Linux Foundation Certified System Administrator (LFCS) Exam — Questions and Answers

Question 1: What is the effect of running `taskset -c 0,2 ./myapp`?

Restricts myapp to run only on CPU cores 0 and 2 (Correct answer)
Starts myapp with CPU quota of 20%
Sets myapp's nice value to 0 with 2 threads
Pins myapp to NUMA node 0 with 2 memory regions

Correct answer: Restricts myapp to run only on CPU cores 0 and 2

`taskset -c 0,2` sets the CPU affinity mask, restricting the process to only run on the specified cores.

Question 2: What is the function of the /etc/nsswitch.conf file in name resolution?

Configures the local DNS server
Stores DNS zone records
Lists trusted SSL certificates
Defines the order of sources (files, DNS) for name lookups (Correct answer)

Correct answer: Defines the order of sources (files, DNS) for name lookups

/etc/nsswitch.conf controls which databases (files, dns, myhostname) are consulted and in what order for lookups.

Question 3: What happens when you run `apt-get install -f` (or `--fix-broken`)?

Forces installation ignoring all dependency errors
Reinstalls all installed packages from scratch
Resolves and fixes broken package dependencies automatically (Correct answer)
Fixes corrupted package files using checksums

Correct answer: Resolves and fixes broken package dependencies automatically

`apt-get install -f` attempts to correct broken dependencies by installing missing packages or removing conflicting ones.

Question 4: Which dpkg command extracts the contents of a .deb file without installing it?

dpkg --unpack package.deb
dpkg-deb -x package.deb /target (Correct answer)
dpkg -e package.deb /target
dpkg-deb --info package.deb

Correct answer: dpkg-deb -x package.deb /target

`dpkg-deb -x` extracts the data files from a .deb archive into a target directory without running scripts.

Question 5: A sysadmin wants to set account expiry for user 'tom' to December 31, 2026. Which command is correct?

usermod -e 2026-12-31 tom
passwd --expire 2026-12-31 tom
chage --expiredate 2026-12-31 tom
Both B and C are correct (Correct answer)

Correct answer: Both B and C are correct

Both usermod -e YYYY-MM-DD and chage -E YYYY-MM-DD (or --expiredate) can set account expiry; either command is valid for this task.

Question 6: Which command would permanently change the system's default boot target to `graphical.target`?

ln -sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target
systemctl default graphical.target
systemctl set-default graphical.target (Correct answer)
systemctl enable graphical.target --default

Correct answer: systemctl set-default graphical.target

`systemctl set-default graphical.target` updates the `/etc/systemd/system/default.target` symlink to point to graphical.target, making it the persistent default.

Question 7: While monitoring system performance with the `top` command, you notice a process that needs its priority adjusted. What is the correct interactive keystroke to use within `top` to 'renice' a process?

`k`
`r` (Correct answer)
`p`
`n`

Correct answer: `r`

Within the `top` utility's interactive mode, pressing the 'r' key will prompt you to enter the PID of the process you wish to renice, and then the new niceness value to apply. This allows for real-time priority adjustment without leaving the monitoring tool.

Question 8: Which `systemd-analyze` subcommand shows how long each unit took to start during the last boot?

systemd-analyze critical-chain
systemd-analyze time
systemd-analyze blame (Correct answer)
systemd-analyze plot

Correct answer: systemd-analyze blame

`systemd-analyze blame` lists all units sorted by the time they took to initialize, helping identify boot slowdowns.

Question 9: On a Debian-based system, which command shows the installation candidate version of a package before installing it?

dpkg -l <package>
apt-cache show <package>
apt-cache policy <package> (Correct answer)
apt list <package>

Correct answer: apt-cache policy <package>

`apt-cache policy` displays version priorities and the installation candidate from configured repositories.

Question 10: A sysadmin runs 'groupmod -n webteam developers'. What is the result?

The 'developers' group is deleted and replaced by 'webteam'
The group named 'developers' is renamed to 'webteam' (Correct answer)
Users in 'developers' are moved to 'webteam'
A new group 'webteam' is created as a subgroup of 'developers'

Correct answer: The group named 'developers' is renamed to 'webteam'

groupmod -n new_name old_name renames the existing group without changing its GID or membership.

Question 11: A script has permissions '-rwsr-xr-x' and is owned by root. What happens when a normal user runs it?

It runs with the invoking user's privileges only
It runs with root privileges due to the setuid bit (Correct answer)
It fails because non-root users cannot run setuid scripts
It prompts for a sudo password before running

Correct answer: It runs with root privileges due to the setuid bit

The setuid bit (s in the owner execute position) causes the process to run with the file owner's (root's) effective UID.

Question 12: Which rsyslog rule forwards all facility/severity combinations to a remote UDP syslog server at 192.168.1.1?

*.* forward:192.168.1.1
*.* @192.168.1.1 (Correct answer)
*.* | syslog 192.168.1.1
remote=192.168.1.1

Correct answer: *.* @192.168.1.1

In rsyslog, a single @ before the address means UDP; @@ means TCP — *.* @192.168.1.1 forwards everything over UDP.

Question 13: In a bash script, how do you correctly access the third positional argument passed to the script?

$arg3
$2
$0
$3 (Correct answer)

Correct answer: $3

$3 refers to the third positional parameter; $0 is the script name, $1 is the first argument, and so on.

Question 14: A system administrator sets the `setgid` permission (chmod g+s) on a directory named `/srv/collaboration`. What is the primary effect of this permission on new files and subdirectories created within `/srv/collaboration`?

Only members of the directory's group can create new files in it.
All new files created in the directory will automatically be executable by the group.
New files and subdirectories will inherit the group ownership of the parent directory. (Correct answer)
It prevents anyone other than the file owner from deleting files within the directory.

Correct answer: New files and subdirectories will inherit the group ownership of the parent directory.

When the `setgid` bit is set on a directory, it enforces group inheritance. Any new file or subdirectory created within that directory will have its group ownership automatically set to the group of the parent directory, rather than the primary group of the user who created it. This is essential for shared directories where consistent group ownership is required for collaboration.

Question 15: What is the primary function of the `firewall-cmd --reload` command?

It saves the current runtime rules to the permanent configuration.
It applies the permanent configuration to the runtime environment without dropping existing connections. (Correct answer)
It restarts the entire firewalld service, dropping all active connections.
It lists all the rules in the permanent configuration without applying them.

Correct answer: It applies the permanent configuration to the runtime environment without dropping existing connections.

The `firewall-cmd --reload` command reads the permanent configuration files and applies them as the new runtime configuration. A key feature of `--reload` is that it does this without interrupting or dropping existing connections, making it the preferred way to apply saved changes on a live system. Restarting the service drops connections, and `--runtime-to-permanent` saves the current state.

Question 16: Before shrinking an ext4 filesystem on a logical volume, which step is mandatory?

Run tune2fs -r before reducing
Run fsck on the mounted filesystem
Unmount the filesystem, then run resize2fs to shrink it first (Correct answer)
Snapshot the LV, then reduce

Correct answer: Unmount the filesystem, then run resize2fs to shrink it first

The filesystem must be unmounted and resized with resize2fs before the logical volume itself is reduced to avoid data corruption.

Question 17: You want to run a one-shot script at every boot without keeping a running process. Which service `Type=` is most appropriate?

Type=forking
Type=simple
Type=oneshot (Correct answer)
Type=idle

Correct answer: Type=oneshot

`Type=oneshot` tells systemd the service's main process is expected to exit after completing its task, and systemd waits for it to finish before proceeding.

Question 18: Which systemd target is equivalent to runlevel 5 and starts the graphical desktop?

desktop.target
gui.target
x11.target
graphical.target (Correct answer)

Correct answer: graphical.target

graphical.target is the systemd equivalent of runlevel 5, pulling in a display manager and desktop environment.

Question 19: When using ACLs, the 'mask' entry controls effective permissions for which principals?

All users including the owner
Only named users
Named users (except owner), named groups, and the owning group (Correct answer)
The file owner and root only

Correct answer: Named users (except owner), named groups, and the owning group

The ACL mask defines the maximum effective permissions for named users (except owner), named groups, and the owning group entry.

Question 20: Which directive in /etc/apt/sources.list specifies that source packages should be available?

deb-source
src-deb
deb-src (Correct answer)
deb type=source

Correct answer: deb-src

Lines beginning with `deb-src` in sources.list tell APT where to find source package archives for `apt-get source`.

Linux Foundation Certified System Administrator (LFCS) Exam

The LFCS exam is a performance-based certification that validates a candidate's ability to perform Linux system administration tasks in a live command-line environment.

Questions

120 min

Time Limit

67%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds