Unit 5 - Practice Quiz

The touch command is a standard utility for creating empty files. If the file already exists, touch updates its access and modification timestamps to the current time.

nano is known for its simplicity and user-friendly interface, displaying key commands at the bottom of the screen, which makes it ideal for beginners. vim is more powerful but has a steeper learning curve.

The find command is a powerful and flexible utility that recursively searches a directory tree for files based on a wide range of criteria.

locate uses a database (typically updated daily by the updatedb command) to find files, which is much faster than find's method of searching the live filesystem.

The mkdir command, which stands for 'make directory', is the standard command used to create new directories in the filesystem.

The cp command is used to copy files and directories. mv is used to move or rename them.

grep (Global Regular Expression Print) is the primary tool for searching text content within files for lines matching a pattern or regular expression.

The tail command is used to output the last part of files. By default, it displays the last 10 lines, which is very useful for checking recent log entries.

The > symbol is the standard output redirection operator. It sends the output of the command on the left to the file on the right, replacing any existing content in the file.

The >> operator is the append output redirection operator. It adds the command's output to the end of the specified file, preserving any content that was already there.

The uname command provides system information. The -r flag specifically prints the kernel release version.

The /boot directory contains the files needed to start the system, including the bootloader configuration and the Linux kernel image (often named vmlinuz-...).

modprobe is the preferred command for managing kernel modules because it intelligently handles dependencies, loading any other required modules automatically. insmod is a lower-level tool that does not handle dependencies.

The rmmod command (or modprobe -r) is used to unload a currently loaded kernel module.

lsmod reads from /proc/modules and presents the information in a clean, readable format, showing the module name, size, and what other modules are using it.

The modinfo command is used to display various pieces of information about a kernel module, which is helpful for diagnostics and understanding its purpose.

The initial RAM filesystem (initramfs) is loaded into memory by the boot loader. Its main purpose is to contain the necessary kernel modules (e.g., for disk controllers) to allow the kernel to access and mount the actual root filesystem.

The init process is the ancestor of all user-space processes on a Linux system. In modern systems, this role is often filled by systemd, which is still referred to as the init system.

The /etc/default/grub file contains the main user-configurable settings. The /boot/grub/grub.cfg file is generated automatically and should not be edited directly.

The update-grub command (or grub2-mkconfig on some systems) reads the configuration from /etc/default/grub and other scripts to generate a new /boot/grub/grub.cfg file, making the changes effective on the next boot.

The command :%s/old/new/g is the standard way to perform a global search and replace in vim. The % specifies the range as the entire file, s stands for substitute, and the trailing g flag ensures all occurrences on each line are replaced, not just the first.

This is a classic use of piping commands. The first grep command filters the log for lines containing the IP address. Its output is then piped to a second grep command with the -v (invert match) option, which filters out any lines that contain the word POST.

The find command uses specific predicates: -name for filename patterns, -mtime -10 for files modified less than 10 days ago (i.e., within the last 10 days), and -size +50k for files greater than 50 kilobytes. The other options use incorrect syntax or commands.

A hard link is another name for the same inode. The file data is only removed when the inode's link count drops to zero. Deleting data.txt reduces the link count by one, but data_hardlink still points to the inode, preserving the data. A symbolic link is just a pointer to a filename; if that file is deleted, the link becomes broken.

In bash, file descriptor 1 represents stdout and 2 represents stderr. The redirection > file is shorthand for 1> file. Therefore, > backup.log redirects stdout, and 2> errors.log redirects stderr to their respective files.

The GRUB_TIMEOUT variable in /etc/default/grub sets the time in seconds the menu is displayed. The GRUB_DEFAULT variable sets the default entry. The menu entries are zero-indexed, so the second entry is index 1.

On modern Linux systems, the standard way to persistently load kernel modules at boot is to add their names to a .conf file within the /etc/modules-load.d/ directory. The systemd-modules-load service reads these files during the boot process.

modinfo is the specific tool designed to display detailed information about a kernel module. It reads the module file and extracts metadata like author, description, license, parameters (parm), and dependencies.

The /proc filesystem provides a window into the running kernel. The /proc/cmdline pseudo-file specifically holds the command-line string passed to the kernel at boot time, which is useful for debugging boot issues and verifying parameters.

The /etc/default/grub file is a configuration source file. To apply changes made there, you must run a command to regenerate the actual GRUB configuration file (grub.cfg). The grub2-mkconfig (or update-grub on Debian-based systems) command reads /etc/default/grub and other scripts to build the final bootloader configuration.

This command correctly uses awk. -F: sets the field separator to a colon. The pattern 1, 1 is the first field (username) and $7 is the seventh field (shell).

The correct flags for tar are: c to create, j to use bzip2 compression, v for verbose output, and f to specify the filename. The --exclude option is used to omit files or directories that match a given pattern.

The grep command with the -R (or -r) option performs a recursive search. The -l (list filenames) option is key here; instead of printing the matching lines, it prints only the names of the files that contain the matching string, which is exactly what the question asks for.

The sed command with the -i flag performs an in-place edit, modifying the file directly. The expression 's/^LogLevel debug/#LogLevel debug/' searches for lines that begin (^) with LogLevel debug and replaces them with the same line preceded by a # comment character.

tee reads from standard input and writes to both standard output and one or more files. In this pipeline, it receives the output of ps aux, writes a copy of that output to process_list.txt, and also passes the same output along to the standard input of the grep command.

In the GRUB2 boot menu, pressing the 'e' key allows you to edit the boot commands for the selected menu entry for the current boot only. This is the standard way to temporarily add or modify kernel parameters like init=/bin/bash for recovery purposes.

The kernel itself cannot contain every possible driver. The initramfs is a temporary root filesystem loaded into memory. Its main job is to provide the necessary drivers (e.g., for SATA, NVMe, LVM, or RAID) that allow the kernel to access and mount the real root filesystem, after which the initramfs is discarded.

The main reason to prefer modprobe is its intelligence. It understands module dependencies based on the modules.dep database. If you try to load a module that requires another module to be loaded first, modprobe will handle loading the dependencies automatically. insmod is a lower-level tool that requires you to load all dependencies manually in the correct order.

The output of lsmod has three columns: Module, Size, and Used by. The third column shows two pieces of information: the use count (how many things are currently using this module) and the names of other modules that depend on it. In this case, the 2 means vboxguest has a use count of 2, and one of its users is the vboxsf module.

The grub2-mkconfig command (often aliased as update-grub) runs scripts in /etc/grub.d/ that are designed to automatically detect installed kernels (by looking for vmlinuz-* files in /boot) and generate a corresponding menuentry in the grub.cfg file. This is the standard procedure after installing a new kernel.

This command uses sed -i for in-place editing. The key is the use of two separate expressions (-e), which are processed in order for each line. The first expression /DEPRECATED/d deletes any line containing "DEPRECATED". The second expression /^Listen/s/80/8080/ acts only on the lines that were not deleted, performing the substitution. Reversing the order is incorrect as it might modify a line that is subsequently deleted. Using the g flag would incorrectly change all instances of "80", not just the first. Piping output back to the original file with > will truncate the file before cat can read it, resulting in data loss.

This option is the most efficient. find first filters files based on metadata (type, size, mtime), which is very fast. Then, -exec ... {} + gathers all matching filenames and passes them as a single argument list to one grep command (or as few as possible if the list is very long). This minimizes process creation overhead. The xargs versions are similar but less tightly integrated, and the print0/xargs -0 version, while robust against special filenames, is slightly less direct than the -exec ... + POSIX standard. The grep first option is extremely inefficient because it reads the content of every single file before checking metadata.

This pipeline correctly performs the required aggregation and filtering.

1. awk '1}': Filters for lines where the 9th field is "404" and prints the 1st field (IP address). This is more precise than grep.
2. sort: Sorts the IP addresses so uniq can count them.
3. uniq -c: Counts consecutive identical lines.
4. sort -rn: Sorts the results numerically (-n) and in reverse (-r) order to get the highest counts first.
5. head -n 5: Displays only the top 5 lines.
   The pure awk solution is also correct and often more efficient, but this demonstrates the classic pipeline.

This command uses process substitution (>(...)) to solve a complex redirection problem.

• > >(tee -a out.log): stdout is redirected to a tee process. tee appends the output to out.log and also prints it to its own stdout (which is the terminal).
• 2> >(tee -a err.log >&2): stderr is redirected to another tee process. This tee appends to err.log and also prints to its stdout. We then redirect the stdout of this tee process back to the script's original stderr (>&2), ensuring error messages appear on the terminal's stderr stream as intended.

The /sys filesystem is the direct interface to kernel drivers and subsystems. Device parameters are exposed as files within /sys. The I/O scheduler for a block device is controlled by writing the name of the desired scheduler to /sys/block/<device>/queue/scheduler. This change is immediate and non-persistent. sysctl is used for parameters under /proc/sys, not for device-specific parameters in /sys/block. tuned-adm is a higher-level profile management tool. A udev rule would make the change persistent and is not for a temporary, immediate modification.

The vermagic string embedded in a kernel module must exactly match that of the running kernel. This string includes the kernel version, compiler version, and configuration flags. An error about module_layout or vermagic is a classic sign of a mismatch, which occurs when a module is compiled for one kernel (e.g., 5.4.0-100) but loaded on another (e.g., 5.4.0-101). The only solution is to recompile the module in an environment with the correct kernel headers for the target system, typically found at /lib/modules/$(uname -r)/build.

The install <module> <command> directive is the most powerful blacklisting method. It overrides the default loading behavior for <module>. When any part of the system requests faulty_driver, modprobe will execute /bin/true instead of loading the actual module. Since /bin/true does nothing and exits successfully, the calling program is satisfied, but the problematic module is never actually loaded. The blacklist directive is softer and can be overridden if another module explicitly depends on faulty_driver.

The dracut emergency shell is a recovery environment within the initramfs itself. It is designed to allow manual intervention. The standard procedure is to identify the correct device for the root filesystem (e.g., by checking ls /dev/sd*), then mount it on the expected mount point /sysroot. After mounting, exiting the shell will cause the dracut scripts to resume, and they will now find the root filesystem at /sysroot and proceed with the boot. This allows the system to boot fully, after which the administrator can make permanent fixes to /etc/fstab and GRUB.

The file /etc/default/grub is the central configuration file for GRUB2 variables. The GRUB_CMDLINE_LINUX variable specifies parameters that are added to all Linux menu entries (both normal and recovery). After modifying this file, you must run the GRUB configuration generator (grub2-mkconfig on RHEL-based systems, or the update-grub wrapper on Debian-based systems) to apply the changes to the actual bootloader configuration file (/boot/grub/grub.cfg). Manually editing grub.cfg is wrong because it will be overwritten.

The --link-dest option is specifically designed for this purpose, forming the basis of tools like rsnapshot. It tells rsync to look in the specified directory (/mnt/backup/2023-10-26) for files that also exist in the source (/home/user/). If an identical file is found, rsync creates a hard link in the destination pointing to the file in the --link-dest directory instead of re-transmitting and re-writing the data. This is extremely efficient for both storage space and network bandwidth. The -H option preserves existing hard links from the source.

This is a complex find task. This solution correctly identifies all symlinks (-type l). For each one, it executes a bash subshell. Inside the shell, readlink -m "target != /usr/local/* ]] test then checks if the resulting absolute path does not start with /usr/local/. If this condition is true, it prints the original link's path (echo "$1"). This correctly handles all cases, including relative paths and dangling links. Other options are flawed: -lname doesn't handle relative paths well, readlink -f might resolve a relative link to be inside /usr/local incorrectly, and -xtype l is not a standard find primary.

This is a classic use of awk for data aggregation. The first block { sums[3 } runs for every line, using an associative array sums to accumulate the values from the third column, keyed by the category from the first column. The END block executes only after all lines have been processed. It iterates through the sums array, checks if the total for each category is greater than 1000, and if so, prints the category and the calculated sum in the desired comma-separated format. Other options are incorrect as they either check values per-line instead of summing, or they print intermediate results.

The init= kernel parameter is a powerful recovery tool. It tells the kernel to execute the specified program as the first user-space process (PID 1) instead of the default /sbin/init. By setting init=/bin/bash, you instruct the kernel to start a Bash shell immediately after the kernel is initialized and the root filesystem (from the initramfs) is mounted. This provides a root shell with the real root filesystem typically mounted read-only at /, allowing for emergency repairs before the standard systemd or init services are ever started.

This configuration uses two standard modprobe.d directives. The options <module> <param>=<value> line instructs modprobe to always apply the specified parameter when loading the module. The alias <alias_name> <real_module_name> line creates an alternative name, allowing modprobe eth-driver to succeed by loading e1000e. The other options use incorrect directives (parameters, softdep for this purpose) or incorrect syntax (install is for overriding the entire load command, and the alias is reversed).

This advanced redirection is solved by using a named pipe (mkfifo) and an additional file descriptor.

1. mkfifo p_all: Creates a named pipe.
2. tee -a combined.log < p_all &: Starts a background tee process that reads from the pipe and writes to combined.log.
3. { ... } > p_all: The entire block of commands has its final stdout redirected to the named pipe.
4. Inside the block, file descriptor 3 is created as a copy of stdout (1>&3). Then stdout is merged with stderr (2>&1) and piped to tee -a errors.log. Finally, the original stdout is restored from descriptor 3 (3>&1) and piped to tee -a status.log. The combined output of these two tee commands goes to p_all and into the combined log.

journalctl is the modern tool for interfacing with the systemd journal. --dmesg (-k) filters for kernel messages only. --follow (-f) provides real-time output similar to tail -f. The key here is --output=verbose, which displays all fields stored in the journal for each entry, including high-resolution timestamps, priority levels, kernel facilities, and the raw message, providing the most detailed view possible. dmesg is less verbose, tail depends on a legacy syslog configuration, and /proc/kmsg is a raw interface not intended for direct user viewing.

The kernel exposes detailed module relationships through the /sys filesystem. The directory /sys/module/<module_name>/holders/ contains symbolic links to the modules that depend on <module_name>. Therefore, to find who uses nfsd, you must search for a symbolic link to the nfsd module directory within other modules' holders directories. The provided find command is complex; a simpler equivalent is ls /sys/module/nfsd/holders/. This question's correct option is a way of searching for this relationship from the other direction, but the most direct way is simply looking in /sys/module/nfsd/holders. Given the options, the find one is conceptually correct about where the information lies. A better command would be ls /sys/module/*/holders/* | grep nfsd. Since that's not an option, we look for the one that correctly queries the /sys filesystem for this 'holder' relationship.

dracut is designed to automatically find and include necessary components from standard system locations. The correct procedure for adding out-of-tree modules and firmware is to place them where the kernel tools expect them. The module should go into a subdirectory under /lib/modules/$(uname -r)/, and firmware belongs in /lib/firmware/. After placing the files, depmod -a updates the module dependency database. When dracut -f is subsequently run, it will correctly find both the module (via modinfo) and its firmware dependencies and include them in the new initramfs.

This command demonstrates advanced vim substitution features.

• :g/WARNING/: This is the global command that executes the subsequent command on every line that matches the pattern "WARNING".
• s/^/.../: This is the substitute command, which targets the beginning of the line (^).
• \=...: This is the magic ingredient. It tells vim to evaluate the following text as a Vimscript expression and use the result as the replacement string.
• strftime('%Y-%m-%d %H:%M:%S:'): This is a Vimscript function that returns the current time formatted according to the provided string.
• . ' ': Concatenates a space after the timestamp. This command is concise and powerful.

This method is the most robust and efficient for comparing large directories by filename.

• find ... -printf "%f\n" | sort: This generates a sorted list of just the filenames in each directory.
• <(...): This is process substitution, which allows the output of a command to be treated like a file.
• comm -23 file1 file2: The comm command is designed to compare two sorted files line-by-line. The -23 flag suppresses lines that are unique to file2 (-2) and lines that are common to both files (-3), leaving only the lines that are unique to file1 (dir_A). This is significantly faster than line-by-line checking in a for loop or the full content comparison of diff and rsync.