Free CompTIA Linux+ Sample Questions

Correct answers: A, D — depmod -a; /lib/modules/$(uname -r)/modules.dep

• A. Correct. The depmod command scans the kernel modules directories and regenerates the dependency database. The -a (all) flag instructs depmod to probe all modules listed in the configuration files for the current kernel version.
• B. Incorrect. The modprobe -a command is used to load all modules specified on the command line simultaneously, rather than updating the dependency database. modprobe relies on the database already being up to date.
• C. Incorrect. udevadm trigger is used to request the kernel to re-send device events (uevents), typically to force udev to re-apply rules to existing devices. It does not manage kernel module dependencies.
• D. Correct. The /lib/modules/$(uname -r)/modules.dep file is the primary text file created by depmod. It lists the dependencies for every module in the kernel version's directory, which modprobe uses to load prerequisite modules automatically.
• E. Incorrect. Files within /etc/modprobe.d/ are manual configuration files used to set module aliases, blacklists, and specific options. They are not the generated dependency database updated by depmod.
• F. Incorrect. The System.map file is a look-up table used by the kernel to map memory addresses to function names (symbols). It is created during the kernel compilation process and is not updated when adding new modules via depmod.

Correct answer: A — The variable was not exported, so it is not available to child processes.

• A. Correct. When a variable is defined in the shell as `VAR=value`, it is created as a local shell variable and is not automatically inherited by child processes. To make it an environment variable accessible to a Python script or any other child process, it must be promoted using the `export` command (e.g., `export DB_PASS=secret`).
• B. Incorrect. Variable names in Linux are case-sensitive but not restricted to lowercase. Standard practice for environment variables is actually to use uppercase names. Python's `os.environ` can read any exported variable regardless of case as long as it is referenced correctly.
• C. Incorrect. While `/etc/environment` is used for system-wide persistent environment variables, it is not necessary for passing a variable to a script in a specific session. The immediate issue is that the variable exists only in the current shell's local memory and was not exported.
• D. Incorrect. Running a script with `sudo` elevates privileges but does not resolve environment inheritance issues. In fact, `sudo` typically cleans or resets the environment for security reasons, making local shell variables even less likely to be accessible unless specific flags like `-E` are used.

Correct answer: C — dd

• A. rsync is a utility used for synchronizing files and directories between two locations, often over a network. It is highly efficient for file-level backups due to its delta-transfer algorithm, but it does not perform raw bit-by-bit block-level imaging.
• B. tar (Tape Archiver) is used to bundle multiple files and directories into a single archive file. While it preserves file structure and metadata, it operates at the file system level and cannot create a bit-for-bit clone of the underlying storage device.
• C. dd is a powerful command-line utility used to convert and copy data at the block level. It is the standard tool for creating exact bit-by-bit images of disks or partitions, making it ideal for forensic imaging and disk cloning where every bit (including deleted space and boot sectors) must be captured.
• D. cpio (Copy In, Copy Out) is an archiving tool used to copy files to and from archives. Like tar, it functions at the file level rather than the block level and is not used for creating raw hardware-level images.

Correct answer: B — rsync -avz -e "ssh -p 2222" /local/ remote@server:/backup/

• A. The --port option is used specifically when connecting to an rsync daemon (typically on port 873), not when rsync is being tunneled over SSH. Using this with a remote shell connection syntax will not work as intended.
• B. The -e (or --rsh) option allows the user to specify the remote shell program to use for the transfer. By providing the string "ssh -p 2222", rsync is instructed to use SSH with the specific port flag for the connection.
• C. The --ssh-port option is not a valid parameter for the rsync command. All SSH-specific settings must be passed through the remote shell (-e) flag or configured in the user's SSH config file.
• D. In rsync, the lowercase -p flag is shorthand for --perms, which tells rsync to preserve the permissions of the source files. It has no relation to the network port used for the connection.

Correct answer: A — qemu-img resize db-data.qcow2 +50G

• A. Correct. The 'qemu-img resize' command is the standard utility for changing the capacity of a QEMU disk image (such as .qcow2 or .raw). Using the '+50G' syntax correctly instructs the tool to increment the current size by 50 gigabytes.
• B. Incorrect. While 'virsh vol-resize' can resize volumes managed by libvirt, it typically requires the storage pool name and volume name as defined in libvirt's XML configuration, rather than a direct file path. Furthermore, 'qemu-img' is the more direct tool for manipulating the image file itself.
• C. Incorrect. 'virt-resize' (part of the libguestfs suite) is primarily used to resize partitions and filesystems inside a disk image. It usually requires a source image and a separate destination image and is not used to simply expand the underlying container file size in-place.
• D. Incorrect. This command is invalid because 'qemu-img' does not have an 'expand' subcommand. The correct subcommand for modifying disk capacity is 'resize'.

Correct answer: A — mount -t iso9660 -o loop ubuntu-server.iso /mnt/iso

• A. Correct. This command uses the correct syntax to mount an ISO file. The `-t iso9660` option specifies the filesystem type as ISO 9660 (the standard for optical discs), and the `-o loop` option is necessary to mount a regular file as a loop device, allowing Linux to treat the image file as a block device.
• B. Incorrect. The `--bind` option is used to make a directory or file hierarchy available at a different mount point. It does not interpret or mount the internal filesystem structure of an ISO image file.
• C. Incorrect. The `-a` (all) option tells the mount command to mount all filesystems defined in the `/etc/fstab` file. It does not take an ISO filename and target directory as arguments in this manner.
• D. Incorrect. The `-o remount` option is used to change the mount options of a filesystem that is already mounted (such as changing from read-only to read-write). It cannot be used to perform an initial mount of an ISO file.

Correct answer: A — netplan apply

• A. Correct. The command 'netplan apply' is the standard way to apply network configuration changes. It parses the YAML configuration files in /etc/netplan/, generates the necessary configuration for the backend renderer (systemd-networkd or NetworkManager), and immediately applies the settings to the running system.
• B. Incorrect. Netplan is a configuration generator and CLI utility, not a persistent daemon or systemd service. Therefore, 'systemctl restart netplan' is not a valid way to manage or activate network configurations.
• C. Incorrect. 'netplan update' is not a valid command within the Netplan utility. The typical workflow involves 'netplan generate' (to create the backend files) and 'netplan apply' (to apply them), or 'netplan try' (to test them with a rollback mechanism).

Correct answer: B — Press 'e' at the GRUB menu, edit the line starting with 'linux' or 'linux16', and press Ctrl+X to boot.

• A. Booting from a Live CD and chrooting into the system is a valid recovery method for major repairs like reinstalling the kernel or resetting passwords, but it is overly complex and time-consuming for the simple task of temporarily removing a kernel parameter.
• B. This is the standard procedure in GRUB2. Pressing 'e' allows for the temporary editing of boot parameters for the current session. The administrator can navigate to the kernel specification line (starting with 'linux', 'linux16', or 'linuxefi'), delete the problematic parameter, and press Ctrl+X or F10 to boot the system with the modified configuration.
• C. Pressing 'c' in the GRUB menu enters the GRUB command-line interface. However, 'systemctl default' is a systemd command used within the operating system's user space, not from within the GRUB pre-boot environment. This would not allow for the modification of kernel parameters.
• D. Interrupting the boot process multiple times is a common method to trigger recovery modes in Windows or some automated Linux recovery scripts, but it is not the standard or manual way to edit kernel parameters on a Linux system using the GRUB bootloader.

Correct answers: C, E — docker login registry.example.com; docker pull registry.example.com/app:latest

• A. Incorrect. The command `docker auth` is not a valid Docker CLI command. Authentication to a Docker registry is initiated using the `docker login` command.
• B. Incorrect. `docker fetch` is not a valid Docker command for retrieving images. The standard command used to download or retrieve an image from a registry is `docker pull`.
• C. Correct. The `docker login registry.example.com` command authenticates the administrator with the specified private registry, enabling access to proprietary or private images.
• D. Incorrect. `docker registry login` is not the correct syntax for the Docker CLI. The proper subcommand is simply `login`, followed by the registry hostname.
• E. Correct. Once authenticated, `docker pull registry.example.com/app:latest` is the standard command used to download the specific image from the private registry to the local host.

Correct answer: B — systemctl daemon-reload

• A. The 'systemctl reload httpd' command instructs the service (process) to reload its own configuration files (such as httpd.conf) if it supports doing so. It does not prompt systemd to reread the unit file definitions stored on disk.
• B. The 'systemctl daemon-reload' command reloads the systemd manager configuration. This is required whenever a unit file (e.g., .service, .timer, .mount) is modified on disk, as systemd must reread the files and regenerate its internal dependency tree to recognize the changes.
• C. There is no 'systemctl rebind' command used for reloading service configurations. This option is invalid for the purpose of applying unit file changes.
• D. The 'systemd-analyze verify' command is a troubleshooting tool used to check unit files for syntax errors and logical inconsistencies. While it can identify problems, it does not apply changes or reload the systemd daemon.

Correct answer: A — apt-get install -f

• A. Correct. The `apt-get install -f` (or `--fix-broken`) command is used to repair broken dependencies and attempt to complete partially installed packages. Since `dpkg` does not automatically fetch dependencies, running this command allows the APT package manager to identify the missing requirements in the local database and fetch them from the configured repositories to resolve the installation.
• B. Incorrect. The `dpkg --configure -a` command attempts to configure any unpacked packages that were left in an unconfigured state. However, it cannot download or install missing dependencies from a repository, meaning it will still fail if the dependencies are not already present on the system.
• C. Incorrect. The `apt-get update` command refreshes the local package index from the configured repositories. While it is often run before an installation, it does not install packages or fix dependency issues on its own.
• D. Incorrect. The `apt-get upgrade` command is used to upgrade all currently installed packages to their latest versions. It is not specifically used to resolve dependency errors for a broken package manually installed via `dpkg`.

Correct answer: C — renice -n 15 -p 4512

• A. The nice command is used to set the priority of a new process at the time it is started. It cannot be used to modify the priority of a process that is already running, and it does not support the -p flag to target a PID.
• B. The chrt command is used to manipulate real-time scheduling attributes and policies (like SCHED_FIFO or SCHED_RR). It is not the standard tool for adjusting the 'nice' value of a normal background process like a backup script.
• C. The renice command is specifically designed to alter the scheduling priority of an already running process. In Linux, nice values range from -20 (highest priority) to 19 (lowest priority). Setting the value to 15 increases the 'niceness', thereby lowering the process priority and allowing other services more CPU time. The -p flag correctly identifies the target process by its PID.
• D. While renice is the correct command, a negative nice value (like -15) increases the process priority. This would make the backup script even more aggressive, further degrading the performance of other critical services.

Correct answer: A — The process has terminated but its parent has not yet read its exit status.

• A. Correct. A process in state 'Z' is known as a zombie (or defunct) process. This occurs when a process has completed execution and terminated, but its entry remains in the process table because the parent process has not yet collected its exit status using a system call like wait().
• B. Incorrect. Processes waiting for an event or I/O are typically in an interruptible sleep ('S') or uninterruptible sleep ('D') state. Zombie processes are no longer executing at all.
• C. Incorrect. A process that has been stopped by a job control signal (like SIGSTOP) is indicated by the 'T' state. Unlike stopped processes, zombie processes have already finished their execution and cannot be resumed.
• D. Incorrect. A process that is currently running or is in the run queue waiting for CPU time is indicated by the 'R' (running or runnable) state.

Correct answer: A — chmod u+s /usr/local/bin/diag_tool

• A. Correct. Setting the setuid (SUID) bit with `chmod u+s` allows a user to execute a file with the permissions of the file's owner. Since the tool is owned by root, users executing the tool will run it with root privileges, fulfilling the requirement without needing sudo.
• B. Incorrect. The `chmod g+s` command sets the setgid (SGID) bit. On an executable file, this causes the file to run with the privileges of the file's group rather than the file's owner.
• C. Incorrect. The `chmod +t` command sets the sticky bit. This is primarily used on directories (like `/tmp`) to ensure that only the owner of a file (or root) can delete or rename it, even if others have write access to the directory. It does not provide privilege escalation for executables.
• D. Incorrect. The `chattr +i` command sets the immutable attribute on a file, which prevents it from being modified, deleted, renamed, or linked, even by root. It has no effect on the execution privileges of the file.

Correct answer: B — /etc/skel

• A. /etc/profile.d contains initialization scripts used for system-wide shell configuration. These scripts are sourced at login by shells like bash but are not copied to individual user home directories.
• B. /etc/skel is the 'skeleton' directory. When the useradd command creates a new user home directory, it automatically copies all files and directories (including hidden files like .bashrc and .profile) from this directory into the new user's home.
• C. /etc/default/useradd is a configuration file used to set default values for the useradd utility (such as the default shell or the path to the skeleton directory), but it does not store the template files themselves.
• D. /var/spool/skel is not a standard directory in Linux. The /var/spool directory is typically used for data waiting to be processed, such as mail or print jobs, while template files conventionally reside in /etc/skel.

Correct answers: A, C — PCI-DSS; CIS Benchmarks

• A. PCI-DSS (Payment Card Industry Data Security Standard) is a global security standard for organizations that handle credit card transactions. It is mandatory for securing cardholder data and aligns with the organization's requirement to process credit card transactions.
• B. HIPAA (Health Insurance Portability and Accountability Act) is a U.S. standard related to protecting sensitive patient health information in healthcare environments. It is not directly relevant to credit card processing or general OS hardening.
• C. CIS (Center for Internet Security) Benchmarks provide industry-recognized, consensus-based best practices for securely configuring and hardening various operating systems, including Linux. These benchmarks align with the organization's goal of following industry best-practice hardening guidelines.
• D. GDPR (General Data Protection Regulation) is a regulation focused on data protection and privacy for individuals within the European Union. While it impacts global data handling, it does not specify technical OS hardening benchmarks or payment processing requirements.
• E. FISMA (Federal Information Security Management Act) is a United States federal law that defines a framework for securing federal government operations and assets. It is not the most relevant standard for commercial credit card transactions or general industry hardening guidelines.

Correct answers: A, B — openssl genrsa -out server.key 2048; openssl req -new -key server.key -out server.csr

• A. Correct. This command generates a new RSA private key of 2048 bits and saves it to the file server.key. This is the first step in creating a new HTTPS certificate.
• B. Correct. This command generates a new Certificate Signing Request (CSR) using the previously generated private key (server.key) and saves the CSR to the file server.csr. This CSR is then submitted to a Certificate Authority to request a signed certificate.
• C. Incorrect. This command is used to sign a CSR with an existing private key to create a self-signed certificate. While it uses the inputs, it produces a final certificate instead of the CSR required by a Certificate Authority.
• D. Incorrect. This command extracts the public key from an existing RSA private key and outputs it in PEM format. It does not assist in the generation of the initial private key or the CSR.
• E. Incorrect. This command creates a PKCS#12 (.pfx or .p12) archive file, which is used to bundle a private key with its signed public certificate for transport or installation. It is not used to generate a CSR.

Correct answer: A — The custom shell path is not listed in the `/etc/shells` file.

• A. PAM (Pluggable Authentication Modules) often utilizes the `pam_shells.so` module, which restricts access to users who have a login shell listed in `/etc/shells`. When a custom shell is installed in a non-standard location like `/usr/local/bin/zsh`, it must be manually added to this file for FTP and other services to authorize the login.
• B. While the shell binary must be executable for the user to run it, authentication failures in PAM-based services after changing a shell are typically due to the shell not being recognized as a valid login shell by security policies, rather than a standard filesystem permission issue on the binary itself.
• C. While a corrupted `/etc/passwd` file would cause widespread login issues, the use of `chsh` specifically modifies the user's shell entry. If `chsh` completed successfully, the file is likely intact, but the new path provided is being rejected by the authentication layer (PAM).
• D. FTP daemons are shell-agnostic and do not need to support specific shell features. They rely on the operating system's authentication and authorization mechanisms to determine if the user's assigned shell is valid and allowed.

Correct answer: B — PREROUTING, INPUT, OUTPUT, POSTROUTING

• A. Incorrect. INPUT, OUTPUT, and FORWARD are the default chains for the `filter` table, which is used for general packet filtering rather than address translation.
• B. Correct. In modern Linux kernels (specifically since version 2.6.34), the `nat` table includes four built-in chains: PREROUTING (for DNAT on incoming packets), POSTROUTING (for SNAT on outgoing packets), OUTPUT (for NAT on locally-generated packets), and INPUT (for NAT on packets destined for the local host).
• C. Incorrect. While PREROUTING and POSTROUTING are standard chains in the `nat` table, FORWARD is never part of the `nat` table. The FORWARD chain is primarily found in the `filter` and `mangle` tables.
• D. Incorrect. The FORWARD chain is not available in the `nat` table. While the `nat` table does include INPUT (in modern kernels) and POSTROUTING, the inclusion of FORWARD makes this choice incorrect.

Correct answer: A — chmod +t /opt/dev_share

• A. The sticky bit (+t) is a special permission bit used on directories. When set, only the file's owner, the directory's owner, or the root user can rename or delete files within that directory. This is the standard mechanism for managing shared writable directories (like /tmp) to prevent users from deleting each other's work.
• B. The setgid bit (g+s) on a directory ensures that files created within it inherit the group ownership of the parent directory. While useful for ensuring all members of the 'developers' group can access new files, it does not restrict deletion permissions for those with write access to the directory.
• C. This command sets a default Access Control List (ACL) for user permissions on newly created files. Default ACLs determine the standard permissions (rwx) inherited by new files but do not enforce owner-only deletion restrictions.
• D. The immutable attribute (+i) prevents any changes to the directory or its contents, including deletion, creation, and modification. This would stop developers from doing any work in the directory, making it far too restrictive for this scenario.

Correct answer: A — /etc/pam.d/su

• A. Correct. The /etc/pam.d/su file is the PAM (Pluggable Authentication Modules) configuration file specifically used by the su command. To restrict su access to members of the wheel group, the administrator must enable the pam_wheel.so module by adding or uncommenting a line like 'auth required pam_wheel.so use_uid' in this file.
• B. Incorrect. The /etc/security/limits.conf file is used to define user resource limits such as maximum open files, CPU time, or number of processes. It does not handle authentication control or group restrictions for the su command.
• C. Incorrect. The /etc/sudoers file controls permissions for the sudo command, which is a different mechanism for privilege escalation. It is not the file where pam_wheel.so is configured for the su command.
• D. Incorrect. The /etc/login.defs file contains system-wide default settings for the shadow password suite, such as UID ranges and password aging policies. It is not used for enabling PAM modules to restrict access to specific commands.

Correct answer: A — A keytab file

• A. A keytab (key table) file contains one or more Kerberos principals and their associated encrypted keys. This allows services, scripts, or daemons to authenticate to the Key Distribution Center (KDC) non-interactively without requiring a human to enter a password. It is the standard method for automated service authentication in a Kerberos environment.
• B. A Ticket Granting Ticket (TGT) is obtained from the KDC after a successful authentication event. While a service might use a keytab to acquire a TGT, the TGT itself is dynamic, time-limited, and stored in a credential cache rather than being the static file generated by an administrator for the initial automated authentication setup.
• C. An SSH private key is used for secure shell access and public-key authentication within the SSH protocol. It is not used for native Kerberos protocol exchanges or service principal authentication to a backend database.
• D. An X.509 certificate is used in Public Key Infrastructure (PKI) and SSL/TLS for identity verification and encryption. While Kerberos can sometimes integrate with certificates (via PKINIT), the primary and standard tool for automated Kerberos service authentication is the keytab file.

Correct answer: A — pip install -r requirements.txt

• A. Correct. The command 'pip install -r requirements.txt' is the standard way to install dependencies from a requirements file. The '-r' flag (or --requirement) specifies that pip should read and install the packages listed in the provided file rather than from command-line arguments.
• B. Incorrect. 'read' is not a valid subcommand for the pip tool. Pip uses the 'install' subcommand to add packages to an environment.
• C. Incorrect. While 'python3 -m pip' is a valid way to invoke pip (ensuring it uses the specific Python interpreter's pip module), this command is missing the necessary 'install' subcommand and the '-r' flag required to parse the requirements file.
• D. Incorrect. 'fetch' is not a standard pip subcommand for installing packages from a requirements file. Pip uses 'install' with '-r' to process these dependencies.

Correct answer: A — #!/usr/bin/env python3

• A. Correct. This is a valid shebang line. The '#!' (shebang) sequence tells the kernel which interpreter to use for the file. Using '/usr/bin/env python3' is a best practice for portability, as it searches the user's PATH to find the python3 executable, ensuring the script works even if Python is installed in different locations on different systems.
• B. Incorrect. A shebang must begin with the '#!' characters to be recognized by the operating system loader. Double forward slashes are used for comments in many programming languages but have no special meaning for script execution in a shell environment.
• C. Incorrect. While this line starts with the shebang characters, it fails because the kernel requires an absolute path to the interpreter (e.g., /usr/bin/python3) or an absolute path to a helper utility like /usr/bin/env. It will not automatically search the PATH for 'python3' if only the name is provided.
• D. Incorrect. This line specifies the Bash shell as the interpreter and attempts to pass 'python3' as an argument. This would cause the script to be executed as a shell script rather than a Python script, leading to syntax errors as Bash attempts to interpret Python code.

Correct answers: A, C — git fetch; git merge

• A. Correct. The first step of 'git pull' is 'git fetch', which retrieves the latest changes, objects, and refs from the remote repository and updates the local remote-tracking branches.
• B. Incorrect. While 'git pull --rebase' can be used to rebase instead of merge, 'git rebase' is not the standard default behavior of the 'git pull' command.
• C. Correct. After the fetch operation is complete, 'git pull' executes 'git merge' to integrate the retrieved changes from the remote-tracking branch into the current local branch.
• D. Incorrect. 'git commit' is used to save local changes to the repository history. It is not part of the internal sequence of 'git pull', although the merge step within a pull may create a merge commit.
• E. Incorrect. 'git checkout' is used to switch between branches or restore working tree files; it is not involved in the process of synchronizing remote updates via 'git pull'.

Correct answer: B — set -e

• A. The 'set -x' command enables shell tracing (xtrace), which prints each command and its arguments to the terminal before execution. While highly effective for debugging, it does not alter the script's exit behavior upon encountering an error.
• B. The 'set -e' (errexit) command instructs the shell to exit immediately if any command, pipeline, or compound command returns a non-zero exit status. This is a best practice for scripts performing critical operations where a failure in one step makes subsequent steps dangerous or invalid.
• C. The 'set -v' (verbose) command prints shell input lines as they are read by the interpreter. It is useful for verifying script content as it runs but does not halt execution based on command failure.
• D. The 'set -u' (nounset) command treats unset variables as an error and exits the script immediately if they are referenced. While this helps catch bugs related to undefined variables, it does not monitor the exit status of general commands.

Correct answer: A — Configure a webhook in the Git repository to send an HTTP POST request to Jenkins on push events.

• A. Configuring a webhook in the Git repository is the standard, event-driven method for CI/CD automation. When a developer pushes code, the Git server immediately sends an HTTP POST request to Jenkins, triggering the build process in real-time without manual intervention or the delays associated with polling.
• B. Setting up a cron job to poll the repository (using git pull) is inefficient. This polling-based approach introduces latency (up to the interval of the cron job) and places unnecessary load on both the Jenkins server and the Git repository.
• C. Jenkins agents are designed to execute build and test tasks, not to monitor local developer workstations. This approach is impractical for enterprise environments, hard to maintain, and does not detect the push to the central repository which is the required trigger point.
• D. The .git/config file stores repository-level settings such as remotes and branch configurations; it does not have the capability to trigger external automation like Jenkins. While Jenkins itself has a 'Poll SCM' feature, it is configured within the Jenkins job settings, not the Git configuration file, and is still less efficient than a webhook.

Correct answers: A, C — Requesting the AI to use specific, well-known utilities (e.g., POSIX-compliant awk or sed).; Specifying the target Linux distribution and shell environment (e.g., Ubuntu 22.04, Bash 5.1).

• A. Requesting specific, well-known utilities like POSIX-compliant awk or sed ensures portability, predictability, and compatibility across different systems. It reduces the chance of the AI model inventing obscure, non-standard, or unsafe command flags.
• B. Removing comments reduces readability and maintainability. Comments are essential for understanding the script's intent, performing security audits, and allowing for future modifications by human administrators.
• C. Specifying the target Linux distribution and shell version allows the AI to generate commands that match the available features, package names, and syntax of that specific environment. This significantly reduces the likelihood of encountering runtime errors or broken logic.
• D. Providing sensitive information like root passwords to an AI is a major security risk. It exposes credentials unnecessarily, as AI can generate scripts using sudo without requiring actual passwords.
• E. Standard package managers provide essential security features like signature verification and dependency resolution. Bypassing them can lead to system instability, broken dependencies, and the installation of untrusted software.

Correct answer: A — free

• A. Correct. The 'free' command is specifically used to display the total amount of free and used physical and swap memory in the system, as well as the buffers and caches used by the kernel. This command provides a quick and comprehensive overview of the system's memory allocation and availability.
• B. Incorrect. The 'df' (disk free) command is used to display the amount of disk space used and available on mounted filesystems. It does not provide information about RAM or swap memory usage.
• C. Incorrect. The 'du' (disk usage) command is used to estimate and display the space usage of files and directories on the storage drive. It is used for measuring storage consumption, not system memory.

Correct answer: B — Comment out the failing entry for /data in /etc/fstab and reboot.

• A. Incorrect. Running fsck on the root partition is not appropriate because the error specifically points to a dependency failure for /data, not the root filesystem. Furthermore, running fsck on a mounted root partition can cause further data corruption.
• B. Correct. Commenting out the failing /data entry in /etc/fstab removes the problematic mount requirement, allowing the init system (like systemd) to bypass the dependency failure and complete the boot process. Once the system boots normally, the administrator can investigate the new drive, its UUID, or filesystem health in a stable environment.
• C. Incorrect. Reinstalling the GRUB bootloader addresses issues where the system cannot find or load the kernel. Since the system has reached emergency mode, GRUB has already successfully handed off control to the kernel.
• D. Incorrect. Rebuilding the initramfs with dracut is used when the system lacks the drivers or modules necessary to mount the root filesystem or start the initial boot process. It does not resolve configuration errors within /etc/fstab for secondary mount points.

Correct answer: B — The filesystem detected an inconsistency or hardware error and remounted itself as read-only to prevent further corruption.

• A. Disk quotas limit the amount of space or number of files a user or group can consume, but they do not alter the mount state of the filesystem. If a quota were exceeded, the system would return a 'Disk quota exceeded' or 'No space left on device' error rather than a 'Read-only file system' error.
• B. When a Linux filesystem (such as ext4) detects metadata inconsistencies, I/O errors, or hardware failure, the kernel's default behavior (often defined by the 'errors=remount-ro' mount option) is to remount the filesystem as read-only. This is a safeguard designed to prevent further data corruption. This specific state triggers the 'Read-only file system' error reported by the administrator.
• C. Using chmod to remove write permissions would result in a 'Permission denied' error. It changes the file's mode bits but does not change the mount status of the entire filesystem to read-only.
• D. Incorrect SELinux contexts lead to 'Permission denied' or 'Access denied' errors and generate AVC (Access Vector Cache) entries in security logs. SELinux governs access control but does not cause a filesystem to be remounted as read-only.

Correct answer: B — sar

• A. The top command provides a real-time, interactive view of system resource usage and running processes. It is used for live monitoring and does not read binary data files collected by the sysstat daemon for historical reporting.
• B. The sar (System Activity Reporter) command is part of the sysstat package and is specifically designed to read binary data files (typically located in /var/log/sa/) collected by the sysstat daemon. It provides comprehensive historical reports on CPU, memory, network, and I/O usage.
• C. The htop command is an enhanced, interactive process viewer similar to top. While it provides a more user-friendly real-time interface, it lacks the ability to parse historical sysstat data files.
• D. The dmesg command displays messages from the kernel ring buffer, which are useful for troubleshooting hardware or kernel-related issues. It does not provide performance utilization metrics or historical data analysis.

Correct answer: A — /etc/resolv.conf

• A. Correct. /etc/resolv.conf is the primary configuration file used to specify DNS resolver settings in a traditional Linux environment. It contains nameserver entries (e.g., 'nameserver 8.8.8.8') that specify the IP addresses of the upstream DNS servers the system should query for name resolution.
• B. Incorrect. /etc/hosts is used for local, static hostname-to-IP address mappings. While it can be used to resolve specific hostnames without a DNS query, it does not define the IP addresses of upstream DNS servers.
• C. Incorrect. /etc/nsswitch.conf (Name Service Switch) is used to configure the order and priority of various databases and services for name resolution (e.g., checking 'files' before 'dns'). It dictates the lookup process but does not contain the actual IP addresses of the DNS servers.
• D. Incorrect. /etc/networks is a legacy file used to map descriptive network names to network IP addresses, primarily for use with tools like the route command. It is not used for defining DNS resolvers.

Correct answer: A — faillock --user <username> --reset

• A. The faillock --user <username> --reset command is used to clear the recorded failed authentication attempts for a specific user. On modern Linux distributions using the pam_faillock module, this is the definitive method to unlock an account that has been locked specifically due to exceeding the failed login threshold.
• B. The passwd -u command is used to unlock an account that was manually locked by an administrator (typically via passwd -l), which places a '!' in front of the password hash in /etc/shadow. It does not reset the failed login counter managed by faillock.
• C. The usermod -U command performs a similar function to passwd -u, unlocking a password by removing the '!' prefix in the shadow file. It is not designed to address lockouts triggered by PAM policy counters for failed login attempts.
• D. The chage -E -1 command sets the account expiration date to 'never'. This is used to manage password aging or account lifecycle expiration, but it has no effect on a lockout caused by too many failed login attempts.

Correct answer: A — The file has the immutable attribute set; use `chattr -i hidden_miner.sh` to remove it.

• A. The immutable attribute (+i) is a file system attribute that prevents any modification, renaming, or deletion of a file, even by the root user. When this attribute is set, attempting to remove the file results in an "Operation not permitted" error regardless of standard permissions (rwx). Using `chattr -i` removes this attribute, allowing root to proceed with deletion.
• B. While Security-Enhanced Linux (SELinux) can restrict the root user's actions, the specific combination of world-writable permissions and an "Operation not permitted" error is the classic signature of an immutable file attribute. Furthermore, `setenforce 0` is a diagnostic tool to put SELinux in permissive mode, but it does not address the underlying file attribute issue.
• C. An active mount point would typically return a "Device or resource busy" error if you tried to remove the directory it is mounted on, or it would simply delete the file if it were just a regular file inside a mounted filesystem. A single script file like `hidden_miner.sh` is rarely used as a mount point itself.
• D. The sticky bit (+t) is typically applied to directories (like /tmp) to prevent users from deleting files owned by others. On a regular file, it does not prevent the root user from deleting the file, nor would it cause an "Operation not permitted" error in this context.