LPIC-1: Linux Administrator Practice Exam

What the LPIC-1 exam covers

• System Architecture299 questions
• Linux Installation and Package Management251 questions
• GNU and Unix Commands254 questions
• Devices, Linux Filesystems, FHS251 questions
• Shells and Shell Scripting246 questions
• Desktops, Admin Tasks, Essential Services, Networking, and Security204 questions

Free LPIC-1 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,505.

1. Question 1System Architecture

   Which command is used to display messages generated by the kernel during the boot process?

   • Asyslog --kernel
   • Bbootlog
   • Cjournalctl --boot-messages
   • DdmesgCorrect
   ✓ Correct answer: D

   The kernel writes early boot and runtime messages to a fixed-size in-memory ring buffer. The dmesg command prints the contents of that kernel ring buffer, showing hardware detection, driver initialization, and other kernel-level events, which makes it the go-to tool for diagnosing boot and hardware problems.

   Why the other options are wrong

   • Asyslog --kernel is not a real command; syslog refers to the system logging service and message format, and it has no --kernel option for reading the kernel ring buffer.
   • Bbootlog is not a standard Linux command and does not exist in normal distributions.
   • Cjournalctl --boot-messages uses an invalid option; the correct journalctl flag is -b (or --boot), and even then it reads the journal rather than the raw kernel ring buffer.
2. Question 2Linux Installation and Package Management

   When /boot is a separate partition, what must it be large enough to store?

   • AOnly the compressed kernel image (vmlinuz)
   • BThe entire root filesystem and all installed packages
   • CSwap space plus the systemd journal archives
   • DThe kernel image, initramfs, and bootloader filesCorrect
   ✓ Correct answer: D

   When /boot is a separate partition it must be large enough for each installed kernel image, its matching initramfs or initrd, and the bootloader's files such as GRUB modules and config. These are needed before the root filesystem is mounted. Keeping several kernels can require a few hundred megabytes.

   Why the other options are wrong

   • AThe initramfs and bootloader files are also required, not just vmlinuz.
   • BThe root filesystem and packages live on the root partition, not /boot.
   • CSwap is a separate area and journals are stored under /var.
3. Question 3Shells and Shell Scripting

   What does the 'source' command (or its shorthand '.') do in bash?

   • ADisplays the source code of a command
   • BExecutes commands from a file in the current shell environmentCorrect
   • CDownloads and installs a source code package
   • DCreates a backup copy of a file
   ✓ Correct answer: B

   The source builtin (and its shorthand dot, .) reads and runs the commands in a file within the current shell, so any variables, functions, or directory changes it makes persist. This is why you re-source ~/.bashrc to apply edits without opening a new shell.

   Why the other options are wrong

   • ADisplays the source code of a command describes type or which (or 'declare -f' for functions), not source.
   • CDownloads and installs a source code package describes a package manager or build process, not the source builtin.
   • DCreates a backup copy of a file describes cp, not source.
4. Question 4Linux Installation and Package Management

   An administrator added /usr/local/lib to /etc/ld.so.conf.d/local.conf but a newly installed library there is still reported as "not found" by a service. Assuming the file content is correct, what is the most likely cause?

   • ALdconfig was not run, so /etc/ld.so.cache was not rebuiltCorrect
   • BThe library must be copied into /etc/ld.so.conf.d/ to be found
   • CLD_LIBRARY_PATH must always be set for /usr/local/lib to work
   • DThe system must be reinstalled to register new library paths
   ✓ Correct answer: A

   The dynamic linker resolves library SONAMEs at runtime using the precompiled cache file /etc/ld.so.cache rather than scanning directories on every load. Adding a path to /etc/ld.so.conf.d/ only takes effect after ldconfig reads the configuration, scans the directories, and regenerates the cache and the necessary version symlinks. Until ldconfig is executed, the new directory and its library remain absent from the cache and the linker reports "not found." Running ldconfig (optionally ldconfig -v to watch it process the path) resolves the issue.

   Why the other options are wrong

   • BThe library must be copied into /etc/ld.so.conf.d/ to be found is incorrect because that directory holds configuration text files listing paths, not the library binaries themselves.
   • CLD_LIBRARY_PATH must always be set for /usr/local/lib to work is incorrect because once the path is in the cache via ldconfig, no environment variable is needed; LD_LIBRARY_PATH is only an optional override.
   • DThe system must be reinstalled to register new library paths is incorrect because library paths are registered simply by editing the config and running ldconfig, never requiring reinstallation.
5. Question 5Desktops, Admin Tasks, Essential Services, Networking, and Security

   An IPv6 address begins with the prefix fe80::. What type of address is this, and what is its scope?

   • AA global unicast address routable across the Internet
   • BA link-local address valid only on the local network segmentCorrect
   • CA unique local address equivalent to IPv4 private ranges
   • DA multicast address used for neighbor discovery
   ✓ Correct answer: B

   Addresses in the fe80::/10 range are IPv6 link-local addresses, automatically configured on every IPv6-enabled interface. Their scope is limited to a single link, so routers never forward them off the local segment; they are used for neighbor discovery and as next-hop addresses, and often require a zone identifier such as fe80::1%eth0.

   Why the other options are wrong

   • AA global unicast address routable across the Internet is wrong because globally routable unicast addresses fall under 2000::/3, not fe80::.
   • CA unique local address equivalent to IPv4 private ranges is wrong because unique local addresses use the fc00::/7 (commonly fd00::/8) prefix.
   • DA multicast address used for neighbor discovery is wrong because IPv6 multicast addresses begin with ff00::/8, not fe80::.
6. Question 6System Architecture

   You want to watch, in real time, the kernel uevents and the resulting udev events as you plug in a USB device, to see which rules and properties apply. Which command displays this live event stream?

   • AUdevadm monitor --kernel --udev --propertyCorrect
   • BUdevadm info --watch
   • CUdevadm trigger --verbose --monitor
   • DUdevadm settle --print-events
   ✓ Correct answer: A

   udevadm monitor listens on the netlink socket and prints events as they occur. The --kernel option shows the raw uevents the kernel emits, --udev shows the events after udev has processed them, and --property includes the full set of device properties for each event, making this the standard way to observe in real time what happens when a device is added or removed.

   Why the other options are wrong

   • Budevadm info --watch is wrong because udevadm info queries a device's current database/sysfs state on demand and has no --watch live-stream mode.
   • Cudevadm trigger --verbose --monitor is wrong because udevadm trigger re-emits stored events rather than streaming live ones, and it has no --monitor option.
   • Dudevadm settle --print-events is wrong because udevadm settle only waits for the event queue to empty and does not print an ongoing event stream.
7. Question 7Linux Installation and Package Management

   You ran 'alien --to-deb program.rpm' and noticed the resulting package's version is '1.5-2' even though the RPM was '1.5-1'. Why did the Debian package's revision number increase, and how do you prevent it?

   • AAlien increments the revision to mark it as converted; use --keep-version (-k) to retain the original versionCorrect
   • Balien always doubles the source revision number during conversion, and there is no supported option to prevent this behavior
   • Cdpkg increments the package revision at install time, so passing the dpkg --no-bump option is what suppresses the change
   • DThe source RPM was corrupt, which inflated the revision, so reconverting it with the --fix-version flag corrects the number
   ✓ Correct answer: A

   By default alien adds one to the package's release/revision number so the converted package is distinguishable from an official one and is treated as newer. Passing --keep-version (-k) tells alien to leave the version exactly as it was in the source package. This is the documented behavior and the documented way to override it.

   Why the other options are wrong

   • Balien increments the revision by one rather than doubling it, and --keep-version prevents the change entirely.
   • Cdpkg does not change package versions at install time, and --no-bump is not a real dpkg option.
   • DThe version bump is normal alien behavior rather than a sign of corruption, and --fix-version is not an alien option.
8. Question 8GNU and Unix Commands

   You want grep to count how many lines in maillog contain the case-insensitive word 'failed', regardless of capitalization. Which command returns the count?

   • Agrep -ci 'failed' maillogCorrect
   • Bgrep -ni 'failed' maillog
   • Cgrep -oi 'failed' maillog | wc
   • Dgrep -c -v 'failed' maillog
   ✓ Correct answer: A

   The -c option makes grep print only the number of matching lines, and -i makes the match case-insensitive so 'failed', 'Failed', and 'FAILED' all count. Combining them as -ci yields a single integer count of all lines containing the word in any letter case. This is the concise idiom for tallying matching lines without listing them.

   Why the other options are wrong

   • Bgrep -ni 'failed' maillog is incorrect because -n prefixes each matching line with its line number and prints the lines; it does not produce a count.
   • Cgrep -oi 'failed' maillog | wc is incorrect because -o prints each match on its own line counting multiple matches per line, and bare 'wc' prints lines, words, and bytes rather than a clean line count; this changes the semantics from counting matching lines.
   • Dgrep -c -v 'failed' maillog is incorrect because -v inverts the match, so it counts the lines that do NOT contain 'failed', the opposite of what is requested.
9. Question 9Devices, Linux Filesystems, FHS

   You need to locate every file under /usr/share larger than 10 megabytes AND then run 'ls -lh' on each match to view their sizes. Which find command does this efficiently?

   • Afind /usr/share -size +10M -exec ls -lh {} \;Correct
   • Bfind /usr/share -size +10MB | ls -lh
   • Cfind /usr/share -size 10M -ls -lh
   • Dfind /usr/share -bigger 10M -do ls -lh
   ✓ Correct answer: A

   The -size +10M test matches files strictly larger than 10 mebibytes (the suffix M means 1048576-byte units in GNU find), and the -exec action runs the given command for each match, substituting the matched path for {} and terminating the command with the escaped semicolon \;. This is the standard way to act on find results directly.

   Why the other options are wrong

   • Bfind /usr/share -size +10MB | ls -lh is wrong because MB is not a valid size suffix and piping filenames into ls does not pass them as arguments; ls would just read its own stdin and ignore them.
   • Cfind /usr/share -size 10M -ls -lh is wrong because -size 10M means exactly 10M rather than larger, and the -ls action takes no -lh option.
   • Dfind /usr/share -bigger 10M -do ls -lh is wrong because find has no -bigger test and no -do action; the size predicate is -size and the action is -exec.
10. Question 10Shells and Shell Scripting

    A SQL table customers has columns id, name, and city. You must delete only the rows for customers located in the city 'Reno'. Which statement performs exactly that?

    • ADELETE FROM customers WHERE city = 'Reno';Correct
    • BDELETE customers WHERE city = 'Reno';
    • CDELETE FROM customers;
    • DREMOVE FROM customers WHERE city = 'Reno';
    ✓ Correct answer: A

    The standard SQL deletion syntax is DELETE FROM table WHERE condition; the WHERE clause restricts removal to rows where city equals 'Reno'. The string literal is enclosed in single quotes, and FROM is required after DELETE. Omitting the WHERE clause would delete every row in the table.

    Why the other options are wrong

    • BDELETE customers WHERE city = 'Reno'; is incorrect because the FROM keyword is required between DELETE and the table name in standard SQL.
    • CDELETE FROM customers; is incorrect because without a WHERE clause it removes all rows from the table, not just the Reno customers.
    • DREMOVE FROM customers WHERE city = 'Reno'; is incorrect because REMOVE is not an SQL keyword; row deletion uses DELETE.

Related Linux resources

• LPIC-1 study guideKey concepts
• Linux practice examsAll Linux
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Red Hat Certified System Administrator (RHCSA, EX200-style) practice examRelated
• LPIC-2 practice examRelated
• Linux Foundation Certified System Administrator (LFCS) practice examRelated

LPIC-1 practice exam FAQ