LPI 102-500 Practice Test 36
Question 350
A Linux administrator investigates the following system incident: A central syslog collector receives no messages after a firewall change although the sender still logs locally. Which TWO complementary steps provide the best corrective action and its most direct diagnostic verification? Select TWO answers.
- Review queue IDs, delivery attempts, logs, DNS or transport errors and results after a controlled retry.
- Assume every facility label means the same thing and that writing a remote hostname in rsyslog.conf guarantees delivery despite transport failures.
- Configure a facility-and-priority selector with the intended action and a supported remote target, then test message routing and transport.
- Identify the installed mail transport agent and use its supported aliases, forward and submission interface while limiting work to the basic client objectives.
- Inspect /etc/rsyslog.conf rules, generated `logger` messages, receiver logs and network or TLS transport state.
Explanation
Correct Answers
C:Recommended administrative action: Configure a facility-and-priority selector with the intended action and a supported remote target, then test message routing and transport. Linux principle: Rsyslog rules match syslog facilities and severities, and remote forwarding depends on correct action syntax and reachable transport.
E:Most direct verification evidence: Inspect /etc/rsyslog.conf rules, generated `logger` messages, receiver logs and network or TLS transport state. Linux principle: Rsyslog rules match syslog facilities and severities, and remote forwarding depends on correct action syntax and reachable transport.
Incorrect Answers
A:That option would review queue IDs, delivery attempts, logs, DNS or transport errors and results after a controlled retry, but it addresses a different concern. Rsyslog rules match syslog facilities and severities, and remote forwarding depends on correct action syntax and reachable transport.
B:This shortcut is unsafe for the present Linux issue: Assume every facility label means the same thing and that writing a remote hostname in rsyslog.conf guarantees delivery despite transport failures. Rsyslog rules match syslog facilities and severities, and remote forwarding depends on correct action syntax and reachable transport.
D:This alternative addresses MTA implementation recognition and basic client scope, not the specific issue of Rsyslog facility priority and central forwarding: Identify the installed mail transport agent and use its supported aliases, forward and submission interface while limiting work to the basic client objectives. Linux principle: Rsyslog rules match syslog facilities and severities, and remote forwarding depends on correct action syntax and reachable transport.
Question 351
On a production Linux workstation or server, a technician observes: An application keeps writing to an old unlinked logfile after rotation because it holds an open file descriptor and no supported reopen step runs. Which administrative step is the MOST appropriate way to resolve this issue? Select ONE best answer.
- Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely.
- Identify the installed mail transport agent and use its supported aliases, forward and submission interface while limiting work to the basic client objectives.
- Use CUPS or the LPD-compatible `lpq` and `lprm` or `cancel` commands to identify and remove only the failed job from the correct queue.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
Explanation
Correct Answer
A:Recommended administrative action: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Incorrect Answers
B:That option would identify the installed mail transport agent and use its supported aliases, forward and submission interface while limiting work to the basic client objectives, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
C:That option would use CUPS or the LPD-compatible `lpq` and `lprm` or `cancel` commands to identify and remove only the failed job from the correct queue, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
D:That option would assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Question 352
During an LPIC-1 practice lab, the operator encounters this condition: An application keeps writing to an old unlinked logfile after rotation because it holds an open file descriptor and no supported reopen step runs. Which Linux behavior or technical principle BEST explains why the issue occurs? Select ONE best answer.
- Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
- NTP requires an active synchronized peer association and correct daemon configuration; DNS resolution of a pool name alone is insufficient.
- Submitting a message to an MTA queue is not proof of final recipient delivery; queue status and remote response determine disposition.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
Explanation
Correct Answer
A:Relevant Linux operating principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Incorrect Answers
B:This alternative addresses Traditional NTP configuration and peer observation, not the specific issue of Logrotate retention, compression and daemon reopen: NTP requires an active synchronized peer association and correct daemon configuration; DNS resolution of a pool name alone is insufficient. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions. Appropriate response: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Root-cause evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
C:This alternative addresses Mail queue inspection and resend decisions, not the specific issue of Logrotate retention, compression and daemon reopen: Submitting a message to an MTA queue is not proof of final recipient delivery; queue status and remote response determine disposition. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions. Appropriate response: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Root-cause evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
D:That option would assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule, but it addresses a different concern. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
Question 353
A helpdesk escalation describes this Linux behavior: An application keeps writing to an old unlinked logfile after rotation because it holds an open file descriptor and no supported reopen step runs. Which evidence or command result MOST directly tests the suspected root cause? Select ONE best answer.
- Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
- Review queue IDs, delivery attempts, logs, DNS or transport errors and results after a controlled retry.
- Inspect `journalctl -u name.service --since ...`, `-p` selections, boot switches and the original message fields.
Explanation
Correct Answer
A:Most direct verification evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Incorrect Answers
B:This shortcut is unsafe for the present Linux issue: Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
C:That option would review queue IDs, delivery attempts, logs, DNS or transport errors and results after a controlled retry, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
D:That option would inspect `journalctl -u name.service --since .`, `-p` selections, boot switches and the original message fields, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Question 354
An operations handoff identifies this problem: An application keeps writing to an old unlinked logfile after rotation because it holds an open file descriptor and no supported reopen step runs. Which observed outcome BEST confirms a successful and properly scoped correction? Select ONE best answer.
- Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
- New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
- An approved peer is selected and local clock metrics converge within documented tolerances after configuration reload.
Explanation
Correct Answer
B:Observable acceptance criterion: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Incorrect Answers
A:This alternative addresses Persistent systemd journal storage, not the specific issue of Logrotate retention, compression and daemon reopen: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
C:This shortcut is unsafe for the present Linux issue: Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
D:This alternative addresses Traditional NTP configuration and peer observation, not the specific issue of Logrotate retention, compression and daemon reopen: An approved peer is selected and local clock metrics converge within documented tolerances after configuration reload. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions. Appropriate response: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Root-cause evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
Question 355
A team maintaining a Linux host reports: An application keeps writing to an old unlinked logfile after rotation because it holds an open file descriptor and no supported reopen step runs. Which misleading assumption MOST directly contributes to this failure and should be rejected? Select ONE best answer.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
- Assume the command named sendmail proves the Sendmail daemon is installed and that Postfix and Exim share interchangeable configuration files.
- Conclude every error ever printed by journalctl happened in the current boot and avoid unit or timestamp constraints during troubleshooting.
- Assume starting chronyd guarantees accurate time even when all configured NTP peers are unreachable or unselected.
Explanation
Correct Answer
A:Reject this specific misconception: Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule. It incorrectly assumes behavior that conflicts with the observed Linux conditions.
Incorrect Answers
B:That option would assume the command named sendmail proves the Sendmail daemon is installed and that Postfix and Exim share interchangeable configuration files, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
C:This alternative addresses Journalctl unit, priority and time filtering, not the specific issue of Logrotate retention, compression and daemon reopen: Conclude every error ever printed by journalctl happened in the current boot and avoid unit or timestamp constraints during troubleshooting. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions. Appropriate response: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Root-cause evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
D:That option would assume starting chronyd guarantees accurate time even when all configured NTP peers are unreachable or unselected, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Question 356
While verifying a Linux change request, an engineer finds: Large authentication logs fill the filesystem despite a logrotate config because the rotation schedule and size policy were never tested. Which administrative step is the MOST appropriate way to resolve this issue? Select ONE best answer.
- Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely.
- Edit approved local alias mappings and run newaliases as required by the installed MTA, then test delivery and the local queue.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
- Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions.
Explanation
Correct Answer
A:Recommended administrative action: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely.
Incorrect Answers
B:This alternative addresses Mail aliases and newaliases database updates, not the specific issue of Logrotate retention, compression and daemon reopen: Edit approved local alias mappings and run newaliases as required by the installed MTA, then test delivery and the local queue. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions. Appropriate response: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Root-cause evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
C:This shortcut is unsafe for the present Linux issue: Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
D:That option would configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Question 357
A Linux administrator investigates the following system incident: Large authentication logs fill the filesystem despite a logrotate config because the rotation schedule and size policy were never tested. Which Linux behavior or technical principle BEST explains why the issue occurs? Select ONE best answer.
- Printing systems maintain spooled job identities separately from source documents; deleting the original file does not reliably cancel a submitted print job.
- The systemd journal records structured metadata such as unit, boot identifier, severity and timestamps that support targeted evidence retrieval.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
- Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Explanation
Correct Answer
D:Relevant Linux operating principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Incorrect Answers
A:This alternative addresses CUPS queue inspection and selective cancellation, not the specific issue of Logrotate retention, compression and daemon reopen: Printing systems maintain spooled job identities separately from source documents; deleting the original file does not reliably cancel a submitted print job. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions. Appropriate response: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Root-cause evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
B:This alternative addresses Journalctl unit, priority and time filtering, not the specific issue of Logrotate retention, compression and daemon reopen: The systemd journal records structured metadata such as unit, boot identifier, severity and timestamps that support targeted evidence retrieval. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions. Appropriate response: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Root-cause evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
C:This shortcut is unsafe for the present Linux issue: Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule. It cannot establish a safe correction. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Question 358
On a production Linux workstation or server, a technician observes: Large authentication logs fill the filesystem despite a logrotate config because the rotation schedule and size policy were never tested. Which evidence or command result MOST directly tests the suspected root cause? Select ONE best answer.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
- Inspect `chronyc tracking`, `chronyc sources -v`, configured servers or pools, network reachability and timedatectl synchronization status.
- Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives.
- Inspect CUPS printer state, queue name and job ID, view lpq or lpstat output, and confirm the target job disappears after cancellation.
Explanation
Correct Answer
C:Most direct verification evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives.
Incorrect Answers
A:This shortcut is unsafe for the present Linux issue: Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule. It cannot establish a safe correction. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions. Appropriate response: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Root-cause evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
B:That option would inspect `chronyc tracking`, `chronyc sources -v`, configured servers or pools, network reachability and timedatectl synchronization status, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
D:That option would inspect CUPS printer state, queue name and job ID, view lpq or lpstat output, and confirm the target job disappears after cancellation, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Question 359
During an LPIC-1 practice lab, the operator encounters this condition: Large authentication logs fill the filesystem despite a logrotate config because the rotation schedule and size policy were never tested. Which observed outcome BEST confirms a successful and properly scoped correction? Select ONE best answer.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
- New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
- The backlog drains for the intended destinations and repeat sends are not introduced merely to mask a routing failure.
- Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
Explanation
Correct Answer
B:Observable acceptance criterion: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
Incorrect Answers
A:This shortcut is unsafe for the present Linux issue: Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
C:This alternative addresses Mail queue inspection and resend decisions, not the specific issue of Logrotate retention, compression and daemon reopen: The backlog drains for the intended destinations and repeat sends are not introduced merely to mask a routing failure. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions. Appropriate response: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Root-cause evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Independent acceptance: New entries flow to the active logfile after rotation and archived logs meet retention and space limits without losing needed audit evidence.
D:This alternative addresses Persistent systemd journal storage, not the specific issue of Logrotate retention, compression and daemon reopen: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
Question 360
A helpdesk escalation describes this Linux behavior: Large authentication logs fill the filesystem despite a logrotate config because the rotation schedule and size policy were never tested. Which TWO complementary steps provide the best corrective action and its most direct diagnostic verification? Select TWO answers.
- Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
- Review approved ntpd or chrony configuration, reload the correct service and inspect peer association and reachability with ntpq or chronyc as applicable.
- Inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias.
- Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives.
Explanation
Correct Answers
A:Recommended administrative action: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
E:Most direct verification evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Incorrect Answers
B:This shortcut is unsafe for the present Linux issue: Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
C:That option would review approved ntpd or chrony configuration, reload the correct service and inspect peer association and reachability with ntpq or chronyc as applicable, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
D:That option would inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
