LPI 102-500 Practice Test 33
Question 320
A team maintaining a Linux host reports: A team judges a system synchronized because a hostname resolves even though no NTP peer is selected and packet exchange fails. Which TWO complementary steps provide the best corrective action and its most direct diagnostic verification? Select TWO answers.
- Review approved ntpd or chrony configuration, reload the correct service and inspect peer association and reachability with ntpq or chronyc as applicable.
- Inspect /etc/ntp.conf or /etc/chrony.conf, verify service state, view ntpq -p or chronyc sources and check UDP connectivity.
- Inspect `journalctl -u name.service --since ...`, `-p` selections, boot switches and the original message fields.
- Configure a supported per-user ~/.forward destination and validate permissions and loop prevention, or select an approved server-side forwarding mechanism.
- Assume pinging pool.ntp.org proves a running server's clock is synchronized and that editing a file automatically reloads the time daemon.
Explanation
Correct Answers
A:Recommended administrative action: Review approved ntpd or chrony configuration, reload the correct service and inspect peer association and reachability with ntpq or chronyc as applicable. Linux principle: NTP requires an active synchronized peer association and correct daemon configuration; DNS resolution of a pool name alone is insufficient.
B:Most direct verification evidence: Inspect /etc/ntp.conf or /etc/chrony.conf, verify service state, view ntpq -p or chronyc sources and check UDP connectivity. Linux principle: NTP requires an active synchronized peer association and correct daemon configuration; DNS resolution of a pool name alone is insufficient.
Incorrect Answers
C:That option would inspect `journalctl -u name.service --since .`, `-p` selections, boot switches and the original message fields, but it addresses a different concern. NTP requires an active synchronized peer association and correct daemon configuration; DNS resolution of a pool name alone is insufficient.
D:That option would configure a supported per-user ~/.forward destination and validate permissions and loop prevention, or select an approved server-side forwarding mechanism, but it addresses a different concern. NTP requires an active synchronized peer association and correct daemon configuration; DNS resolution of a pool name alone is insufficient.
E:This shortcut is unsafe for the present Linux issue: Assume pinging pool.ntp.org proves a running server's clock is synchronized and that editing a file automatically reloads the time daemon. NTP requires an active synchronized peer association and correct daemon configuration; DNS resolution of a pool name alone is insufficient.
Question 321
While verifying a Linux change request, an engineer finds: After a reboot an investigator cannot read pre-reboot journal records because journald was using volatile storage and no persistent journal directory existed. Which administrative step is the MOST appropriate way to resolve this issue? Select ONE best answer.
- Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely.
- Configure a supported per-user ~/.forward destination and validate permissions and loop prevention, or select an approved server-side forwarding mechanism.
- Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
Explanation
Correct Answer
C:Recommended administrative action: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions.
Incorrect Answers
A:That option would use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
B:That option would configure a supported per-user ~/.forward destination and validate permissions and loop prevention, or select an approved server-side forwarding mechanism, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
D:That option would assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
Question 322
A Linux administrator investigates the following system incident: After a reboot an investigator cannot read pre-reboot journal records because journald was using volatile storage and no persistent journal directory existed. Which Linux behavior or technical principle BEST explains why the issue occurs? Select ONE best answer.
- NTP requires an active synchronized peer association and correct daemon configuration; DNS resolution of a pool name alone is insufficient.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
- Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
- The systemd journal records structured metadata such as unit, boot identifier, severity and timestamps that support targeted evidence retrieval.
Explanation
Correct Answer
C:Relevant Linux operating principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
Incorrect Answers
A:This alternative addresses Traditional NTP configuration and peer observation, not the specific issue of Persistent systemd journal storage: NTP requires an active synchronized peer association and correct daemon configuration; DNS resolution of a pool name alone is insufficient. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Root-cause evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Independent acceptance: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
B:That option would assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events, but it addresses a different concern. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions.
D:This alternative addresses Journalctl unit, priority and time filtering, not the specific issue of Persistent systemd journal storage: The systemd journal records structured metadata such as unit, boot identifier, severity and timestamps that support targeted evidence retrieval. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Root-cause evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Independent acceptance: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
Question 323
On a production Linux workstation or server, a technician observes: After a reboot an investigator cannot read pre-reboot journal records because journald was using volatile storage and no persistent journal directory existed. Which evidence or command result MOST directly tests the suspected root cause? Select ONE best answer.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
- Inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias.
- Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot.
- Inspect CUPS printer state, queue name and job ID, view lpq or lpstat output, and confirm the target job disappears after cancellation.
Explanation
Correct Answer
C:Most direct verification evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot.
Incorrect Answers
A:This shortcut is unsafe for the present Linux issue: Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events. It cannot establish a safe correction.
B:That option would inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
D:That option would inspect CUPS printer state, queue name and job ID, view lpq or lpstat output, and confirm the target job disappears after cancellation, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
Question 324
During an LPIC-1 practice lab, the operator encounters this condition: After a reboot an investigator cannot read pre-reboot journal records because journald was using volatile storage and no persistent journal directory existed. Which observed outcome BEST confirms a successful and properly scoped correction? Select ONE best answer.
- The host tracks an approved source with acceptable measured offset and remains time-synchronized under representative network conditions.
- Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
- An approved peer is selected and local clock metrics converge within documented tolerances after configuration reload.
Explanation
Correct Answer
B:Observable acceptance criterion: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
Incorrect Answers
A:This alternative addresses Chrony synchronization and source state, not the specific issue of Persistent systemd journal storage: The host tracks an approved source with acceptable measured offset and remains time-synchronized under representative network conditions.
C:This shortcut is unsafe for the present Linux issue: Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events. It cannot establish a safe correction.
D:This alternative addresses Traditional NTP configuration and peer observation, not the specific issue of Persistent systemd journal storage: An approved peer is selected and local clock metrics converge within documented tolerances after configuration reload.
Question 325
A helpdesk escalation describes this Linux behavior: After a reboot an investigator cannot read pre-reboot journal records because journald was using volatile storage and no persistent journal directory existed. Which misleading assumption MOST directly contributes to this failure and should be rejected? Select ONE best answer.
- Delete the original PDF as a substitute for canceling a queued print job and indiscriminately purge all printers for one stalled queue.
- Chain two ~/.forward files to one another and assume the MTA will always infer the intended final recipient without loops.
- Assume saving /etc/aliases updates every running MTA's alias map immediately and that no delivery test is necessary.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
Explanation
Correct Answer
D:Reject this specific misconception: Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events. It incorrectly assumes behavior that conflicts with the observed Linux conditions.
Incorrect Answers
A:This alternative addresses CUPS queue inspection and selective cancellation, not the specific issue of Persistent systemd journal storage: Delete the original PDF as a substitute for canceling a queued print job and indiscriminately purge all printers for one stalled queue. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Root-cause evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Independent acceptance: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
B:This alternative addresses User mail forwarding and delivery loops, not the specific issue of Persistent systemd journal storage: Chain two ~/.forward files to one another and assume the MTA will always infer the intended final recipient without loops. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Root-cause evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Independent acceptance: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
C:That option would assume saving /etc/aliases updates every running MTA's alias map immediately and that no delivery test is necessary, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
Question 326
An operations handoff identifies this problem: A service team requires logs across planned restarts, but tests only the current boot's journal and overlooks persistence settings. Which administrative step is the MOST appropriate way to resolve this issue? Select ONE best answer.
- Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals.
- Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
- Set appropriate system time with timedatectl, maintain UTC-based hardware RTC where supported, and keep the displayed timezone separate from clock synchronization.
Explanation
Correct Answer
B:Recommended administrative action: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions.
Incorrect Answers
A:That option would apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
C:This shortcut is unsafe for the present Linux issue: Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events. It cannot establish a safe correction.
D:That option would set appropriate system time with timedatectl, maintain UTC-based hardware RTC where supported, and keep the displayed timezone separate from clock synchronization, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
Question 327
A team maintaining a Linux host reports: A service team requires logs across planned restarts, but tests only the current boot's journal and overlooks persistence settings. Which Linux behavior or technical principle BEST explains why the issue occurs? Select ONE best answer.
- Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
- Postfix, Sendmail and Exim are distinct MTAs; compatible command names do not establish which daemon or configuration is active.
- Printing systems maintain spooled job identities separately from source documents; deleting the original file does not reliably cancel a submitted print job.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
Explanation
Correct Answer
A:Relevant Linux operating principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
Incorrect Answers
B:This alternative addresses MTA implementation recognition and basic client scope, not the specific issue of Persistent systemd journal storage: Postfix, Sendmail and Exim are distinct MTAs; compatible command names do not establish which daemon or configuration is active. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Root-cause evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Independent acceptance: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
C:This alternative addresses CUPS queue inspection and selective cancellation, not the specific issue of Persistent systemd journal storage: Printing systems maintain spooled job identities separately from source documents; deleting the original file does not reliably cancel a submitted print job. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Root-cause evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Independent acceptance: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
D:This shortcut is unsafe for the present Linux issue: Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events. It cannot establish a safe correction. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
Question 328
While verifying a Linux change request, an engineer finds: A service team requires logs across planned restarts, but tests only the current boot's journal and overlooks persistence settings. Which evidence or command result MOST directly tests the suspected root cause? Select ONE best answer.
- Compare `timedatectl status`, `hwclock --show` and `date -u`, and inspect whether NTP synchronization and local-RTC policies align.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
- Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot.
- Inspect ~/.forward ownership and content, trace headers and MTA delivery logs, and send a single controlled test message.
Explanation
Correct Answer
C:Most direct verification evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot.
Incorrect Answers
A:That option would compare `timedatectl status`, `hwclock --show` and `date -u`, and inspect whether NTP synchronization and local-RTC policies align, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
B:This shortcut is unsafe for the present Linux issue: Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events. It cannot establish a safe correction. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Root-cause evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Independent acceptance: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
D:That option would inspect ~/.forward ownership and content, trace headers and MTA delivery logs, and send a single controlled test message, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
Question 329
A Linux administrator investigates the following system incident: A service team requires logs across planned restarts, but tests only the current boot's journal and overlooks persistence settings. Which observed outcome BEST confirms a successful and properly scoped correction? Select ONE best answer.
- Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
- Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
- Clock values stay consistent over a controlled reboot and displayed local time matches the configured zone while UTC remains stable.
Explanation
Correct Answer
B:Observable acceptance criterion: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
Incorrect Answers
A:This alternative addresses Journal vacuuming and offline rescue analysis, not the specific issue of Persistent systemd journal storage: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Root-cause evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Independent acceptance: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
C:This shortcut is unsafe for the present Linux issue: Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
D:This alternative addresses System clock versus real-time clock and UTC policy, not the specific issue of Persistent systemd journal storage: Clock values stay consistent over a controlled reboot and displayed local time matches the configured zone while UTC remains stable. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention. Appropriate response: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Root-cause evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Independent acceptance: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
Question 330
On a production Linux workstation or server, a technician observes: A service team requires logs across planned restarts, but tests only the current boot's journal and overlooks persistence settings. Which TWO complementary steps provide the best corrective action and its most direct diagnostic verification? Select TWO answers.
- Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot.
- Inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias.
- Identify the installed mail transport agent and use its supported aliases, forward and submission interface while limiting work to the basic client objectives.
- Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions.
- Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events.
Explanation
Correct Answers
A:Most direct verification evidence: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
D:Recommended administrative action: Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions. Linux principle: Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
Incorrect Answers
B:This alternative addresses Mail aliases and newaliases database updates, not the specific issue of Persistent systemd journal storage: Inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias.
C:That option would identify the installed mail transport agent and use its supported aliases, forward and submission interface while limiting work to the basic client objectives, but it addresses a different concern. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.
E:This shortcut is unsafe for the present Linux issue: Assume journalctl always stores all boot history on disk and that an empty list of previous boots means no service ever logged events. Systemd-journald may use volatile or persistent storage depending on configuration and directory availability; querying only the current boot cannot prove retention.