Linux Foundation Certified System Administrator (LFCS) Practice Exam

What the Linux Foundation Certified System Administrator (LFCS) exam covers

• Essential Commands171 questions
• Operations Deployment213 questions
• Users and Groups84 questions
• Networking210 questions
• Storage170 questions

Free LFCS practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 848-question bank.

1. Question 1Essential Commands

   What does sudo provide?

   • ARunning commands with elevated (often root) privileges per policy in /etc/sudoersCorrect
   • BSwitching to another shell without changing the caller's privileges at all
   • CLogging every command a user types for later audit and playback
   • DRestricting a user to a limited set of commands inside a chroot jail
   ✓ Correct answer: A

   sudo lets authorised users run individual commands as root or another user according to rules in /etc/sudoers, without sharing the root password, and logs each invocation for accountability. This supports least-privilege administration.

   Why the other options are wrong

   • Bsudo runs a command as another user, usually root, so the caller's effective privileges do change; a shell switch that keeps the same privileges is not what sudo is for.
   • Csudo can record the I/O of commands run through it (log_input and log_output, replayed with sudoreplay), but that is an optional extra for sudo-run commands; it does not log everything a user types in their own shell, and privilege delegation is its purpose.
   • Dsudoers can limit which commands a user may run through sudo, and its deprecated CHROOT setting can run such a command in a chroot, but those are optional restrictions on sudo-run commands; what sudo provides is running commands with another user's privileges per policy, and confining a user's own session in a jail comes from the login setup, such as sshd ChrootDirectory.
2. Question 2Operations Deployment

   Which journalctl option filters messages by priority, showing only errors and worse?

   • Ajournalctl -g err
   • Bjournalctl -t err
   • Cjournalctl -p errCorrect
   • Djournalctl -u err
   ✓ Correct answer: C

   The -p (--priority) option filters by syslog priority level, and specifying err shows messages at err level and all more severe levels (crit, alert, emerg). Priority filtering uses the standard syslog severity scale, so -p err is the correct way to see only errors and worse.

   Why the other options are wrong

   • Ajournalctl -g err uses --grep to match the literal pattern 'err' in message text via regex; it does not filter by priority level.
   • Bjournalctl -t err filters by syslog identifier (the program tag), treating 'err' as a tag name, not a severity.
   • Djournalctl -u err filters by systemd unit named 'err'; it does not select messages by priority.
3. Question 3Essential Commands

   A log file may contain duplicate adjacent lines. You run 'sort access.log | uniq -c | sort -rn'. What is the result?

   • AA list of unique lines each prefixed by its occurrence count, ordered from most to least frequentCorrect
   • BOnly the lines that appear exactly once in the file, listed in alphabetical order
   • CAll lines reversed character by character
   • DThe line count of the file printed as a single number
   ✓ Correct answer: A

   uniq only collapses adjacent duplicate lines, so the file is first piped through sort to group identical lines together. uniq -c then prepends each unique line with the number of times it occurred. The final 'sort -rn' performs a reverse numeric sort on that leading count field, placing the most frequent lines at the top. This sort | uniq -c | sort -rn idiom is the classic way to build a frequency-ranked report.

   Why the other options are wrong

   • BOnly the lines that appear exactly once, in alphabetical order is incorrect because that describes 'uniq -u', whereas -c counts and outputs every unique line, not just singletons.
   • CAll lines reversed character by character is incorrect because no command in the pipeline reverses characters; 'rev' would do that, and sort -r reverses sort order, not text.
   • DThe line count of the file printed as a single number is incorrect because that is the behavior of 'wc -l', not this pipeline.
4. Question 4Storage

   After creating /dev/sdb1 with mkfs.xfs, you want a persistent, non-volatile identifier to reference the filesystem in /etc/fstab instead of the device node. Which command displays the UUID of the new filesystem?

   • Ablkid /dev/sdb1Correct
   • Bfdisk -l /dev/sdb1
   • Cdf -h /dev/sdb1
   • Dlsof /dev/sdb1
   ✓ Correct answer: A

   blkid reads filesystem and partition metadata directly from block devices and prints attributes including UUID, LABEL, and TYPE. Referencing a filesystem by UUID in /etc/fstab is the recommended practice because UUIDs survive device-name reordering that can occur when disks are added or the kernel enumerates devices differently. The output line looks like '/dev/sdb1: UUID="..." TYPE="xfs"', which you can copy into an fstab entry as 'UUID=...'. This makes blkid the correct tool here.

   Why the other options are wrong

   • Bfdisk -l /dev/sdb1 is incorrect because fdisk reports partition table geometry and partition type codes, not the filesystem UUID.
   • Cdf -h /dev/sdb1 is incorrect because df reports mounted filesystem space usage and requires the device to be mounted, and it does not show the UUID.
   • Dlsof /dev/sdb1 is incorrect because lsof lists open files/processes using a resource, not filesystem identifiers.
5. Question 5Essential Commands

   You run 'sort -t: -k3 -n /etc/passwd'. How are the lines of /etc/passwd ordered in the output?

   • ABy the numeric value of the third colon-separated field (UID)Correct
   • BAlphabetically by the entire line
   • CBy the third character of each line, ascending
   • DBy the third whitespace-separated field, numerically
   ✓ Correct answer: A

   The -t: option sets the field delimiter to a colon, matching the format of /etc/passwd, and -k3 selects the third field, which is the UID, as the sort key. The -n flag forces a numeric comparison so that values like 2 and 10 sort by magnitude rather than lexically. The default direction is ascending, so the lowest UID appears first.

   Why the other options are wrong

   • BAlphabetically by the entire line is incorrect because -k3 restricts the key to the third field rather than the whole line.
   • CBy the third character of each line, ascending is incorrect because -k references fields delimited by -t, not character positions.
   • DBy the third whitespace-separated field, numerically is incorrect because -t: changes the delimiter to a colon, so whitespace is not used to split fields.
6. Question 6Operations Deployment

   A process started by your shell as job %3 is stopped, and you simply want to terminate it using its job specifier rather than looking up its PID. Which command sends SIGTERM to that job?

   • Akill %3Correct
   • Bkill -3
   • Cpkill %3
   • Dkillall %3
   ✓ Correct answer: A

   The bash kill builtin accepts job specifications that begin with %, so kill %3 signals job 3 without looking up its PID, and with no signal named it sends SIGTERM. A stopped process cannot act on SIGTERM until it runs again, so when the job is stopped bash also sends SIGCONT to the job's process group after the SIGTERM, which lets the pending signal terminate it.

   Why the other options are wrong

   • Bkill -3 is incorrect because -3 is parsed as a signal specifier (SIGQUIT) with no target PID, so kill would print a usage error rather than signal job 3.
   • Cpkill %3 is incorrect because pkill matches by process name or attributes and does not understand shell job specs; '%3' would be treated as a name pattern.
   • Dkillall %3 is incorrect because killall matches by command name, so it would search for a program literally named '%3' and find none.
7. Question 7Networking

   Which command runs mtr non-interactively in report mode, sending 10 probe cycles to gw.example.com and printing a summary table?

   • Amtr --report --report-cycles 10 gw.example.comCorrect
   • Bmtr --summary --report-cycles 10 gw.example.com
   • Cmtr -i 10 gw.example.com
   • Dmtr --once gw.example.com
   ✓ Correct answer: A

   'mtr --report --report-cycles 10 gw.example.com' (short form -r -c 10) sends ten rounds of probes, then exits after printing a summary suitable for pasting into a ticket. It does not require a terminal.

   Why the other options are wrong

   • Bmtr has no --summary option.
   • C-i sets the interval between probes in seconds, not the cycle count or report mode.
   • Dmtr has no --once option.
8. Question 8Networking

   After bringing up an interface you run 'ip -br addr show'. What does the '-br' option do?

   • AIt prints a brief, one-line-per-interface summary showing name, operational state, and addressesCorrect
   • BIt combines all listed interfaces into a single bridge device and prints the resulting bridge members
   • CIt broadcasts the current address information to every host on the connected subnet for discovery
   • DIt rebinds the interface and forces it to request a fresh lease from a new DHCP server
   ✓ Correct answer: A

   The '-br' (brief) modifier to the ip command condenses output into a compact tabular form, with one line per interface listing the interface name, its operational state (UP/DOWN/UNKNOWN), and its assigned addresses. This is far easier to scan than the default multi-line output and works with both 'ip -br addr' and 'ip -br link'. It is purely a display option and changes nothing about the interface configuration.

   Why the other options are wrong

   • B-br only controls output formatting; it never creates or bridges devices.
   • Cip addr show is a local query and sends nothing onto the network.
   • D-br does not touch DHCP; it just formats the show output.
9. Question 9Networking

   You want every connection to the host shortcut name 'web' to actually connect to web03.example.com on port 2222 as user 'deploy' using a specific identity file, configured once in your client. In which file do you add a 'Host web' block with HostName, Port, User, and IdentityFile?

   • A~/.ssh/configCorrect
   • B/etc/ssh/sshd_config
   • C~/.ssh/known_hosts
   • D~/.ssh/authorized_keys
   ✓ Correct answer: A

   The per-user SSH client configuration file ~/.ssh/config lets you define Host blocks (aliases) with directives such as HostName, Port, User, and IdentityFile, so 'ssh web' expands to the full settings automatically. This avoids retyping options on every connection and is the standard place for client-side connection profiles. It applies only to the ssh client, not the server.

   Why the other options are wrong

   • B/etc/ssh/sshd_config is incorrect because that file configures the server daemon (sshd), not the outbound client behavior.
   • C~/.ssh/known_hosts is incorrect because it stores remote servers' host public keys for verification and cannot define connection aliases.
   • D~/.ssh/authorized_keys is incorrect because it lists public keys permitted to log in to an account on a server, not client connection settings.
10. Question 10Storage

    You created a dedicated swap partition at /dev/sdb2. Which command initializes it with the proper swap signature so the kernel will recognize it as swap space?

    • Amkswap /dev/sdb2Correct
    • Bmkfs.swap /dev/sdb2
    • Cswapon --format /dev/sdb2
    • Dmkfs -t swap /dev/sdb2
    ✓ Correct answer: A

    mkswap is the dedicated tool that writes the swap-area signature (the header containing the magic string, version, and a UUID) onto a partition or file so the kernel can later activate it with swapon. After mkswap the device is formatted as swap but not yet in use until swapon enables it, and mkswap also assigns a UUID you can reference in /etc/fstab. Running it on the raw partition is the correct, single-step way to prepare swap.

    Why the other options are wrong

    • Bmkfs.swap /dev/sdb2 is wrong because no mkfs.swap helper exists; mkfs only has helpers for real filesystems like mkfs.ext4 and mkfs.xfs.
    • Cswapon --format /dev/sdb2 is wrong because swapon has no --format option; swapon only activates space already prepared by mkswap.
    • Dmkfs -t swap /dev/sdb2 is wrong because mkfs dispatches to a mkfs.<type> helper, and since mkfs.swap does not exist this fails with 'mkfs.swap: not found'.

Who this Linux Foundation Certified System Administrator (LFCS) practice exam is for

This practice set is for anyone preparing for the Linux Foundation Certified System Administrator (LFCS) exam at the foundational level - from first-time candidates building a foundation to experienced Linux practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Linux Foundation Certified System Administrator (LFCS) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Treat your readiness score as knowledge readiness, then validate it with hands-on practice in a real environment before booking the Linux Foundation Certified System Administrator (LFCS) exam.

Related Linux resources

• Linux Foundation Certified System Administrator (LFCS) study guideKey concepts
• Linux practice examsAll Linux
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Hands-on lfcs labsLearn
• Hands-on linux-plus labsLearn
• LFCS command cheat sheetCheat sheet
• Debian and Red Hat, side by sideCheat sheet
• Linux+ XK0-006 command cheat sheetCheat sheet
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• LPIC-1 practice examRelated
• LPIC-2 practice examRelated
• Red Hat Certified Ansible (EX294-style) practice examRelated

Linux Foundation Certified System Administrator (LFCS) practice exam FAQ