keeping edits in /etc/default/grub means they survive regeneration.

Question 10System Architecture

Which command shows kernel uevents and the resulting udev processing in real time, for example while a USB device is plugged in?

  1. udevadm monitor Correct answer.
  2. journalctl --list-boots
  3. dmesg --follow
  4. lsusb --tree

Explanation

udevadm monitor subscribes to the kernel's event socket and prints both the raw uevents and the events udev generates after applying its rules, which makes it the standard tool for observing hotplug handling. dmesg shows driver messages but not udev's rule processing.

Question 11System Architecture

In which directory are administrator-created udev rules normally placed?

  1. /etc/init.d
  2. /usr/lib/udev/rules.d
  3. /etc/udev/rules.d Correct answer.
  4. /lib/modules

Explanation

Local rules go into /etc/udev/rules.d and are read in lexical order; distribution-provided rules live in /usr/lib/udev/rules.d and can be overridden by a file of the same name in /etc. Rules are re-read when udev is reloaded or the system boots.

Question 12System Architecture

Which file in /proc lists the I/O port ranges that drivers have registered for their devices?

  1. /proc/interrupts
  2. /proc/dma
  3. /proc/meminfo
  4. /proc/ioports Correct answer.

Explanation

/proc/ioports reports the port address ranges claimed by each driver, which is useful when diagnosing an address conflict between two devices. Interrupt lines and legacy DMA channels are reported in separate files.

Question 13System Architecture

Which GRUB 2 command loads a Linux kernel image from the boot partition so that it can be started?

  1. set
  2. initrd
  3. linux Correct answer.
  4. chainloader

Explanation

In GRUB 2 the linux command loads the kernel and takes its command line as arguments, while initrd loads the matching initramfs afterwards. Only after both are loaded does the boot command transfer control to the kernel.

Question 14System Architecture

Which command makes graphical.target the default boot target for all future boots?

  1. systemctl enable graphical.target
  2. systemctl set-default graphical.target Correct answer.
  3. systemctl isolate graphical.target
  4. systemctl start graphical.target

Explanation

set-default rewrites the default.target symlink so that the chosen target is started on the next boot. isolate changes only the currently running target and leaves the default untouched.

Question 15System Architecture

On a Debian-based system using SysV init, in which directory are the service control scripts located?

  1. /etc/rc.local
  2. /usr/lib/systemd/system
  3. /etc/systemd/system
  4. /etc/init.d Correct answer.

Explanation

SysV init runs scripts stored in /etc/init.d and links them into per-runlevel directories such as /etc/rc3.d to select which services start. The init scripts themselves accept start, stop, restart and status arguments.

Question 16System Architecture

Where does GPT keep its backup copy of the partition table?

  1. In the /boot filesystem
  2. In the first sector of the disk
  3. At the end of the disk Correct answer.
  4. In the extended boot record

Explanation

GPT writes a primary header and partition entry array near the beginning of the disk and a duplicate at the last usable sector, so a damaged primary copy can be repaired from the backup with tools such as gdisk. This redundancy is one of the advantages over MBR.

Question 17System Architecture

Which tool generates the initramfs image on Fedora and RHEL systems?

  1. mkinitcpio
  2. dracut Correct answer.
  3. grub2-mkconfig
  4. update-initramfs

Explanation

dracut builds the initramfs from the running system's modules and configuration, writing the result to /boot. Its options differ from the distribution-specific tools used elsewhere, so the correct choice depends on the distribution family.

Question 18System Architecture

Which kernel parameter specifies the device that should be mounted as the root filesystem at boot?

  1. init=
  2. root= Correct answer.
  3. rdinit=
  4. vga=

Explanation

root= names the block device, for example root=/dev/sda2 or root=UUID=..., that the kernel or initramfs mounts as /. The init= parameter instead names the first program executed in the real root after mounting.

Question 19System Architecture

Which of the following commands performs an orderly shutdown and then removes power from the machine?

  1. poweroff Correct answer.
  2. init 6
  3. shutdown -H now
  4. reboot

Explanation

poweroff stops services cleanly and then signals the hardware through ACPI to cut power. Halting with shutdown -H stops the CPU but may leave the power supply on, which is the key difference.

Question 20System Architecture

Which file lists the filesystems, mount points and options used to mount the non-root filesystems after the root filesystem is up?

  1. /etc/fstab Correct answer.
  2. /etc/crypttab
  3. /etc/mtab
  4. /proc/mounts

Explanation

/etc/fstab is the administrator-maintained table read by mount and by the boot process to bring up remaining filesystems, including swap. It also carries the dump and fsck order fields.

Question 21System Architecture

In GRUB 2 device naming, what does (hd0,gpt3) identify?

  1. Partition 3 on the first GPT disk Correct answer.
  2. Partition 1 on the third GPT disk
  3. Logical partition 3 on the first disk
  4. The third GPT disk in the system

Explanation

GRUB numbers disks from zero in firmware enumeration order and appends the partition number, with gpt or msdos indicating the partition table type. The first number is therefore the disk and the second the partition on that disk.

Question 22System Architecture

Which systemd target mounts the root filesystem read-only and starts only the most minimal services?

  1. rescue.target
  2. sysinit.target
  3. multi-user.target
  4. emergency.target Correct answer.

Explanation

emergency.target is the most minimal mode: the root filesystem is mounted read-only and only a root shell is offered, which makes it useful when the disk must not be modified. rescue.target goes further and mounts filesystems read-write with basic services.

Question 23System Architecture

Which command creates a new entry in the UEFI boot manager so that the firmware can start a Linux boot loader?

  1. efibootmgr -v
  2. grub-install --recheck
  3. efibootmgr -c Correct answer.
  4. bootctl list

Explanation

efibootmgr writes Boot#### variables into the firmware's non-volatile store, and -c creates a new one pointing at a loader file on a specified disk and partition. Listing existing entries and reinstalling boot files do not add a new boot variable.

Question 24System Architecture

Why is /boot frequently placed on a separate, unencrypted partition when the root filesystem is encrypted?

  1. Because the Linux kernel cannot reside on any encrypted block device
  2. Because the boot loader must read the kernel before the root is decrypted Correct answer.
  3. Because /boot is required to be mounted read-only during normal operation
  4. Because GRUB cannot load a kernel from a filesystem that is not encrypted

Explanation

At boot the firmware and boot loader execute before any root-device decryption happens, so they must be able to read the kernel and initramfs from storage that is accessible at that moment. Placing them on a plain /boot partition, or teaching GRUB to decrypt, solves that ordering problem.

Question 25System Architecture

Which command asks the kernel to re-emit uevents for devices that already exist, so that udev applies its rules to them again?

  1. udevadm settle
  2. udevadm trigger Correct answer.
  3. udevadm control
  4. udevadm info

Explanation

udevadm trigger replays events for devices present in sysfs, which is how coldplug devices are processed after udev starts or after rules change. It only requests events; the other subcommands wait for, query or configure the daemon.

Question 26System Architecture

Which directory in a Linux system contains files such as cpuinfo, meminfo and interrupts that report kernel and hardware information?

  1. /proc Correct answer.
  2. /sys
  3. /dev
  4. /etc

Explanation

The proc filesystem is mounted at /proc and presents kernel and process data as virtual files that are generated on access. Files such as cpuinfo and meminfo therefore exist only in memory and always reflect the current state.

Question 27System Architecture

Which command lists the USB devices attached to the system together with their vendor and product identifiers?

  1. lspci
  2. lsmod
  3. lsusb Correct answer.
  4. lsblk

Explanation

lsusb reads the USB bus information and prints one line per device, including the vendor and product ID in hexadecimal form. It is the USB counterpart of lspci.

Question 28System Architecture

Which command displays the kernel modules that are currently loaded, along with their size and usage count?

  1. depmod
  2. lsmod Correct answer.
  3. insmod
  4. modinfo

Explanation

lsmod prints the contents of /proc/modules in a readable table with the module name, its memory size and how many other modules use it. It only reports modules that are already resident in the kernel.

Question 29System Architecture

In the traditional SysV init scheme, which runlevel is used to halt the system?

  1. 0 Correct answer.
  2. 3
  3. 6
  4. 1

Explanation

Runlevel 0 is defined as system halt, so init stops all services and then tells the kernel to power off. Runlevel 6 is reserved for reboot and runlevel 1 for single-user mode.

Question 30System Architecture

Which command displays the default target that systemd will boot into?

  1. systemctl default
  2. systemctl get-default Correct answer.
  3. systemctl show-default
  4. systemctl list-targets

Explanation

systemctl get-default prints the name of the target unit that default.target links to, which is the target reached at the end of boot. Changing it requires set-default rather than get-default.

Question 31System Architecture

Which command prints the contents of the kernel ring buffer, including hardware detection messages generated during boot?

  1. uptime
  2. last
  3. who
  4. dmesg Correct answer.

Explanation

dmesg dumps the kernel ring buffer, which stores messages emitted by the kernel and its drivers, including device probing at boot time. Access may be restricted by the kernel.dmesg_restrict sysctl parameter.

Question 32System Architecture

What is the name of the firmware routine that tests and initializes hardware before a boot loader is started?

  1. MBR
  2. GRUB
  3. POST Correct answer.
  4. initramfs

Explanation

The power-on self-test runs from firmware immediately after power is applied and verifies that essential hardware such as memory and processors is functional. Only after it finishes does the firmware hand control to a boot loader.

Question 33System Architecture

Which file did traditional SysV init read to determine the default runlevel?

  1. /etc/init.d/rc
  2. /etc/default/grub
  3. /etc/inittab Correct answer.
  4. /etc/rc.local

Explanation

The init daemon parsed /etc/inittab at startup and used the initdefault entry to select the runlevel to enter. On systems using systemd the equivalent setting is the default.target symbolic link.

Question 34System Architecture

How many primary partitions can a disk with an MBR partition table hold at most?

  1. 2
  2. 16
  3. 4 Correct answer.
  4. 8

Explanation

The MBR partition table has room for exactly four 16-byte entries, so only four primary partitions can exist. If more are needed, one entry is used as an extended partition that contains logical partitions.

Question 35System Architecture

Which command loads a kernel module together with any modules it depends on?

  1. rmmod
  2. insmod
  3. modprobe Correct answer.
  4. modinfo

Explanation

modprobe consults the dependency information generated by depmod and loads the requested module plus everything it needs. It also applies options and blacklist rules configured under /etc/modprobe.d.

Question 36System Architecture

Which file can an administrator create to stop modprobe from loading a particular kernel module automatically?

  1. /etc/modprobe.d/blacklist.conf Correct answer.
  2. /etc/modules
  3. /etc/default/modules
  4. /etc/sysctl.conf

Explanation

Configuration files in /etc/modprobe.d may contain blacklist lines that prevent modprobe from loading a module when it is requested as an alias. The file name is arbitrary as long as it ends in .conf and lives in that directory.

Question 37System Architecture

Which command prints every kernel parameter that is currently available through sysctl?

  1. sysctl -n
  2. sysctl -a Correct answer.
  3. sysctl -w
  4. sysctl -p

Explanation

The -a option makes sysctl dump all currently known parameters and their values. Other options are used to change values or to alter the output format.

Question 38System Architecture

Which file reports, for each IRQ line, how many interrupts have been handled by each CPU?

  1. /proc/interrupts Correct answer.
  2. /proc/devices
  3. /proc/softirqs
  4. /proc/ioports

Explanation

The proc file /proc/interrupts contains one row per interrupt line with a counter for every processor, plus the driver that registered the handler. It is the standard way to check whether a device is generating interrupts.

Question 39System Architecture

Which systemd unit type starts a service on demand when traffic arrives on a network port?

  1. .mount
  2. .target
  3. .socket Correct answer.
  4. .timer

Explanation

A socket unit owns a network or UNIX socket and activates the associated service unit only when a connection or datagram arrives. This socket activation lets services start lazily and be restarted without losing the listening socket.

Question 40System Architecture

Which command switches the running system immediately to the rescue target, stopping units that are not required by it?

  1. systemctl enable rescue.target
  2. systemctl start rescue.target
  3. systemctl set-default rescue.target
  4. systemctl isolate rescue.target Correct answer.

Explanation

isolate starts the named target and stops everything that is not part of its dependency tree, which is how runlevel changes are performed under systemd. Without isolate the target's units are merely started alongside the current ones.

Question 41System Architecture

Which command shows log entries from the current boot only?

  1. journalctl -b Correct answer.
  2. journalctl -n 20
  3. journalctl -f
  4. journalctl --since today

Explanation

The -b option limits journal output to messages recorded since the last system start, and a numeric offset such as -b -1 selects an earlier boot. Other options filter by count, time or follow mode instead of by boot.

Question 42System Architecture

Which command configures a unit so that it is started automatically at boot by creating the required symbolic links?

  1. systemctl mask
  2. systemctl enable Correct answer.
  3. systemctl start
  4. systemctl daemon-reload

Explanation

enable reads the [Install] section of a unit and creates the links that connect it to the appropriate target's wants or requires directory under /etc/systemd/system. It does not start the unit right away.

Question 43System Architecture

Which command reports the total time spent in firmware, the boot loader and userspace during the most recent boot?

  1. systemd-analyze Correct answer.
  2. systemd-analyze critical-chain
  3. systemd-analyze verify
  4. systemd-analyze blame

Explanation

Run without arguments, systemd-analyze prints a startup summary that splits the boot into firmware, loader, kernel and userspace phases. Additional subcommands drill into individual units or configuration problems.

Question 44System Architecture

Which command lists block devices in a tree, showing their size, type and mount point?

  1. lsblk Correct answer.
  2. df -h
  3. fdisk -l
  4. mount

Explanation

lsblk reads sysfs and prints all block devices in a parent-child tree, including size, type, name and, where applicable, the mount point. It shows empty devices that hold no filesystem as well.

Question 45System Architecture

Which command prints total, used and available memory together with buffer and cache usage in human-readable units?

  1. du -sh
  2. vmstat
  3. top
  4. free -h Correct answer.

Explanation

free summarises the memory figures taken from /proc/meminfo, and the -h option scales the values to KiB, MiB and GiB. It distinguishes buffers and cache from memory actually consumed by processes.

Question 46System Architecture

Which mechanism allows a new kernel to be loaded and started from the running kernel without going through the firmware boot process?

  1. kexec Correct answer.
  2. kprobe
  3. kdump
  4. kmod

Explanation

kexec loads a kernel image into memory and jumps to it directly, skipping firmware initialization and shortening the reboot. It is commonly used together with kdump so that a crash kernel can be started after a panic.

Question 47System Architecture

Which command rebuilds the modules.dep file that records the dependencies between kernel modules?

  1. modprobe
  2. modinfo
  3. insmod
  4. depmod Correct answer.

Explanation

depmod scans the module tree under /lib/modules and writes modules.dep and its associated index files so that modprobe can resolve dependencies. It is normally run automatically after a kernel or module package is installed.

Question 48System Architecture

Which command saves the contents of memory to the swap area and powers the machine down, restoring the saved state at the next start?

  1. systemctl poweroff
  2. systemctl suspend
  3. systemctl hibernate Correct answer.
  4. systemctl hybrid-sleep

Explanation

hibernate writes an image of memory to swap and then powers off, so the state survives without power. On resume the kernel reads the image back and the session continues where it stopped.

Question 49System Architecture

Which command displays, as a tree, the units that a given unit pulls in through its dependency declarations?

  1. systemctl list-dependencies Correct answer.
  2. systemctl status
  3. systemctl list-units
  4. systemctl list-unit-files

Explanation

list-dependencies walks the Requires, Wants and similar relationships of the named unit and prints the resulting tree. The output shows what will be started or stopped together with that unit.

Question 50System Architecture

Which command reboots the machine in 15 minutes after warning every logged-in user?

  1. shutdown -r +15 Correct answer.
  2. shutdown -c +15
  3. shutdown -k +15
  4. shutdown -h +15

Explanation

The -r option selects a reboot and the +15 form schedules it relative to the current time, while the default message is broadcast to all terminals. The scheduled action can still be called off with -c before it runs.