LPI 102-500 Practice Test 37
Question 360
A helpdesk escalation describes this Linux behavior: Large authentication logs fill the filesystem despite a logrotate config because the rotation schedule and size policy were never tested. Which TWO complementary steps provide the best corrective action and its most direct diagnostic verification? Select TWO answers.
- Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely.
- Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule.
- Review approved ntpd or chrony configuration, reload the correct service and inspect peer association and reachability with ntpq or chronyc as applicable.
- Inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias.
- Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives.
Explanation
Correct Answers
A:Recommended administrative action: Use suitable logrotate frequency, size, retention and postrotate or copytruncate strategy based on service behavior and test the rotation safely. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
E:Most direct verification evidence: Run `logrotate -d` or a controlled forced rotation, inspect the daemon's file handles, timestamps and retained compressed archives. Linux principle: Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Incorrect Answers
B:This shortcut is unsafe for the present Linux issue: Assume changing a log filename automatically redirects every process's open descriptor and that logrotate compresses logs even with no active rule. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
C:That option would review approved ntpd or chrony configuration, reload the correct service and inspect peer association and reachability with ntpq or chronyc as applicable, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
D:That option would inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias, but it addresses a different concern. Renaming a logfile does not force a running process to reopen its file descriptor; retention depends on configured rotation and cleanup actions.
Question 361
An operations handoff identifies this problem: A host's persistent journal consumes too much disk space and staff deletes arbitrary active journal files while journald is writing. Which administrative step is the MOST appropriate way to resolve this issue? Select ONE best answer.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
- Configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions.
- Inspect pending mail via mailq or a supported MTA queue command, identify the deferred-delivery reason and repair transport before replaying messages.
- Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals.
Explanation
Correct Answer
D:Recommended administrative action: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals.
Incorrect Answers
A:This shortcut is unsafe for the present Linux issue: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. It cannot establish a safe correction. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
B:That option would configure persistent journald storage where appropriate and verify /var/log/journal and journald.conf settings while respecting retention and permissions, but it addresses a different concern. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
C:That option would inspect pending mail via mailq or a supported MTA queue command, identify the deferred-delivery reason and repair transport before replaying messages, but it addresses a different concern. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Question 362
A team maintaining a Linux host reports: A host's persistent journal consumes too much disk space and staff deletes arbitrary active journal files while journald is writing. Which Linux behavior or technical principle BEST explains why the issue occurs? Select ONE best answer.
- The systemd journal records structured metadata such as unit, boot identifier, severity and timestamps that support targeted evidence retrieval.
- A running chrony daemon does not by itself guarantee synchronization; the system needs reachable selected sources and a converging offset and frequency state.
- Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
Explanation
Correct Answer
C:Relevant Linux operating principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Incorrect Answers
A:This alternative addresses Journalctl unit, priority and time filtering, not the specific issue of Journal vacuuming and offline rescue analysis: The systemd journal records structured metadata such as unit, boot identifier, severity and timestamps that support targeted evidence retrieval. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
B:This alternative addresses Chrony synchronization and source state, not the specific issue of Journal vacuuming and offline rescue analysis: A running chrony daemon does not by itself guarantee synchronization; the system needs reachable selected sources and a converging offset and frequency state. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
D:This shortcut is unsafe for the present Linux issue: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Question 363
While verifying a Linux change request, an engineer finds: A host's persistent journal consumes too much disk space and staff deletes arbitrary active journal files while journald is writing. Which evidence or command result MOST directly tests the suspected root cause? Select ONE best answer.
- Compare `timedatectl status`, `hwclock --show` and `date -u`, and inspect whether NTP synchronization and local-RTC policies align.
- Inspect `chronyc tracking`, `chronyc sources -v`, configured servers or pools, network reachability and timedatectl synchronization status.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
- Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries.
Explanation
Correct Answer
D:Most direct verification evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries.
Incorrect Answers
A:That option would compare `timedatectl status`, `hwclock --show` and `date -u`, and inspect whether NTP synchronization and local-RTC policies align, but it addresses a different concern. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
B:That option would inspect `chronyc tracking`, `chronyc sources -v`, configured servers or pools, network reachability and timedatectl synchronization status, but it addresses a different concern. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
C:This shortcut is unsafe for the present Linux issue: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. It cannot establish a safe correction.
Question 364
A Linux administrator investigates the following system incident: A host's persistent journal consumes too much disk space and staff deletes arbitrary active journal files while journald is writing. Which observed outcome BEST confirms a successful and properly scoped correction? Select ONE best answer.
- The active mail agent is correctly identified and basic address handling is validated without editing a different product's configuration.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
- Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
- The host tracks an approved source with acceptable measured offset and remains time-synchronized under representative network conditions.
Explanation
Correct Answer
C:Observable acceptance criterion: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
Incorrect Answers
A:This alternative addresses MTA implementation recognition and basic client scope, not the specific issue of Journal vacuuming and offline rescue analysis: The active mail agent is correctly identified and basic address handling is validated without editing a different product's configuration. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
B:This shortcut is unsafe for the present Linux issue: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. It cannot establish a safe correction. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
D:This alternative addresses Chrony synchronization and source state, not the specific issue of Journal vacuuming and offline rescue analysis: The host tracks an approved source with acceptable measured offset and remains time-synchronized under representative network conditions. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
Question 365
On a production Linux workstation or server, a technician observes: A host's persistent journal consumes too much disk space and staff deletes arbitrary active journal files while journald is writing. Which misleading assumption MOST directly contributes to this failure and should be rejected? Select ONE best answer.
- Delete the original PDF as a substitute for canceling a queued print job and indiscriminately purge all printers for one stalled queue.
- Conclude every error ever printed by journalctl happened in the current boot and avoid unit or timestamp constraints during troubleshooting.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
- Assume starting chronyd guarantees accurate time even when all configured NTP peers are unreachable or unselected.
Explanation
Correct Answer
C:Reject this specific misconception: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. It incorrectly assumes behavior that conflicts with the observed Linux conditions.
Incorrect Answers
A:This alternative addresses CUPS queue inspection and selective cancellation, not the specific issue of Journal vacuuming and offline rescue analysis: Delete the original PDF as a substitute for canceling a queued print job and indiscriminately purge all printers for one stalled queue. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
B:This alternative addresses Journalctl unit, priority and time filtering, not the specific issue of Journal vacuuming and offline rescue analysis: Conclude every error ever printed by journalctl happened in the current boot and avoid unit or timestamp constraints during troubleshooting. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
D:That option would assume starting chronyd guarantees accurate time even when all configured NTP peers are unreachable or unselected, but it addresses a different concern. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Question 366
During an LPIC-1 practice lab, the operator encounters this condition: After recovering a failed root volume, operators assume `journalctl` can only read the live boot and cannot inspect copied journal files. Which administrative step is the MOST appropriate way to resolve this issue? Select ONE best answer.
- Configure reachable approved chrony sources and check tracking and source selection before declaring time synchronization healthy.
- Inspect pending mail via mailq or a supported MTA queue command, identify the deferred-delivery reason and repair transport before replaying messages.
- Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
Explanation
Correct Answer
C:Recommended administrative action: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Incorrect Answers
A:That option would configure reachable approved chrony sources and check tracking and source selection before declaring time synchronization healthy, but it addresses a different concern. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
B:This alternative addresses Mail queue inspection and resend decisions, not the specific issue of Journal vacuuming and offline rescue analysis: Inspect pending mail via mailq or a supported MTA queue command, identify the deferred-delivery reason and repair transport before replaying messages.
D:This shortcut is unsafe for the present Linux issue: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. It cannot establish a safe correction. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
Question 367
A helpdesk escalation describes this Linux behavior: After recovering a failed root volume, operators assume `journalctl` can only read the live boot and cannot inspect copied journal files. Which Linux behavior or technical principle BEST explains why the issue occurs? Select ONE best answer.
- Mail alias files map local recipient names to delivery targets, and some MTAs use a compiled alias database that must be rebuilt after changes.
- Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
- Rsyslog rules match syslog facilities and severities, and remote forwarding depends on correct action syntax and reachable transport.
Explanation
Correct Answer
B:Relevant Linux operating principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Incorrect Answers
A:This alternative addresses Mail aliases and newaliases database updates, not the specific issue of Journal vacuuming and offline rescue analysis: Mail alias files map local recipient names to delivery targets, and some MTAs use a compiled alias database that must be rebuilt after changes. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
C:This shortcut is unsafe for the present Linux issue: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
D:This alternative addresses Rsyslog facility priority and central forwarding, not the specific issue of Journal vacuuming and offline rescue analysis: Rsyslog rules match syslog facilities and severities, and remote forwarding depends on correct action syntax and reachable transport. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
Question 368
An operations handoff identifies this problem: After recovering a failed root volume, operators assume `journalctl` can only read the live boot and cannot inspect copied journal files. Which evidence or command result MOST directly tests the suspected root cause? Select ONE best answer.
- Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
- Inspect installed service packages, process or systemd state, sendmail-compatible binary ownership and a simple local mail delivery test.
- Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries.
Explanation
Correct Answer
D:Most direct verification evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Incorrect Answers
A:This alternative addresses Persistent systemd journal storage, not the specific issue of Journal vacuuming and offline rescue analysis: Inspect journald.conf, /var/log/journal ownership, `journalctl --list-boots` and archived messages after a controlled reboot.
B:This shortcut is unsafe for the present Linux issue: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. It cannot establish a safe correction. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
C:That option would inspect installed service packages, process or systemd state, sendmail-compatible binary ownership and a simple local mail delivery test, but it addresses a different concern. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Question 369
A team maintaining a Linux host reports: After recovering a failed root volume, operators assume `journalctl` can only read the live boot and cannot inspect copied journal files. Which observed outcome BEST confirms a successful and properly scoped correction? Select ONE best answer.
- Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
- Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
- The host tracks an approved source with acceptable measured offset and remains time-synchronized under representative network conditions.
Explanation
Correct Answer
A:Observable acceptance criterion: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Incorrect Answers
B:This alternative addresses Persistent systemd journal storage, not the specific issue of Journal vacuuming and offline rescue analysis: Required previous-boot records remain queryable with appropriate permissions without uncontrolled disk consumption.
C:This shortcut is unsafe for the present Linux issue: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
D:This alternative addresses Chrony synchronization and source state, not the specific issue of Journal vacuuming and offline rescue analysis: The host tracks an approved source with acceptable measured offset and remains time-synchronized under representative network conditions. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system. Appropriate response: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Root-cause evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Independent acceptance: Retained journal data stays readable within approved storage limits and recovered records can be analyzed from their copied location.
Question 370
While verifying a Linux change request, an engineer finds: After recovering a failed root volume, operators assume `journalctl` can only read the live boot and cannot inspect copied journal files. Which TWO complementary steps provide the best corrective action and its most direct diagnostic verification? Select TWO answers.
- Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals.
- Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries.
- Configure a facility-and-priority selector with the intended action and a supported remote target, then test message routing and transport.
- Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory.
- Inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias.
Explanation
Correct Answers
A:Recommended administrative action: Apply supported journal size or age retention and `journalctl --vacuum-*` controls; use `journalctl --directory` or `--file` to inspect saved journals. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
B:Most direct verification evidence: Compare current journal disk usage, archived files and results of journalctl --disk-usage, vacuum and offline directory queries. Linux principle: Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
Incorrect Answers
C:That option would configure a facility-and-priority selector with the intended action and a supported remote target, then test message routing and transport, but it addresses a different concern. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
D:This shortcut is unsafe for the present Linux issue: Delete random active binary journal files to reclaim space and insist journalctl cannot read a rescued /var/log/journal directory. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.
E:That option would inspect /etc/aliases, run newaliases with permission, review MTA logs and send a controlled message to the alias, but it addresses a different concern. Journald has supported retention and vacuum mechanisms, and journalctl can read archived journal stores outside the running system.