I85PREP
⌘ K
LPIC-2 201-450 study materials
LPIC-2 201-450 study resources

LPIC-2 201-450 practice questions

One question at a time. Build your LPIC-2 201-450 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Capacity Planning

Which command displays a snapshot of virtual memory statistics including processes, memory, paging, block I/O, and CPU activity, with the first report line showing averages since boot?

  1. vmstat Correct answer.
  2. pidstat
  3. iostat
  4. mpstat

Explanation

vmstat reports virtual memory, process, paging, block I/O, and CPU statistics; when no interval is given, its first line reflects averages since boot. iostat focuses on device I/O and CPU, mpstat reports per-CPU activity, and pidstat targets per-process statistics.

Question 2Capacity Planning

Which file provides the system load averages for the last 1, 5, and 15 minutes?

  1. /proc/vmstat
  2. /proc/meminfo
  3. /proc/loadavg Correct answer.
  4. /proc/stat

Explanation

/proc/loadavg contains the running and total process counts along with the 1-, 5-, and 15-minute load averages. /proc/meminfo reports memory use, /proc/stat exposes cumulative CPU counters, and /proc/vmstat reports virtual memory events.

Question 3Capacity Planning

A server has four logical CPUs and its 15-minute load average is 8.00. What does this most likely indicate?

  1. The load average is invalid because it exceeds the number of CPUs.
  2. Memory pressure is the sole cause because the load average counts only swapped pages and nothing else.
  3. The system has ample CPU headroom because load is measured per core.
  4. CPU contention exists; the run queue is roughly twice the core count. Correct answer.

Explanation

The load average counts runnable plus uninterruptible tasks, so it must be compared with the number of logical CPUs. A 15-minute load of 8.00 on four CPUs means roughly twice as many tasks are demanding CPU as the system can run concurrently, indicating contention.

Question 4Capacity Planning

In sar -u 1 5 output, which field rising sharply alongside low %idle suggests processes are blocked waiting for storage rather than consuming CPU?

  1. %system
  2. %user
  3. %iowait Correct answer.
  4. %nice

Explanation

%iowait is the percentage of time CPUs were idle while at least one outstanding disk I/O request existed. A sharp rise in %iowait with low %idle points to storage latency or saturation, whereas %user, %system, and %nice reflect CPU execution time.

Question 5Capacity Planning

In free -m output on a modern Linux system, which column best estimates how much memory can be allocated to new applications without causing swapping?

  1. free
  2. used
  3. available Correct answer.
  4. buff/cache

Explanation

The available column estimates memory that can be given to new processes without swapping because it includes reclaimable page cache while excluding swap. The free column counts only completely unused memory, and buff/cache is reclaimable but not directly the same as available.

Question 6Capacity Planning

iostat -x reports %util of 99% and await of 250 ms for /dev/sdb, while CPU idle is high. What is the most accurate capacity conclusion?

  1. The sdb device is saturated; I/O requests are queueing and disk capacity needs attention. Correct answer.
  2. The CPU is the primary bottleneck and should be upgraded before any storage changes are considered.
  3. The network interface is dropping packets, which causes retransmissions and inflated await values.
  4. The memory subsystem is failing because await directly measures RAM access latency.

Explanation

%util near 100% means the block device was busy almost continuously, and a high await indicates requests spent a long time waiting in the queue. Together they point to storage saturation, so adding disk capacity, spreading I/O across devices, or reducing load is appropriate.

Question 7Capacity Planning

Within the sysstat toolkit, which program collects system activity data and writes it in a binary format that sar can later read?

  1. sa2
  2. sar
  3. sadc Correct answer.
  4. sa1

Explanation

sadc is the system activity data collector; it samples activity and writes binary records that sar later reports on. sa1 and sa2 are wrapper scripts used by cron or systemd timers, while sar is the reporting front end.

Question 8Capacity Planning

Which interactive command allows an administrator to view and sort processes by CPU or memory usage in real time to identify capacity consumers?

  1. iostat
  2. top Correct answer.
  3. vmstat
  4. free

Explanation

top provides a live, interactive process view and can sort by CPU or memory usage, making it useful for finding current capacity consumers. vmstat, iostat, and free produce summaries or snapshots rather than an interactive per-process list.

Question 9Capacity Planning

Historical sar data shows disk utilization for /data increasing from 40% to 75% over three months with steady growth. What is the best capacity planning action?

  1. Replace all disks immediately without analyzing the observed trend.
  2. Disable sar collection to reduce the I/O overhead causing the growth.
  3. Delete the sar history because historical data cannot predict future usage.
  4. Project the trend and plan more storage or workload redistribution before saturation. Correct answer.

Explanation

Capacity planning uses historical trends to project when a resource will reach a threshold, allowing planned expansion or load redistribution. Deleting history, replacing hardware blindly, or disabling monitoring removes the data needed for a defensible forecast.

Question 10Capacity Planning

Which command provides a summary of socket statistics, including TCP, UDP, and raw sockets, without listing every connection?

  1. netstat -r
  2. ip -s link
  3. ss -t
  4. ss -s Correct answer.

Explanation

ss -s prints a summary of socket statistics grouped by protocol, giving counts without dumping every connection. ss -t lists TCP sockets, netstat -r shows the routing table, and ip -s link reports interface-level packet statistics.

Question 11Capacity Planning

Which procfs file should be sampled over time to obtain per-interface receive and transmit byte and packet counters for network capacity trending?

  1. /proc/net/arp
  2. /proc/net/tcp
  3. /proc/net/dev Correct answer.
  4. /proc/net/route

Explanation

The /proc/net/dev file lists each network interface with RX and TX byte, packet, error, and drop counters. Sampling it over time gives interface throughput and error trends that support network capacity planning. The other files describe routing, TCP sockets, and ARP entries rather than per-interface counters.

Question 12Capacity Planning

A filesystem still has free data blocks but is refusing new files because it has run out of inodes. Which df invocation should be used to confirm inode exhaustion and track it over time?

  1. df -i Correct answer.
  2. df -h
  3. df -a
  4. df -T

Explanation

The df -i form reports inode usage and free inodes for each mounted filesystem, which directly confirms inode exhaustion. Block usage from df -h can look healthy while inode allocation is at 100 percent. Monitoring inode use over time prevents unexpected file-creation failures.

Question 13Capacity Planning

Which sysstat utility reports per-process CPU, memory, and block I/O statistics at repeated intervals so that a single growing process can be identified?

  1. pidstat Correct answer.
  2. sar -n DEV
  3. vmstat 1
  4. iostat -x

Explanation

pidstat belongs to the sysstat package and can report per-process CPU, memory, and I/O counters at a chosen interval. That per-process detail is useful when a single application is driving capacity growth. iostat, vmstat, and sar -n DEV report device, system-wide, or network statistics rather than per-process breakdowns.

Question 14Capacity Planning

When using sar -n DEV 1 5 to plan network capacity, which pair of fields reports interface throughput in kilobytes per second rather than packet counts?

  1. rxpck/s and txpck/s
  2. rxkB/s and txkB/s Correct answer.
  3. rxerr/s and txerr/s
  4. rxcmp/s and txcmp/s

Explanation

In sar -n DEV output, rxkB/s and txkB/s express received and transmitted throughput in kilobytes per second. Those rates are suitable for comparing interface utilization with link speed. The pck fields count packets, err fields count errors, and cmp fields relate to compressed packets.

Question 15Capacity Planning

df reports a data filesystem as 100 percent full, but du sums only about half of the used space. Processes are suspected of holding deleted files open. Which command lists open files whose link count is zero?

  1. fuser -m /data
  2. du -sh /data
  3. df -h /data
  4. lsof +L1 Correct answer.

Explanation

The lsof +L1 selection lists open files with a link count below one, which is typical for deleted files still held by a process. Such files consume blocks until the process closes them or is restarted, explaining the df and du discrepancy. df, du, and fuser do not provide that link-count filter.

Question 16Capacity Planning

mpstat -P ALL 1 5 shows CPU 7 at 100 percent busy while the other seven logical CPUs are nearly idle. Which interpretation is most consistent with this per-CPU profile?

  1. Disk queue depth is too high
  2. Network packets are being dropped
  3. The system is swapping heavily
  4. A single busy thread is limited by one CPU Correct answer.

Explanation

A per-CPU view with one saturated logical CPU and the rest idle usually points to a single-threaded or poorly parallelized workload pinned to that CPU. Adding cores will not help until the application is parallelized or the work is spread across processes. Swap, disk queue, and network drop counters would need separate evidence.

Question 17Capacity Planning

In sar -b output, which field reports the number of write requests issued to block devices per second, making it useful for tracking rising write pressure?

  1. bwrtn/s
  2. wtps Correct answer.
  3. rtps
  4. tps

Explanation

The wtps field counts write transfers per second issued to block devices, while tps is total transfers and rtps is read transfers. bwrtn/s reports blocks written per second, which measures volume rather than request count. Tracking wtps helps separate rising request pressure from larger individual writes.

Question 18Capacity Planning

A host has 16 GiB of RAM and 4 GiB of swap. vm.overcommit_memory is set to 2 and vm.overcommit_ratio is 50. What is the approximate CommitLimit for this host?

  1. 10 GiB
  2. 12 GiB Correct answer.
  3. 8 GiB
  4. 20 GiB

Explanation

With overcommit_memory set to 2, CommitLimit is approximately swap plus the overcommit_ratio percentage of physical RAM. Here that is 4 GiB plus 50 percent of 16 GiB, or 4 GiB plus 8 GiB, giving 12 GiB. The limit constrains how much virtual memory can be committed when strict overcommit accounting is enabled.

Question 19Capacity Planning

Which sar option reports swap space utilization values such as kbswpfree, kbswpused, and percent swpused for capacity planning?

  1. sar -W
  2. sar -r
  3. sar -B
  4. sar -S Correct answer.

Explanation

The sar -S option reports swap space utilization, including free, used, and percent-used swap values. It answers how much configured swap remains, whereas sar -W reports swapping activity and sar -r reports memory utilization. sar -B reports paging statistics.

Question 20Capacity Planning

Before concluding that bandwidth is the network bottleneck, which command should be used to inspect interface error and drop counters?

  1. ethtool -i eth0
  2. ss -lnt
  3. netstat -i Correct answer.
  4. ip route show

Explanation

netstat -i displays per-interface packet, error, and drop counters, which can reveal corruption or overruns that mimic bandwidth exhaustion. ip route show only prints routes, ethtool -i reports driver information, and ss -lnt lists listening TCP sockets. Checking errors and drops prevents misattributing a link-quality problem to capacity.

Question 21Capacity Planning

Which sar option produces a historical report of filesystem block and inode utilization that can be used to trend storage capacity?

  1. -v
  2. -b
  3. -r
  4. -F Correct answer.

Explanation

sar -F reports filesystem statistics such as total and free blocks, total and free inodes, and percent-used values, so repeated samples show how filesystem consumption changes over time. The other reports cover block I/O, memory, or kernel tables rather than mounted filesystem capacity.

Question 22Capacity Planning

An administrator needs long-term samples of kernel table consumption, including open file handles and inode cache entries, to plan resource limits. Which sar option provides those counters?

  1. -q
  2. -v Correct answer.
  3. -S
  4. -n SOCK

Explanation

sar -v reports kernel table statistics including dentunusd, file-nr, inode-nr, and pty-nr, which indicate pressure on kernel-managed resources. Use it rather than queue, swap-space, or socket summaries when the concern is descriptor and inode-table growth.

Question 23Capacity Planning

Which sar report should be scheduled to trend TCP connection establishment rates when sizing a front-end server for peak request bursts?

  1. -n ED
  2. -n SOCK
  3. -n TCP Correct answer.
  4. -n DEV

Explanation

sar -n TCP reports active/s and passive/s, the rates of locally initiated and remotely initiated TCP connections, along with segment rates. Those connection rates help size listen queues and server capacity, while DEV, ED, and SOCK report interface traffic, errors, and socket allocation.

Question 24Capacity Planning

A volume group must be checked for unallocated physical extents before a logical volume is extended for growth. Which command reports VSize and VFree for that decision?

  1. lvdisplay --maps
  2. vgs --units g Correct answer.
  3. pvs --units g
  4. lvs --units g

Explanation

vgs summarizes each volume group with VSize, VFree, and related extent counts, so it shows whether enough free extents remain in the group. pvs and lvs show physical volume and logical volume detail, while lvdisplay --maps shows segment mapping rather than remaining VG capacity.

Question 25Capacity Planning

A 10 GbE interface reports rxkB/s of 1,000,000 in a sar -n DEV sample. Assuming 1 kB equals 1024 bytes and decimal network rates, what is the approximate receive utilization?

  1. 100 percent
  2. 125 percent
  3. 8 percent
  4. 80 percent Correct answer.

Explanation

1,000,000 kB/s is about 1,024,000,000 bytes/s, or roughly 8.2 Gb/s after multiplying by 8. Against a 10 Gb/s interface that is approximately 80 percent receive utilization, leaving limited headroom for bursts.

Question 26Capacity Planning

Which command is best suited to identify the processes consuming the most disk I/O bandwidth during a capacity investigation on a running Linux system?

  1. free -m
  2. vmstat 1
  3. iotop -o Correct answer.
  4. mpstat -P ALL 1

Explanation

iotop reads per-process I/O accounting and with -o displays only processes actively doing I/O, which directly identifies top disk consumers. vmstat, mpstat, and free summarize system-wide block, CPU, and memory state without attributing I/O to individual processes.

Question 27Capacity Planning

A /data filesystem holds 1.2 TB of used space on a 2.0 TB volume and is growing by 100 GB per month. If the operational warning threshold is 80 percent used, how many months remain before the threshold is reached?

  1. 6 months
  2. 4 months Correct answer.
  3. 8 months
  4. 2 months

Explanation

Eighty percent of 2.0 TB is 1.6 TB, so the filesystem can grow by 0.4 TB, or 400 GB, before reaching the threshold. At 100 GB per month, 400 GB of growth corresponds to 4 months.

Question 28Capacity Planning

Repeated sar -B samples show high majflt/s, sustained pgscank/s and pgscand/s, and %vmeff below 10 percent. What is the most appropriate capacity-planning conclusion?

  1. Disk throughput is the sole bottleneck, so replacing the storage subsystem will eliminate the major faults.
  2. Swap space is overprovisioned; reducing the swap area will improve reclaim efficiency.
  3. The page cache is oversized; dropping caches before buying memory will improve reclaim efficiency.
  4. The active working set exceeds RAM; reclaim is inefficient, so adding memory should reduce paging. Correct answer.

Explanation

High major fault and scan rates with low %vmeff mean the kernel is scanning many pages but reclaiming few useful ones, a sign of memory pressure rather than a swap sizing issue. Adding RAM raises the resident working set that can be held, reducing reclaim scans and major faults.

Question 29Linux Kernel

Which command inserts a single kernel object file given by path and does not resolve module dependencies?

  1. modprobe
  2. modinfo
  3. insmod Correct answer.
  4. depmod

Explanation

insmod loads exactly the .ko file named on the command line and leaves dependency resolution to the administrator. modprobe instead consults modules.dep and loads required prerequisites automatically before inserting the requested module.

Question 30Linux Kernel

Which virtual filesystem is normally mounted at /sys and exposes kernel objects, drivers, and device attributes as directories and files?

  1. procfs
  2. tmpfs
  3. sysfs Correct answer.
  4. devtmpfs

Explanation

sysfs is mounted at /sys and represents kernel objects and their attributes, including devices and driver information. procfs is normally at /proc and exposes process and kernel status information in a different layout.

Question 31Linux Kernel

In a bootloader configuration, which kernel command-line parameter specifies the device that the kernel should mount as the root filesystem?

  1. root=/dev/sda2 Correct answer.
  2. init=/dev/sda2
  3. boot=/dev/sda2
  4. mount=/dev/sda2

Explanation

The root= parameter tells the kernel which block device or filesystem specification to use for the root filesystem. The init= parameter instead names the program to run as the first userspace process after mounting the root filesystem.

Question 32Linux Kernel

An administrator wants udev to stop loading the pcspkr module automatically, but still wants to be able to load it manually with modprobe pcspkr. Which directive in a file under /etc/modprobe.d achieves this?

  1. options pcspkr disabled=1
  2. install pcspkr /bin/false
  3. alias pcspkr off
  4. blacklist pcspkr Correct answer.

Explanation

The blacklist directive prevents automatic loading through udev while still permitting an explicit modprobe pcspkr command. The alias off and install directives are stronger blocks that interfere with manual loading or replace the load action.

Question 33Linux Kernel

Which directory is read for drop-in files that set kernel parameters persistently on a systemd-based Linux system?

  1. /etc/modprobe.d
  2. /etc/default/grub
  3. /etc/modules-load.d
  4. /etc/sysctl.d Correct answer.

Explanation

Drop-in files under /etc/sysctl.d with a .conf suffix are read by systemd-sysctl and applied at boot to set kernel parameters persistently. The other directories configure module options, modules to load, or bootloader defaults rather than sysctl parameters.

Question 34Linux Kernel

On Debian and Ubuntu systems, which command rebuilds the initramfs for the currently running kernel after a module configuration change?

  1. mkinitrd --force
  2. dracut --regenerate-all
  3. update-initramfs -u Correct answer.
  4. mkinitcpio --allpresets

Explanation

Debian and Ubuntu use update-initramfs, and the -u option updates the existing initramfs image for the current kernel. The other commands are associated with different distributions or with generating images for multiple kernels rather than the Debian current-kernel update workflow.

Question 35Linux Kernel

After configuring a kernel source tree with menuconfig, which sequence builds the kernel image, installs modules, and installs the kernel on a typical Linux system?

  1. make install; make; make modules_install
  2. make; make modules_install; make install Correct answer.
  3. make install; make modules_install; make
  4. make modules_install; make; make install

Explanation

The build must run make before modules can be installed, and modules_install must copy modules into /lib/modules before the kernel image and bootloader entries are installed. The final make install copies the kernel image and typically updates the bootloader configuration.

Question 36Linux Kernel

Which command reads a module file's metadata and prints only the names of modules it depends on?

  1. lsmod foo
  2. modprobe --show-depends foo
  3. modinfo -F depends foo Correct answer.
  4. depmod -n foo

Explanation

modinfo -F depends extracts the depends field from the module file metadata and prints only the dependency names. modprobe --show-depends resolves and displays the commands used to load a module, which is not limited to the metadata depends field.

Question 37Linux Kernel

A 5.10.0 kernel source tree is configured with CONFIG_LOCALVERSION="-custom". After building with make and running make modules_install, where are the modules installed?

  1. /lib/modules/5.10.0
  2. /lib/modules/5.10.0-custom Correct answer.
  3. /usr/src/linux-5.10.0-custom
  4. /boot/modules/5.10.0-custom

Explanation

CONFIG_LOCALVERSION appends its string to the kernel release, so the installed module directory includes the -custom suffix. The running kernel reports the same combined release through uname -r, and modules must match that release for modprobe to find them.

Question 38Linux Kernel

To pass the parameter max_bonds=2 to the bonding module every time it is loaded by modprobe, which line should be placed in a file under /etc/modprobe.d?

  1. options max_bonds=2 bonding
  2. options bonding max_bonds=2 Correct answer.
  3. install bonding /sbin/modprobe bonding
  4. alias bonding max_bonds=2

Explanation

The options directive is followed by the module name and the parameters modprobe should append when inserting that module. Here, options bonding max_bonds=2 causes max_bonds=2 to be supplied each time modprobe loads bonding.

Question 39Linux Kernel

Which command displays the contents of the kernel ring buffer, where boot-time driver and hardware messages are recorded?

  1. uptime
  2. free
  3. lspci
  4. dmesg Correct answer.

Explanation

dmesg reads the kernel ring buffer, which records boot-time hardware detection, driver initialization, and later kernel messages. It is the standard first place to inspect when a driver or device fails during startup.

Question 40Linux Kernel

Which command lists currently loaded kernel modules together with their size, reference count, and dependencies?

  1. lsmod Correct answer.
  2. modinfo
  3. lspci
  4. depmod

Explanation

lsmod reads /proc/modules and lists each loaded module with its memory size, reference count, and dependent modules. It is the quick way to confirm whether a driver is currently loaded.

Question 41Linux Kernel

After adding a module file under /lib/modules/$(uname -r)/kernel/drivers/, which command regenerates modules.dep, modules.alias, and related dependency metadata for that kernel?

  1. insmod
  2. depmod Correct answer.
  3. modprobe
  4. ldconfig

Explanation

depmod scans the module directory for the running kernel and regenerates modules.dep, modules.alias, and related index files. modprobe depends on this metadata to resolve dependencies and aliases.

Question 42Linux Kernel

On a RHEL or CentOS system, which command rebuilds the initramfs for the currently running kernel using dracut?

  1. dracut --force Correct answer.
  2. make initramfs
  3. update-initramfs -u
  4. mkinitcpio -P

Explanation

On RHEL and related distributions, dracut builds the initramfs, and --force overwrites the existing image for the running kernel. The other commands belong to Debian, Arch, or are not valid initramfs generators.

Question 43Linux Kernel

Which file usually contains the configuration that was used to build the currently running distribution kernel?

  1. /lib/modules/$(uname -r)/build/.config
  2. /proc/config.gz
  3. /boot/config-$(uname -r) Correct answer.
  4. /boot/System.map-$(uname -r)

Explanation

Distribution kernels normally ship their build configuration as /boot/config-$(uname -r). /proc/config.gz exists only when the kernel was built with CONFIG_IKCONFIG_PROC and that interface is enabled.

Question 44Linux Kernel

Which command removes the module named nfsd and any dependencies that are no longer used, while refusing to remove modules still in use?

  1. rmmod --remove nfsd
  2. modprobe -r nfsd Correct answer.
  3. insmod -r nfsd
  4. depmod -r nfsd

Explanation

modprobe -r removes the named module and then any dependencies that are no longer in use. It refuses to remove a module that is still referenced, which avoids breaking a running system.

Question 45Linux Kernel

Which file should an administrator read to see the exact kernel command line that the bootloader passed to the currently running kernel?

  1. /boot/config-$(uname -r)
  2. /proc/kallsyms
  3. /proc/cmdline Correct answer.
  4. /etc/default/grub

Explanation

/proc/cmdline contains the exact command line that the bootloader passed to the currently running kernel. It is therefore the authoritative place to check parameters such as root= or quiet.

Question 46Linux Kernel

An administrator needs the current value of the max_bonds parameter for the loaded bonding module without reloading it. Which path should be read?

  1. /sys/module/bonding/parameters/max_bonds Correct answer.
  2. /etc/modprobe.d/bonding.conf
  3. /lib/modules/$(uname -r)/modules.parameters
  4. /proc/modules

Explanation

For a loaded module, sysfs exposes parameters under /sys/module/<module>/parameters/. Reading max_bonds from there returns the current value without unloading or reloading bonding.

Question 47Linux Kernel

Which command builds an external kernel module in the current directory against the build tree of the running kernel?

  1. modprobe --build /lib/modules/$(uname -r)/build $PWD
  2. make -C /lib/modules/$(uname -r)/build M=$PWD modules Correct answer.
  3. make -C /usr/src/linux-headers-$(uname -r) headers_install M=$PWD
  4. make -C /lib/modules/$(uname -r)/source M=$PWD modules_install

Explanation

External module builds use make -C pointing at the kernel build tree and M= pointing at the module source directory. The /lib/modules/$(uname -r)/build symlink normally points to the configured headers for the running kernel.

Question 48Linux Kernel

When udev reports a device modalias, which file in /lib/modules/$(uname -r) does modprobe use to map that alias to a module name for automatic loading?

  1. modules.dep
  2. modules.symbols
  3. modules.builtin
  4. modules.alias Correct answer.

Explanation

modprobe maps a device modalias to a module name by consulting modules.alias, which depmod generates from MODULE_ALIAS and device ID tables. This is how udev can request automatic loading of the correct driver.

Question 49Linux Kernel

An administrator is configuring a kernel source tree and wants ext4 support to be part of the kernel image so it is available before any module can be loaded. Which configuration setting accomplishes this?

  1. CONFIG_MODULES=n
  2. CONFIG_EXT4_FS=m
  3. CONFIG_EXT4_FS=y Correct answer.
  4. CONFIG_EXT4_DEBUG=y

Explanation

A value of y compiles the ext4 driver directly into the kernel image, so it is available during early boot before any module loader runs. A value of m builds ext4 as a loadable module, which cannot satisfy a requirement for pre-module availability. CONFIG_EXT4_DEBUG only enables debugging output and does not change whether ext4 is built in.

Question 50Linux Kernel

While running make menuconfig in a kernel source tree, which files provide the menu structure, symbol names, and help text for configuration options?

  1. .config
  2. Kconfig Correct answer.
  3. System.map
  4. Makefile

Explanation

Kconfig files, usually one per source directory, define configuration symbols, dependencies, menu layout, and help text that menuconfig presents. The .config file stores selected values, while Makefiles control build rules and System.map maps symbols in a built image.