Linux Foundation Certified System Administrator (LFCS) Practice Exam

What the Linux Foundation Certified System Administrator (LFCS) exam covers

• Essential Commands260 questions
• Operations Deployment324 questions
• Users and Groups130 questions
• Networking324 questions
• Storage260 questions

Free Linux Foundation Certified System Administrator (LFCS) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,298.

1. Question 1Essential Commands

   Which command changes the permissions of a file?

   • Als
   • BchmodCorrect
   • Cping
   • Dchown
   ✓ Correct answer: B

   chmod (change mode) is the dedicated utility for altering the read, write, and execute permission bits of files and directories, accepting either symbolic notation such as u+x or octal notation such as 755. Mastering it is core to controlling who may access or run a given file on Linux.

   Why the other options are wrong

   • Als only lists directory contents and file metadata; it displays permissions but cannot change them.
   • Cping sends ICMP echo requests to test network reachability and has nothing to do with file permissions.
   • Dchown changes the owner and group of a file, not its permission bits.
2. Question 2Operations Deployment

   A daemon occasionally hangs. You want systemd to detect the hang and restart it, not just react to clean exits. What is the best design?

   • Aset Restart=on-abnormal so unclean signals trigger a restart
   • Brely on Type=simple with only Restart=on-failure for exits
   • Cadd a separate cron job that kills the process every hour on schedule
   • Dimplement sd_notify watchdog support and set WatchdogSec= with Restart=on-watchdog (or Restart=always)Correct
   ✓ Correct answer: D

   A hung daemon may never exit, so exit-based restart policies cannot detect it. With sd_notify watchdog support, the service periodically pings systemd; setting WatchdogSec= makes systemd consider the service hung if it misses a ping, and Restart=on-watchdog (or Restart=always) then restarts it, detecting and recovering from hangs.

   Why the other options are wrong

   • ARestart=on-abnormal reacts to signals and timeouts but cannot detect a process that hangs while still running.
   • BRestart=on-failure only fires on a non-zero exit; a hung process never exits, so it is never restarted.
   • CA blind hourly kill disrupts healthy runs and still misses hangs that occur between the scheduled kills.
3. Question 3Networking

   An app server reaches a database at 10.50.0.10 fine, but a newly added subnet 10.60.0.0/24 behind a second gateway is unreachable, while internet access still works. 'ip route' shows only a default route via the primary gateway. What is the fix?

   • Aadd a specific route for the subnet, e.g., 'ip route add 10.60.0.0/24 via <second-gateway> dev <iface>' (persisting it in network config)Correct
   • BAdd each 10.60.0.0/24 host to /etc/hosts with its address
   • CFlush the routing table with 'ip route flush cache' to force relearning
   • DAdd a second default route so the kernel balances traffic across both gateways
   ✓ Correct answer: A

   With only a default route, all non-local traffic goes through the primary gateway, so a subnet reachable only through a second gateway is unreachable. The fix is to add an explicit route for that destination, e.g. 'ip route add 10.60.0.0/24 via <second-gateway> dev <iface>', and persist it in the network configuration so the kernel sends 10.60.0.0/24 traffic through the correct next hop while everything else still uses the default route.

   Why the other options are wrong

   • B/etc/hosts resolves names to addresses; it does not create a route to an unreachable subnet.
   • CFlushing the route cache does not add the missing path; the specific subnet route is still absent.
   • DA second default route creates ambiguity and asymmetric routing rather than reaching the specific subnet.
4. Question 4Users and GroupsSelect all that apply

   Which TWO files are directly modified when you successfully run 'groupadd developers' on a typical Linux system? (Choose TWO)

   • A/etc/groupCorrect
   • B/etc/gshadowCorrect
   • C/etc/passwd
   • D/etc/skel/.bashrc
   ✓ Correct answer: A, B

   groupadd creates a new group definition, which adds a line to /etc/group containing the group name, an 'x' password placeholder, the assigned GID, and an (initially empty) member list. On systems with shadowed group passwords it also appends a corresponding entry to /etc/gshadow holding the secure group password and administrator information. Together these two files fully define the newly created group.

   Why the other options are wrong

   • C/etc/passwd is incorrect because that file stores user accounts, not group definitions, and adding a group does not create or modify any user record there.
   • D/etc/skel/.bashrc is incorrect because /etc/skel only supplies template files for new home directories during user creation and is never touched by groupadd.
5. Question 5Essential Commands

   You need to remove an empty directory /tmp/scratch but the command must FAIL (not recurse) if the directory unexpectedly contains files. Which command is the safest choice?

   • Armdir /tmp/scratchCorrect
   • Brm -rf /tmp/scratch
   • Crm -r /tmp/scratch
   • Drm -d -f /tmp/scratch
   ✓ Correct answer: A

   rmdir removes only an empty directory and refuses, with an error, if the directory contains any entries. This built-in safety is exactly what is wanted: if /tmp/scratch unexpectedly holds files, the command fails rather than deleting them. It is the conventional, safe tool for removing directories you believe should be empty.

   Why the other options are wrong

   • Brm -rf /tmp/scratch is incorrect because -r recurses and -f forces deletion of any contents without complaint, which is the opposite of the desired fail-if-not-empty behavior.
   • Crm -r /tmp/scratch is incorrect because -r recursively deletes whatever is inside rather than failing when files are present.
   • Drm -d -f /tmp/scratch is incorrect because -d allows rm to remove a directory and the -f flag suppresses errors; while -d alone fails on a non-empty directory, adding -f and the recursive risk make rmdir the clearer, safest single-purpose choice.
6. Question 6Essential Commands

   While reading a man page in the default pager, you want to search forward within the page for the word 'EXAMPLES' and jump to it. Which keystroke initiates a forward search in the less pager that man uses?

   • A/EXAMPLES then EnterCorrect
   • B:EXAMPLES then Enter
   • C!EXAMPLES then Enter
   • D@EXAMPLES then Enter
   ✓ Correct answer: A

   The less pager uses vi-style navigation: pressing / enters forward-search mode and prompts for a pattern at the bottom of the screen. Typing the search term and pressing Enter moves the display to the first match below the current position. Man uses less as its default pager, so the same keystrokes apply when reading manual pages.

   Why the other options are wrong

   • BThe colon (:) prefix is a less command mode for actions like :q to quit or jumping to a specific line in some contexts, but ':EXAMPLES' is not a valid search syntax and would not perform a text search.
   • CThe exclamation mark (!) in less is used to invoke a shell command (shell escape), not to search for text. Typing '!EXAMPLES' would attempt to run 'EXAMPLES' as a shell command.
   • DThe at-sign (@) is not a standard less navigation or search prefix and would have no effect or be ignored in the pager.
7. Question 7Operations Deployment

   A junior admin wants logrotate to compress rotated logs and keep four weeks of weekly rotations for /var/log/myapp.log. Which logrotate directive set, placed in /etc/logrotate.d/myapp, is correct?

   • AWeekly, rotate 4, compressCorrect
   • BDaily, keep 4, gzip on
   • CInterval weekly, retain 4, compressed
   • Dschedule=weekly, count=4, zip
   ✓ Correct answer: A

   In logrotate configuration, 'weekly' sets the rotation frequency, 'rotate 4' keeps four old (rotated) copies before deleting the oldest, and 'compress' gzips the rotated files. With weekly rotation plus 'rotate 4' you retain roughly four weeks of history. These directives are placed inside a stanza like '/var/log/myapp.log { weekly\n rotate 4\n compress\n }'.

   Why the other options are wrong

   • Bdaily, keep 4, gzip on is incorrect because logrotate uses 'rotate N' to set retention (there is no 'keep'), 'compress' (not 'gzip on'), and 'daily' would rotate every day rather than weekly.
   • Cinterval weekly, retain 4, compressed is incorrect because the keywords are 'weekly', 'rotate', and 'compress', not 'interval', 'retain', or 'compressed'.
   • Dschedule=weekly, count=4, zip is incorrect because logrotate directives are bare keywords, not key=value pairs, and 'zip' is not a valid compression directive.
8. Question 8Users and Groups

   You must safely edit /etc/passwd to fix a malformed entry, ensuring the file is locked against concurrent modification by useradd or passwd while you work. Which command should you use?

   • AvipwCorrect
   • Bvi /etc/passwd
   • Cpasswd -e /etc/passwd
   • Dgetent -w passwd
   ✓ Correct answer: A

   vipw opens /etc/passwd in the editor defined by $EDITOR while holding the proper locks (creating /etc/.pwd.lock) so that tools such as useradd, usermod, or passwd cannot modify the file simultaneously and corrupt it. On exit it offers to edit /etc/shadow as well and performs basic consistency checking. This locking is the entire reason vipw exists rather than editing the file directly.

   Why the other options are wrong

   • Bvi /etc/passwd is incorrect because opening the file directly takes no lock, so a concurrent passwd or useradd run could overwrite your changes or corrupt the database.
   • Cpasswd -e /etc/passwd is incorrect because passwd -e expires a user's password and does not edit the passwd file.
   • Dgetent -w passwd is incorrect because getent only queries databases and has no editing or locking capability.
9. Question 9Networking

   Which legacy command, still available on many systems via the net-tools package, displays the kernel routing table including the Gateway, Genmask, and Flags columns in numeric form?

   • Aroute -nCorrect
   • Barp -n
   • Cifconfig -r
   • Dnetstat -i
   ✓ Correct answer: A

   The legacy 'route -n' command from net-tools prints the IPv4 kernel routing table with columns for Destination, Gateway, Genmask, Flags, Metric, Ref, Use, and Iface, where -n suppresses DNS resolution to show numeric addresses. It is the historical counterpart to 'ip route show'; the 'U' flag means the route is up and 'G' marks a route that uses a gateway. Although deprecated in favor of iproute2, it still appears in many environments and exam scenarios.

   Why the other options are wrong

   • Barp -n is incorrect because it shows the ARP cache (IP-to-MAC mappings), not routes.
   • Cifconfig -r is incorrect because ifconfig configures interfaces and has no '-r' route-display option.
   • Dnetstat -i is incorrect because '-i' shows interface statistics; routing is shown by 'netstat -r', not '-i'.
10. Question 10Storage

    A teammate ran 'parted /dev/sdb mkpart primary ext4 1MiB 100GiB' and parted warned: 'The resulting partition is not properly aligned for best performance.' What does proper partition alignment refer to?

    • AStarting the partition on a boundary that matches the device's physical sector/erase-block size (often 1 MiB), so I/O is not split across underlying unitsCorrect
    • BEnsuring the numeric partition index matches its slot position within the GPT partition entry array so tools list it in order
    • CPadding the partition's name label so the label string lands on a 16-byte boundary inside the GPT header block for validity
    • DMaking the partition end exactly on an even-numbered cylinder boundary as historically required by the legacy MBR scheme
    ✓ Correct answer: A

    Partition alignment means the partition's starting offset falls on a multiple of the underlying storage unit (such as a 4 KiB physical sector on Advanced Format disks or an SSD erase block). Misalignment forces reads and writes to straddle two physical units, causing read-modify-write penalties and reduced performance. Using a 1 MiB start (the default with parted's optimal alignment, or '0%') safely satisfies common alignment requirements.

    Why the other options are wrong

    • BAlignment concerns the on-disk start offset, not the partition's index slot in the GPT array.
    • CAlignment is about I/O boundaries, not padding of the label string in the header.
    • DModern alignment uses the 1 MiB offset, not legacy even-cylinder MBR boundaries.

Related Linux resources

• Linux Foundation Certified System Administrator (LFCS) study guideKey concepts
• Linux practice examsAll Linux
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Red Hat Certified System Administrator (RHCSA, EX200-style) practice examRelated
• LPIC-1 practice examRelated
• LPIC-2 practice examRelated

Linux Foundation Certified System Administrator (LFCS) practice exam FAQ