XK0-005 CompTIA Linux+ Exam Dumps and Practice Test Questions Set 2 Q 21-40

Visit here for our full CompTIA XK0-005 exam dumps and practice test questions.

Question 21

Which command is used to view detailed information about system memory usage, including swap and cache?

A) free -h
B) top
C) vmstat
D) ps aux

Answer A) free -h

Explanation

A) free -h: The free command provides a comprehensive overview of system memory usage, including total, used, free, shared, buffer/cache, and available memory. The -h flag makes the output human-readable, converting raw byte values into KB, MB, or GB. This command is invaluable for administrators monitoring memory utilization, diagnosing performance issues, and determining whether the system requires more RAM or swap adjustments. It displays swap usage alongside physical memory, offering insight into memory pressure. Free also distinguishes between memory actively used by applications and memory cached by the system for performance optimization. By observing these metrics, administrators can make informed decisions about application deployment, system tuning, and troubleshooting slowdowns. Its simplicity and clarity make free -h the correct choice for a direct snapshot of memory and swap status.

B) top: The top command provides real-time monitoring of processes and resource usage, including CPU and memory utilization. While top does show memory statistics and highlights which processes are consuming resources, it is process-focused rather than giving a direct, summarized overview of total memory, swap, and cache. It is more suitable for ongoing performance monitoring rather than a quick static snapshot.

C) vmstat: vmstat displays virtual memory statistics, including memory, swap, I/O, CPU, and system activity over time. While vmstat offers detailed performance metrics, its output is less intuitive for quickly assessing memory usage. It is primarily used for performance analysis and trend observation rather than immediate memory snapshots.

D) ps aux: This command lists all running processes along with their CPU and memory consumption. While it provides memory usage at a per-process level, it does not summarize total system memory, swap, or cache usage. It is process-centric and not designed for system-wide memory overview.

free -h is the correct choice because it provides a clear, concise, and comprehensive view of total memory, used and free memory, swap usage, and cache. top, vmstat, and ps aux provide related information but focus on real-time monitoring, performance analysis, or per-process statistics, making them less ideal for a quick memory summary. Understanding memory usage through free -h is essential for system health monitoring, capacity planning, and troubleshooting in Linux environments.

Question 22

Which command is used to add a new user account on a Linux system?

A) useradd
B) adduser
C) passwd
D) groupadd

Answer A) useradd

Explanation

A) useradd: The useradd command is used to create a new user account in Linux. It allows specifying a username, home directory, shell, user ID, and group membership. For example, useradd -m -s /bin/bash username creates a new user with a home directory and Bash shell. useradd is the underlying utility used in most distributions for automated account creation, particularly in scripting and system administration tasks. It ensures proper account initialization, including directory creation, UID assignment, and initial configuration, making it the correct choice.

B) adduser: adduser is a higher-level, interactive command that often wraps useradd for convenience. It may prompt the administrator for password, full name, and other details, making it easier for interactive account creation. While adduser is simpler for manual use, it is not present on all distributions and relies on useradd for actual system changes, so useradd is the more universally applicable tool.

C) passwd: The passwd command sets or changes the password for an existing user account. While essential for account security, it does not create a new user. It can be used in combination with useradd to initialize the password for a new account, but by itself, it cannot add users.

D) groupadd: This command creates a new group on the system. While important for managing group-based permissions, it does not create user accounts. Groups can be assigned during user creation, but groupadd alone cannot initialize a new user.

useradd is the correct choice because it directly creates a new user account, specifying configuration parameters and system properties. adduser is interactive and distribution-dependent, passwd only modifies passwords, and groupadd manages groups rather than users. Proper use of useradd ensures standardized account creation, consistent home directory structures, and secure system administration.

Question 23

Which command displays the disk usage of each directory and subdirectory recursively, helping identify large directories?

A) du -h –max-depth=1
B) df -h
C) ls -lh
D) stat

Answer A) du -h –max-depth=1

Explanation

A) du -h –max-depth=1: The du command calculates disk usage for files and directories. The -h flag provides human-readable output, and –max-depth=1 limits the recursive output to the first level of subdirectories, making it easier to identify which directories consume the most space without overwhelming detail. For example, du -h –max-depth=1 /home/user provides a summarized view of each directory in /home/user, allowing administrators to quickly spot large directories for cleanup or optimization. This combination of recursive analysis and summarization makes it the correct choice for monitoring disk usage.

B) df -h: df displays disk space usage for entire filesystems, showing total, used, and available space. While useful for assessing overall storage consumption, it does not provide directory-level granularity, making it unsuitable for identifying large directories.

C) ls -lh: ls -lh displays file sizes in a human-readable format but does not summarize directories recursively. It provides information at the file level only, so it is not practical for identifying directories consuming large amounts of disk space.

D) stat: stat provides detailed metadata about a file or directory, including size, permissions, and timestamps. While informative, it does not calculate total disk usage for directories or subdirectories and therefore cannot identify space-consuming directories efficiently.

du -h –max-depth=1 is the correct choice because it provides a practical, human-readable summary of disk usage across directories, enabling administrators to detect large directories quickly. df provides filesystem-level usage, ls -lh lists individual files, and stat shows metadata but not aggregated disk usage. Using du effectively is essential for storage management and system maintenance.

Question 24

Which command is used to change the default runlevel or target in a systemd-based Linux system?

A) systemctl set-default
B) init
C) runlevel
D) telinit

Answer A) systemctl set-default

Explanation

A) systemctl set-default: On a systemd-based Linux system, targets replace traditional runlevels. The systemctl set-default command allows administrators to set the default target that the system will boot into. For example, systemctl set-default multi-user.target sets the system to boot into a multi-user, non-graphical mode. systemctl also provides tools to switch targets temporarily, monitor active targets, and control service dependencies. This is the correct choice because it integrates with systemd’s unit management and target system, which replaces older SysV-style runlevels.

B) init: The init command is used on SysV init systems to change the runlevel temporarily. For example, init 3 switches to runlevel 3. While effective on legacy systems, init is largely obsolete on systemd distributions, which use targets rather than runlevels.

C) runlevel: The runlevel command displays the current and previous runlevel. It does not modify the default boot target; it is purely informational and does not provide control over startup configuration.

D) telinit: telinit is another SysV tool that changes the system’s runlevel temporarily. It interacts with init to transition between runlevels but is not used for setting default targets on systemd systems.

systemctl set-default is correct because it provides persistent control over the default boot target in modern systemd environments. init and telinit are legacy tools, and runlevel only displays information. Understanding the transition from runlevels to targets is essential for Linux administration in contemporary distributions.

Question 25

Which command is used to display or set environment variables in a Linux shell?

A) export
B) env
C) set
D) printenv

Answer A) export

Explanation

A) export: The export command is used to set environment variables and mark them for export to child processes in a shell session. For example, export PATH=$PATH:/new/path adds a directory to the PATH variable for all subprocesses spawned from the current shell. export is essential for defining variables that affect program execution, shell scripts, and system configuration. Without export, variables are local to the shell and inaccessible to child processes. This ability to define and propagate environment variables makes export the correct choice.

B) env: The env command displays the current environment variables or executes a command in a modified environment. For example, env prints all environment variables, and env VAR=value command runs a command with a temporary variable setting. While env can be used to view and temporarily modify the environment, it does not permanently set variables in the current shell session.

C) set: The set command displays shell functions, shell variables, and positional parameters. It can also modify shell options. While it can be used to define variables within the shell, they are not automatically exported to child processes unless combined with export.

D) printenv: printenv displays the current environment variables. For example, printenv PATH prints the PATH variable. While useful for viewing environment variables, it does not set or export them.

export is correct because it defines environment variables and ensures they are available to child processes, making it essential for shell scripting, configuration, and application execution. env and printenv are useful for inspection and temporary modifications, and set manipulates shell variables without necessarily exporting them. Mastery of export is fundamental for Linux administration and effective environment management.

Question 26

Which command is used to display the current routing table in Linux?

A) route
B) netstat -r
C) ip route show
D) traceroute

Answer C) ip route show

Explanation

A) route: The route command displays the kernel routing table, showing destination networks, gateway addresses, interface names, and flags. While it is an older utility that works on many Linux systems, it is largely deprecated in favor of the ip route command. It provides useful routing information but lacks some modern features and formatting flexibility. For example, route -n outputs numeric addresses instead of resolving hostnames, making it readable but less versatile than newer commands.

B) netstat -r: netstat with the -r flag displays the routing table along with the interface information and routing statistics. While functional, netstat has been mostly replaced by the ip command suite in modern Linux distributions. netstat also provides a broader view of network connections, which may include unnecessary information when the sole focus is routing.

C) ip route show: The ip command is part of the iproute2 suite and provides comprehensive network configuration and management capabilities. The subcommand ip route show displays the current routing table in a clear, detailed format, including destination networks, gateways, interface names, and route metrics. It is the recommended tool in modern Linux distributions for viewing and managing routes. It supports advanced features like policy routing, multiple routing tables, and IPv6 support, making it the correct choice.

D) traceroute: traceroute traces the path packets take to reach a destination, listing each hop along the route and the time taken. While useful for diagnosing network reachability and identifying routing issues along a path, it does not display the local system’s routing table. It is a diagnostic tool rather than a configuration or route-viewing utility.

ip route show is correct because it provides a comprehensive, modern, and flexible view of the routing table in Linux. route and netstat -r are older tools with limited capabilities, while traceroute is for diagnostic path tracing rather than route inspection. For administrators managing network paths, gateways, or policy routing, ip route show is essential.

Question 27

Which command is used to change the permissions of a file or directory in Linux?

A) chmod
B) chown
C) umask
D) ls -l

Answer A) chmod

Explanation

A) chmod: The chmod command changes the access permissions of a file or directory. It allows setting read, write, and execute permissions for the owner, group, and others, either numerically (e.g., 755) or symbolically (e.g., u+rwx,g+rx,o+rx). For example, chmod 644 file.txt sets read/write permissions for the owner and read-only for group and others. chmod is essential for controlling file access, enforcing security policies, and maintaining system integrity. Proper use of chmod ensures that sensitive files are not accessible by unauthorized users and that directories are accessible as intended.

B) chown: chown changes the owner and group of a file or directory. While related to permissions, it modifies ownership rather than the actual permission bits. It is often used in combination with chmod to enforce security policies, but it does not set permissions directly.

C) umask: umask sets default permissions for newly created files and directories. It defines which permission bits should be masked out when files are created but does not change existing file permissions. While important for default security, umask cannot modify existing permissions.

D) ls -l: ls -l lists files and directories in long format, showing current permissions, ownership, size, and modification time. While informative for checking permissions, it cannot modify them. It is a diagnostic tool rather than a configuration utility.

chmod is the correct choice because it directly modifies file and directory permissions. chown controls ownership, umask sets default permissions for new files, and ls -l displays information without making changes. Mastery of chmod is essential for enforcing proper access control and maintaining system security in Linux.

Question 28

Which command is used to schedule a one-time task at a specific time in Linux?

A) at
B) cron
C) systemctl timer
D) nohup

Answer A) at

Explanation

A) at: The at command schedules a one-time task to run at a specific time. Users can specify the execution time in various formats, such as at 14:30 or at now + 1 hour. Commands are entered into a prompt and executed once at the scheduled time. For example, echo “backup.sh” | at 23:00 schedules the backup script to run at 11 PM. at is ideal for one-off tasks, maintenance scripts, or delayed command execution. It provides flexibility in scheduling and does not require modification of persistent scheduling files.

B) cron: cron schedules recurring tasks using crontab entries. It is designed for tasks that repeat at fixed intervals, such as daily, weekly, or monthly scripts. While powerful for repeated scheduling, cron is not intended for one-time execution without modifying or deleting crontab entries afterward.

C) systemctl timer: systemctl timers are part of systemd and can be used to schedule both one-time and recurring tasks. However, they require the creation of unit and timer files, which is more complex than using at for ad-hoc one-time tasks. Timers are ideal for managed services rather than quick, temporary scheduling.

D) nohup: nohup runs a command immune to hangups and allows it to continue running in the background after logging out. It is not a scheduling tool but a method to keep processes running independent of the user session. While useful for long-running tasks, it does not schedule them at specific times.

at is correct because it is specifically designed for scheduling one-time tasks at precise times. cron is for recurring jobs, systemctl timers are more complex for ad-hoc scheduling, and nohup keeps processes running rather than scheduling them. Using at ensures precise, temporary execution for administrative or maintenance purposes.

Question 29

Which command is used to display the groups a user belongs to in Linux?

A) groups
B) id
C) whoami
D) getent group

Answer A) groups

Explanation

A) groups: The groups command lists all groups to which a user belongs. Running groups username outputs all primary and secondary group memberships, providing insight into access rights and permissions. This is essential for understanding which resources and directories the user can access and is widely used for troubleshooting permissions issues. It shows real-time group membership as configured on the system, making it the correct choice for this task.

B) id: The id command provides detailed information about a user, including UID, GID, and all group memberships. While id includes group information, it also includes additional data like numeric IDs. While informative, groups is simpler and more focused for quickly listing group memberships.

C) whoami: whoami displays the username of the currently logged-in user. While helpful to identify the current session, it does not provide group information.

D) getent group: getent queries the group database and can show members of a particular group, e.g., getent group groupname. While it is useful for checking specific group membership, it is not as straightforward for listing all groups a user belongs to, requiring additional parsing or filtering.

groups is correct because it is direct, simple, and displays all groups a user is part of. id provides additional information but is less focused, whoami only shows the username, and getent requires additional steps to query user memberships. groups is the standard tool for quick group membership verification.

Question 30

Which command is used to display the current shell environment variables in Linux?

A) env
B) export
C) set
D) printenv

Answer A) env

Explanation

A) env: The env command displays the current environment variables and their values. For example, env outputs PATH, HOME, SHELL, and other system or user-defined variables. It is widely used for troubleshooting, shell scripting, and understanding the current session’s environment. It can also be used to run a command in a modified environment, e.g., env VAR=value command, making it highly versatile. env provides a snapshot of all active environment variables, which is essential for administrators and developers working with shell scripts and system configurations.

B) export: export sets environment variables and makes them available to child processes. For example, export PATH=$PATH:/new/path adds a directory to PATH. While it modifies the environment, it does not list all variables on its own.

C) set: set displays shell functions, shell variables, and positional parameters. While comprehensive, it includes more than just environment variables, making the output more cluttered. It also lists shell options and local variables, which can be overwhelming for quickly viewing only environment variables.

D) printenv: printenv displays environment variables, similar to env. While effective for checking individual variables, using printenv without arguments can produce similar output to env, but env is considered more versatile and standard across shell environments.

env is correct because it provides a complete, clear, and standard view of current environment variables. export sets variables, set displays a broader range of shell data, and printenv is functionally similar but less flexible for running commands in modified environments. Understanding env is critical for debugging, scripting, and system configuration in Linux.

Question 31

Which command is used to display all active systemd units and their status in Linux?

A) systemctl list-units
B) service –status-all
C) chkconfig –list
D) ps aux

Answer A) systemctl list-units

Explanation

A) systemctl list-units: The systemctl list-units command displays all active systemd units, including services, sockets, targets, devices, and mounts. It provides detailed status information such as whether the unit is loaded, active, or failed. For example, systemctl list-units lists all currently running services and their states, which is essential for administrators monitoring system performance, troubleshooting service failures, and ensuring proper service operation. systemctl interacts directly with systemd, which is the init system and service manager in modern Linux distributions, making it the most accurate and comprehensive tool for viewing active units.

B) service –status-all: This command lists all services in a legacy SysV format with their current status. While it provides a basic indication of whether a service is running or stopped, it does not offer information about other unit types like targets or sockets, and its output may be inconsistent on systemd-based systems. It is largely used for backward compatibility on older systems.

C) chkconfig –list: chkconfig is a tool for managing service runlevels in SysV init systems. It lists which services are enabled at different runlevels but does not display real-time status or information about other systemd units. Its use is limited on modern Linux distributions.

D) ps aux: ps aux lists all running processes along with their resource usage and associated user. While it can indirectly show whether services are running by examining processes, it does not provide structured unit information or the systemd state of each service. It is more suitable for process monitoring rather than unit management.

systemctl list-units is correct because it provides a real-time, comprehensive view of all active units managed by systemd. service –status-all and chkconfig –list are legacy tools with limited scope, and ps aux is process-focused rather than unit-focused. Understanding systemctl and its ability to list units is critical for modern Linux administration, allowing administrators to monitor, troubleshoot, and manage services and other system components efficiently.

Question 32

Which command is used to display the system hostname and related information in Linux?

A) hostnamectl
B) uname -n
C) cat /etc/hostname
D) hostname

Answer A) hostnamectl

Explanation

A) hostnamectl: The hostnamectl command provides comprehensive information about the system hostname, static hostname, transient hostname, pretty hostname, operating system, kernel, and architecture. It allows both viewing and changing the hostname in a systemd-based environment. For example, hostnamectl displays the current hostname configuration and can also be used to set it persistently with hostnamectl set-hostname newname. hostnamectl is integrated with systemd, making it the preferred method for hostname management on modern Linux distributions.

B) uname -n: uname -n displays the network node hostname of the system. While it provides the current hostname, it does not provide additional details such as operating system, kernel version, or architecture. Its functionality is limited to hostname display only.

C) cat /etc/hostname: This command reads the static hostname from the /etc/hostname file. While it allows administrators to see the configured static hostname, it does not provide additional metadata or allow dynamic hostname changes. It also does not integrate with systemd-managed hostname changes.

D) hostname: The hostname command can display or temporarily set the system hostname. While useful for quick changes or queries, it does not provide a comprehensive view of related system information such as kernel, OS, or architecture. It also does not persist changes across reboots without editing configuration files.

hostnamectl is correct because it offers a full view of hostname-related information and integrates with systemd for persistent changes. uname -n shows only the hostname, cat /etc/hostname reads a static file without metadata, and hostname is limited to temporary or basic changes. Using hostnamectl ensures proper hostname management in modern Linux environments.

Question 33

Which command is used to list all mounted filesystems and their usage statistics in Linux?

A) df -h
B) du -sh
C) mount
D) lsblk

Answer A) df -h

Explanation

A) df -h: The df command displays the disk space usage of filesystems, showing total, used, available space, and mount points. The -h flag outputs the sizes in human-readable format (KB, MB, GB). For example, df -h lists all mounted filesystems along with their usage, which is essential for monitoring storage capacity, preventing disk overfill, and planning backups. df provides a high-level view of disk usage for each filesystem rather than per-directory usage.

B) du -sh: The du command calculates disk usage for directories and files. While useful for identifying space-hungry directories, it does not provide a summary of mounted filesystems or total disk usage at the filesystem level. du focuses on content size rather than mount points.

C) mount: mount displays all currently mounted filesystems along with their mount options. While it shows where filesystems are mounted, it does not provide usage statistics such as free or available space. It is informative for configuration but not for capacity monitoring.

D) lsblk: lsblk lists block devices in a tree structure, including partitions and their sizes. While it provides insight into device structure, it does not report actual usage statistics for filesystems mounted on those devices. It is more focused on hardware topology than on filesystem usage.

df -h is correct because it provides a clear, concise view of all mounted filesystems and their disk usage statistics. du -sh focuses on directories, mount displays locations without usage stats, and lsblk shows devices rather than usage. Using df -h is fundamental for storage monitoring and management in Linux administration.

Question 34

Which command is used to change the default shell for a user in Linux?

A) chsh
B) passwd
C) usermod -s
D) su

Answer A) chsh

Explanation

A) chsh: The chsh (change shell) command allows users or administrators to change the default login shell for a user account. For example, chsh -s /bin/bash username sets Bash as the default shell for the specified user. This affects which shell is started during login sessions and is important for customizing user environments, enforcing consistent scripting behavior, and improving usability. chsh modifies the /etc/passwd entry for the user, ensuring the change is persistent across reboots.

B) passwd: passwd is used to change or set the password for a user account. While critical for security, it does not affect the user’s default shell or environment.

C) usermod -s: usermod with the -s flag can also change the login shell for a user, e.g., usermod -s /bin/zsh username. While effective, usermod is a more general tool for modifying user accounts, and chsh is more specifically intended for shell changes, providing a simpler and safer method for this specific task.

D) su: The su command allows switching to another user account temporarily. While it can invoke a different shell during the session, it does not change the default shell assigned to the user account. su is intended for privilege escalation or account switching rather than configuration changes.

chsh is correct because it is the standard, user-friendly command for changing the default login shell. passwd changes passwords, usermod -s is an alternative but less specialized, and su temporarily switches users. Proper use of chsh ensures consistent shell environments for users across login sessions.

Question 35

Which command is used to search for text patterns within files in Linux?

A) grep
B) find
C) locate
D) awk

Answer A) grep

Explanation

A) grep: grep is the standard command for searching text patterns in files. It supports regular expressions, case-insensitive search, line numbering, and recursive search. For example, grep “error” /var/log/syslog searches for the word “error” in the syslog file, while grep -r “error” /var/log/ searches recursively in all files under /var/log. grep is widely used for log analysis, debugging, and extracting specific data from text files, making it indispensable for Linux administration. Its power lies in pattern matching, filtering, and piping results to other commands.

B) find: find searches for files and directories based on name, type, size, or other attributes. While it can locate files, it does not search the contents of files unless combined with grep or other tools. It is a filesystem search tool rather than a text search tool.

C) locate: locate quickly searches for files using a prebuilt database. Like find, it searches filenames rather than the content of files. While fast, it is unsuitable for pattern searches within file content.

D) awk: awk is a text processing tool that can search, filter, and manipulate text data. While extremely powerful and scriptable, its primary use is for structured text extraction and manipulation rather than simple pattern searching. grep is simpler and more focused for quick searches.

grep is correct because it directly searches text patterns within files and supports advanced features like regular expressions, recursive search, and piping. find and locate search for files, not content, and awk is more suited for advanced text processing. Mastery of grep is essential for log analysis, troubleshooting, and data extraction in Linux systems.

Question 36

Which command is used to display detailed information about block devices and their partitions in Linux?

A) lsblk
B) fdisk -l
C) df -h
D) blkid

Answer A) lsblk

Explanation

A) lsblk: The lsblk command lists all block devices in a tree-like format, showing partitions, mount points, sizes, and device types. It provides a clear visual hierarchy of disks and their partitions, making it easier to understand storage topology. For example, lsblk -f displays filesystem types and labels. This command is crucial for system administrators when configuring new storage, troubleshooting disk issues, or verifying device structures. lsblk does not modify devices, making it safe for inspection. Its combination of clarity, real-time reporting, and support for various flags like -f (filesystem info) and -o (custom columns) makes it the preferred choice for detailed block device information.

B) fdisk -l: fdisk -l lists all partitions on all disks along with size, type, and start/end sectors. While highly informative, fdisk focuses on partition table information and is typically used for disk management and partitioning. It is not as convenient for visualizing device hierarchies and mounted filesystems compared to lsblk.

C) df -h: df displays mounted filesystems and their disk usage in human-readable format. While it provides space utilization data, it does not give detailed information about the block devices themselves or their hierarchical structure.

D) blkid: blkid displays the block device identifiers, such as UUIDs and filesystem types. While useful for scripting and fstab configuration, it does not provide a hierarchical view or size information, making it less suitable for comprehensive device inspection.

lsblk is correct because it provides a clear, structured view of all block devices and partitions, including mount points and filesystem types. fdisk -l is partition-focused, df -h is usage-focused, and blkid is identifier-focused. Using lsblk allows administrators to quickly understand storage layout and device relationships, essential for system management and troubleshooting.

Question 37

Which command is used to display currently loaded kernel modules in Linux?

A) lsmod
B) modinfo
C) insmod
D) dmesg

Answer A) lsmod

Explanation

A) lsmod: The lsmod command lists all currently loaded kernel modules along with their size and usage count. Kernel modules are dynamically loaded pieces of code that extend the kernel’s functionality, such as device drivers or filesystem support. For example, running lsmod outputs the module name, size, and the number of dependent modules, helping administrators verify driver loading and troubleshoot hardware issues. lsmod interacts with the /proc/modules file and is read-only, making it safe for inspection without affecting the system. Its simplicity and direct focus on loaded modules make it the standard command for checking active kernel modules.

B) modinfo: modinfo displays detailed information about a specific kernel module, such as author, description, license, dependencies, and parameters. While informative, it requires specifying a module and does not provide a list of currently loaded modules.

C) insmod: insmod inserts a kernel module into the running kernel. It is used for loading modules but does not display information about modules already loaded. Misuse can destabilize the system, so it is not intended for inspection.

D) dmesg: dmesg displays the kernel ring buffer messages, which include system startup logs and hardware initialization. While it may show module loading events, it does not provide a structured list of currently loaded modules or usage counts.

lsmod is correct because it directly lists all active kernel modules, their size, and dependencies, making it the standard tool for module inspection. modinfo provides detailed information about a specific module, insmod loads modules, and dmesg shows kernel logs. Understanding lsmod is essential for hardware troubleshooting and kernel module management in Linux.

Question 38

Which command is used to view open files and the processes using them on a Linux system?

A) lsof
B) fuser
C) ps aux
D) netstat

Answer A) lsof

Explanation

A) lsof: The lsof (list open files) command displays all open files and the processes that are using them. In Linux, everything is treated as a file, including directories, sockets, pipes, and devices, so lsof provides a comprehensive view of system activity. For example, lsof /var/log/syslog shows which processes are accessing that log file. It is invaluable for diagnosing file locks, resource usage, network connections, and security issues. lsof provides PID, command, user, file descriptor, file type, and file path, making it highly detailed and precise for system auditing.

B) fuser: fuser shows which processes are using a specific file, directory, or port. While useful for identifying process ownership, it is more limited than lsof, which provides a more detailed and comprehensive listing.

C) ps aux: ps aux lists all running processes and their resource usage. While it shows process information, it does not provide details about the files those processes have open, making it unsuitable for tracking file usage.

D) netstat: netstat shows active network connections, listening ports, and routing information. While it can indirectly indicate which processes are using network sockets, it does not cover files, directories, or devices.

lsof is correct because it provides a detailed, system-wide view of all open files and associated processes. fuser is limited to specific files or ports, ps aux shows processes without file details, and netstat focuses on network connections. Mastering lsof is essential for system monitoring, troubleshooting file locks, and security auditing in Linux.

Question 39

Which command is used to monitor real-time system log messages in Linux?

A) tail -f /var/log/messages
B) cat /var/log/messages
C) dmesg
D) journalctl -u

Answer A) tail -f /var/log/messages

Explanation

A) tail -f /var/log/messages: The tail command with the -f flag continuously displays the end of a file, updating the output as new lines are appended. For example, tail -f /var/log/messages shows real-time system log messages as they occur. This is essential for monitoring system events, troubleshooting services, or observing errors as they happen. tail -f provides immediate feedback and is simple to use, making it ideal for live log monitoring.

B) cat /var/log/messages: cat displays the entire content of a log file at a single point in time. While useful for reviewing historical logs, it does not provide real-time updates, limiting its utility for monitoring ongoing events.

C) dmesg: dmesg displays kernel ring buffer messages, including boot and hardware logs. While useful for diagnosing kernel or hardware events, it does not provide real-time updates of general system log files like /var/log/messages.

D) journalctl -u: journalctl displays systemd journal logs, and the -u flag filters logs for a specific unit. While it can provide live updates with journalctl -f -u service, it is unit-specific and requires systemd. tail -f is more general for monitoring any log file in real time.

tail -f /var/log/messages is correct because it provides a continuous, live view of log file updates. cat only shows static snapshots, dmesg is kernel-focused, and journalctl -u is unit-specific in systemd. tail -f remains the standard tool for administrators monitoring general system logs in real time.

Question 40

Which command is used to change file ownership in Linux?

A) chown
B) chmod
C) chgrp
D) ls -l

Answer A) chown

Explanation

A) chown: The chown command changes the ownership of a file or directory. It can modify both the user and group ownership, for example, chown user:group file.txt. Proper use of chown is critical for enforcing file security, controlling access, and ensuring correct permissions in multi-user environments. Changing ownership affects who can modify or execute files, making it a key aspect of system administration. chown interacts directly with the filesystem and updates the /etc/passwd and /etc/group mappings indirectly through ownership assignment.

B) chmod: chmod changes the permission bits of a file or directory, controlling read, write, and execute access. While related to security, it does not change file ownership.

C) chgrp: chgrp changes the group ownership of a file or directory. While useful for group management, it cannot modify the user ownership, so it is more limited than chown.

D) ls -l: ls -l displays file and directory information, including ownership and permissions. It is purely informational and cannot change ownership.

chown is correct because it directly modifies user and group ownership of files and directories. chmod controls permissions, chgrp only changes group ownership, and ls -l displays ownership without making changes. Proper use of chown ensures secure file management and access control in Linux systems.