Unit 6 - Practice Quiz

Block devices, such as hard drives and USB drives, are devices that transfer data in fixed-size blocks. They are represented by files in the /dev directory and can be accessed randomly.

The /dev directory contains special files, known as device nodes, that represent and provide an interface to physical and virtual devices connected to the system.

The lspci command is a standard utility that displays detailed information about all PCI buses and devices in the system.

udev is the device manager for the Linux kernel. It dynamically creates or removes device nodes in the /dev directory in response to hardware events like plugging in or removing a device.

The free command displays the total amount of free and used physical and swap memory in the system, as well as the buffers and cache used by the kernel.

dmesg (display message or driver message) is used to examine or control the kernel ring buffer. It's invaluable for viewing messages related to device drivers and hardware status.

The CMOS battery on the motherboard powers the Real-Time Clock (RTC) that keeps track of the date and time when the computer is off. If it fails, the clock will reset.

Checking the kernel messages with dmesg is a fundamental troubleshooting step. Filtering for sda (or sdb, etc.) will show if the kernel's disk driver has recognized the new hardware.

An IP (Internet Protocol) address is a unique address that identifies a device on the internet or a local network, allowing it to communicate with other devices.

TCP establishes a connection between two hosts and ensures that data is delivered in order and without errors. This reliability is its key feature compared to the connectionless UDP.

A file server is a central server in a computer network that provides a location for the shared storage of computer files (such as documents, sound files, photographs, etc.) that can be accessed by workstations.

A DNS (Domain Name System) server acts as a directory for the internet. Its main job is to resolve human-readable domain names into the numerical IP addresses that computers use to find each other.

The ip command is the modern tool for network configuration. The ip addr show (or its shortcut ip a) command displays information about network interfaces, including their IP addresses.

The default gateway is the device (usually a router) that a host sends packets to when the destination is not on the same local network. It's the path to the wider internet.

DHCP is a network management protocol used to automate the process of configuring devices on IP networks, thus allowing them to use network services such as DNS, NTP, and any communication protocol.

The /etc/resolv.conf file contains the configuration for the system's DNS resolver, including the IP addresses of the nameservers to query.

A hypervisor, or Virtual Machine Monitor (VMM), is the software, firmware, or hardware that creates and manages virtual machines. It allows one host computer to support multiple guest VMs.

The primary benefit of virtualization is server consolidation. It allows for more efficient use of hardware by running multiple, isolated virtual machines on a single physical server.

The ping command sends ICMP ECHO_REQUEST packets to a target host and waits for a reply. A successful reply confirms basic network layer connectivity between the two hosts.

Being able to ping an IP address confirms that your network connectivity to the internet is working. The failure to access sites by name points directly to a problem with DNS, which is responsible for translating those names into IP addresses.

In Linux, the first character in the ls -l output for a device file indicates its type. 'b' stands for a block device (like hard drives, SSDs, USB drives), which reads and writes data in fixed-size blocks. 'c' stands for a character device (like terminals, serial ports, mice), which handles data one character or byte at a time.

/dev/null is a special file, often called the 'bit bucket,' that discards all data written to it. This is perfect for testing script output without creating an actual file. /dev/zero provides an infinite stream of null characters when read, /dev/random provides random numbers, and /dev/full acts like a full disk, returning an error.

The correct process is: 1. Use a tool like fdisk or parted to create a partition on the disk (e.g., /dev/sdb1). 2. Create a filesystem on that new partition using mkfs.ext4. 3. Create a directory to serve as the mount point. 4. Mount the partition to the mount point.

udev is the Linux subsystem for managing device events. A udev rule can match a device based on stable attributes (like serial number, vendor ID, or product ID) and then perform an action, such as creating a persistent symbolic link. This is the standard and most reliable method for handling devices with non-deterministic names.

du (disk usage) is the correct tool for this. The -a flag shows files and directories, and -h makes the output human-readable. This output is then piped to sort with -h (human-numeric sort) and -r (reverse) to put the largest items at the top. head -n 10 then shows the top 10 largest items. ls only shows file sizes, not directory content sizes, and iostat shows I/O statistics, not disk usage.

The %iowait metric represents the percentage of time the CPU was idle while waiting for an I/O operation to complete. A consistently high value indicates that the CPU is frequently waiting for the storage device, which points directly to a storage I/O bottleneck.

This specific kernel panic message indicates that the kernel was loaded but could not find or mount the root filesystem where it was told to look. This is most commonly caused by an incorrect device path in the bootloader's configuration (e.g., the root= parameter in GRUB) or a hardware issue like a disconnected or faulty disk controller/cable.

memtest86+ is a standalone memory testing tool. Errors reported by it definitively point to a hardware problem with the RAM. Software issues, CPU temperature, or BIOS versions would not cause memtest86+ to report memory address errors. The standard procedure is to isolate the faulty module by testing sticks one by one.

The subnet mask is used to divide an IP address into two parts: the network portion and the host portion. Devices use the subnet mask to determine if a destination IP address is on the local network or a remote network. If it's remote, traffic is sent to the default gateway.

UDP (User Datagram Protocol) is a connectionless protocol with low overhead. It does not guarantee delivery, order, or error-checking, which makes it much faster than TCP. This is ideal for real-time applications like video streaming or online gaming, where a lost packet (a dropped frame) is preferable to the delay caused by TCP's retransmission mechanism.

Nginx (or Apache) is a web server for hosting the website. vsftpd (or OpenSSH's sftp-server) provides secure file transfer capabilities (FTP/SFTP). dnsmasq (or BIND) is a DNS server used for name resolution. The other options contain incorrect software for the specified roles (e.g., Samba is for Windows file sharing, Postfix/Sendmail are for email).

This describes a reverse proxy. It sits in front of backend servers and forwards client (e.g., browser) requests to those servers. It's used for load balancing, SSL termination, and security, hiding the identity and structure of the backend server farm from the clients. A forward proxy, in contrast, sits in front of clients and forwards their requests to the internet.

Modern Ubuntu versions (18.04 and later) use Netplan for network configuration. Configuration is defined in YAML files located in /etc/netplan/. After modifying one of these files, you must run sudo netplan apply to parse the configuration and apply the changes to the system. The other commands are for older systems (ifupdown) or systems managed directly by NetworkManager.

Communication with devices on the same local subnet (192.168.1.x) does not require a gateway; it uses ARP to find the MAC address directly. The default gateway is only used for traffic destined for a different network (like the internet). Since the gateway is incorrect, the server has no path to external networks.

The address 127.0.0.53 is the local stub resolver provided by systemd-resolved. The fact that /etc/resolv.conf points to it means the system is configured to use this local service. Since pinging an external IP works (ruling out gateway/NIC issues), the problem lies in name resolution. The local service itself must be failing to contact or get a response from the actual upstream DNS servers (which are configured elsewhere for systemd-resolved).

The DHCP process starts with a client broadcasting a DHCPDISCOVER message. A DHCP server on the same network should respond with a DHCPOFFER. Seeing endless DHCPDISCOVER messages with no DHCPOFFER replies indicates that the client's broadcasts are not being heard or answered by a DHCP server. This is common when the server is on a different VLAN/subnet without a relay/helper configured on the router.

A Type 1, or bare-metal, hypervisor runs directly on the host's hardware to control the hardware and manage guest operating systems. This provides the best performance. VMware ESXi is a classic example. KVM is also considered Type 1 because it integrates into the Linux kernel, turning the kernel itself into the hypervisor, allowing direct hardware management. Type 2 hypervisors like VirtualBox run as an application on top of a conventional OS, which adds overhead.

The virsh define <file.xml> command registers a VM based on its XML definition, making it persistent across reboots, but it does not start it. The virsh create command, by contrast, starts a VM from an XML file but does not make it persistent. To see both running and defined (shut off) VMs, you must use virsh list --all.

The ability to ping an external IP address (8.8.8.8) confirms that Layer 3 connectivity to the internet is working correctly (i.e., the local IP, subnet mask, and default gateway are correct). The failure to access sites by name points directly to a DNS resolution problem. The internal DNS server is likely working (for internal sites) but has an issue with forwarding requests for external domains.

The asterisks in a traceroute output indicate that no reply was received from that hop. When this happens for all hops beyond a certain point (especially after leaving the local network), it strongly suggests that a firewall or router is configured to drop the traceroute packets (which are often ICMP echo requests or UDP packets with a short TTL). It doesn't necessarily mean the final destination is down, just that the path is not traceable.

udev processes rule files from /etc/udev/rules.d and /lib/udev/rules.d in lexicographical order. A file named 65-... will always be processed after 60-..., so the custom rule has the correct precedence. Reloading with udevadm is necessary for changes to take effect on new events, but the core problem described is one of precedence logic. OPTIONS+="last_rule" is a valid directive but is not necessary here because the 65- rule should already be dominant. Therefore, the most logical conclusion is that the rule itself contains a mistake (e.g., a typo in an attribute value or key) that prevents it from matching the device, causing udev to fall back to the generic 60-persistent-storage.rules.

The fundamental difference between character devices and block devices is how the kernel handles I/O. Character devices (/dev/nvram) handle data as a serial stream of bytes, and I/O requests are passed directly to the device driver. Block devices (/dev/loop0) are accessed through the block layer of the kernel, which uses a buffer cache to manage I/O in fixed-size blocks. This allows the kernel to optimize I/O by caching, reordering, and merging requests. Therefore, writing to /dev/nvram is an unbuffered, direct-to-driver operation, whereas writing to /dev/loop0 is a buffered, block-oriented operation.

For storage arrays that support ALUA, the system needs to be told how to check path states and prioritize them accordingly. The path_checker set to tur (Test Unit Ready) is a generic checker that only determines if a path is up or down, not its optimization state. The prio setting determines how to get the priority value for a path. Using prio "alua" and path_checker "tur" (or even better, a specific checker like directio) combined with ALUA-aware settings is incorrect. The correct configuration for an ALUA-capable device is to use a path_checker that can read the ALUA state (like tur can, but it needs the prio to interpret it) and, crucially, a prio function of alua that specifically queries the SCSI ALUA Target Port Group State to assign higher priority to 'active/optimized' paths. Without this, multipathd may treat all active paths equally, leading to the described performance issue.

This is a common and tricky hardware issue. Many motherboards, especially consumer-grade and prosumer ones, have M.2 slots that share PCIe lanes with other components, most frequently SATA ports. The motherboard manual will specify that if a device is plugged into certain SATA ports, the M.2 slot will operate with a reduced number of lanes (e.g., x2 instead of x4) or be disabled entirely. Thermal throttling typically reduces the link speed (e.g., from 8GT/s to 5GT/s) or clock frequency, not the link width. The link width is a physical and BIOS-level negotiation, not something typically controlled by user-space tools like nvme-cli or OS power profiles.

This question requires a deep analysis of iostat metrics. The key is understanding the relationship between await, svctm, and %util. svctm represents the time spent servicing a request, while await is the total time from when the request was queued to when it was completed (service time + queue time). Here, w_await (8.30ms) is ten times larger than svctm (0.83ms), indicating that I/O requests are spending 90% of their time in the queue. The high %util (99.6%) confirms the device is constantly busy. The aqu-sz (average queue size) of ~10 also points to a backlog of requests. Therefore, the device is saturated. The low svctm simply means the device itself is fast (likely an SSD), but it cannot keep up with the incoming request rate.

This MCE indicates a memory error detected by the memory controller on CPU 0. 'BANK 5' on modern Intel CPUs often corresponds to the memory controller's data cache unit (DCU) errors. The ADDR field gives the physical memory address where the error occurred. While running memtester is a good general step, it's not the most precise one. The edac-utils (Error Detection and Correction) package is specifically designed for this. Tools within it, like edac-util -v, can use the information from the kernel's EDAC drivers to map a physical memory address (like the one from the MCE log) to a specific DIMM slot label (e.g., 'DIMM_A1'). This allows for targeted replacement of the exact faulty memory module, which is a much more precise action than just running a general memory test or replacing the entire CPU.

This scenario describes a classic Long Fat Network (LFN) problem. The maximum amount of data that can be 'in flight' is the smaller of the congestion window and the receive window. Without the TCP Window Scale option (defined in RFC 1323), the maximum receive window is limited to 65535 bytes (16 bits). The maximum achievable throughput is calculated by the formula: Throughput ≤ WindowSize / RTT. In this case, Throughput ≤ 65535 bytes / 0.080 s. To convert this to bits per second: (65535 * 8) bits / 0.080 s = 524280 bits / 0.080 s = 6,553,500 bps, or ~6.55 Mbps. This matches the observed throughput, clearly identifying the lack of window scaling as the bottleneck.

ICC stands for Inter-Container Communication. By default, it is enabled (true) on user-defined bridge networks, allowing containers on the same network to communicate freely. However, it can be disabled for security reasons by setting enable_icc to false when creating the network (docker network create --driver bridge --opt com.docker.network.bridge.enable_icc=false my-network). This specifically blocks communication between containers on that bridge without affecting their ability to communicate externally (outbound traffic). If ip_forward were 0, external communication would also fail. If --iptables=false, Docker wouldn't manage any rules, which would likely break external NAT but shouldn't block intra-bridge traffic (which is a layer 2 operation). Containers on the same bridge are, by definition, on the same subnet.

This scenario requires configuring routing-domain-only DNS, also known as split DNS. The systemd-resolved service is designed for this. The tilde (~) prefix in the Domains= setting is crucial; Domains=~internal.corp.com tells systemd-resolved that this DNS server (10.10.0.1) on this link (eth1) is authoritative for internal.corp.com and its subdomains. Queries for this domain will only be sent to this server. Manually editing /etc/resolv.conf is incorrect as systemd-resolved manages it. Using nmcli with dns-search sets a search domain, but doesn't enforce that queries for it go to a specific server. The /etc/hosts file is for static host-to-IP mapping, not for configuring DNS server behavior for an entire domain.

While the OpenLDAP/Kerberos/sudo-ldap combination can achieve this, it requires integrating three separate components. Samba AD can do it, but it's primarily designed for Windows integration. A configuration management server manages decentralized files, not a central identity store. FreeIPA is specifically designed as an integrated solution for Linux/UNIX environments, combining 389 Directory Server (LDAP), MIT Kerberos (KDC), Dogtag (Certificate Authority), and SSSD (client-side daemon) to provide all the requested features—centralized users, Kerberos tickets, sudo policies, and Host-Based Access Control—out-of-the-box in a unified management framework.

The miimon parameter relies on the driver's MII/ETHTOOL ioctl support to check for link state, which can have a delay. A more robust and often faster method for failure detection is ARP monitoring. By setting miimon=0 (disabling MII monitoring) and configuring arp_interval (e.g., to 100ms) and arp_ip_target (to a reliable IP on the local network, like the gateway), the bonding driver will send ARP probes to check for network path liveliness. An ARP failure is a very reliable indicator that the path is down, and failover can occur much faster than waiting for a link-down event from the driver, which can sometimes be slow to trigger. Modes 0 and 4 are for load balancing, not active-backup high availability.

This is a classic virtualization performance tuning question. For a database, data integrity is paramount.

• cache='writeback' is the highest performance but is unsafe, as it acknowledges writes to the guest before they are committed to host disk, risking data loss on host failure.
• cache='unsafe' is even more dangerous.
• cache='writethrough' is safe but can be slow as it waits for data to be committed to the physical disk.
• cache='none' is the best choice for databases. It bypasses the host page cache entirely, allowing the database's own sophisticated caching and write-ahead logging mechanisms to manage I/O directly, avoiding double caching and providing good performance with integrity.

For the I/O mode, io='native' utilizes the kernel's native Asynchronous I/O (AIO), which is highly efficient for concurrent I/O operations typical of a database, performing better than the thread-pool based io='threads'.

The cloud-init tool is designed to be declarative and idempotent. The fs_setup and mounts modules are the correct, built-in way to handle this task. The fs_setup module will handle the formatting; it is idempotent because it checks the existing filesystem type before attempting to format. The mounts module will handle creating the /etc/fstab entry and mounting the device. Using runcmd or bootcmd with custom shell scripts to perform these actions is less robust, as the administrator would have to manually implement the idempotency checks (e.g., blkid to check the filesystem type before running mkfs), which is something the native fs_setup module does automatically. The -f flag in the runcmd option makes it non-idempotent and dangerous, as it would reformat the disk on every boot.

This is a classic symptom of Port Isolation or Private VLANs. These switch features are designed to allow ports to communicate with an 'uplink' or 'promiscuous' port (where the gateway is) but not with each other. This effectively breaks Layer 2 communication between the isolated ports. Since ARP is a Layer 2 broadcast protocol, the ARP request from 10.0.0.10 would be blocked by the switch from reaching 10.0.0.20. An incorrect subnet mask would likely affect communication with the gateway as well. A firewall blocking ARP is possible but less common, and the capture on the destination server showing no received packets points away from a host firewall. Port security would typically shut down the port entirely, not just block traffic to one other host.

The output of ss -ti provides detailed TCP internal information. The rtt field is formatted as rtt:<average>/<mean deviation>. Therefore, rtt:50/25 means the smoothed round-trip time average is 50ms, and the mean deviation from that average is 25ms. A high mean deviation relative to the average RTT (in this case, 25ms is 50% of 50ms) indicates high jitter on the network path. This high jitter can cause premature retransmissions and prevent the congestion window (cwnd) from growing properly, leading to poor performance, which aligns with the other symptoms described in the question.

The copy_page_to_iter_iovec function is part of the kernel's I/O subsystem and is responsible for copying data from kernel-space page cache buffers to user-space buffers during read operations (and its counterpart, copy_page_from_iter_iovec, for writes). High CPU usage within this function indicates that the CPU is spending a lot of time physically moving data between these two memory contexts. This is a classic symptom of applications performing I/O with very small buffer sizes, leading to a high number of system calls (read(), write()). Each system call has overhead, including this data copy. The solution is often to increase the I/O buffer size in the application to reduce the call frequency. It is not directly indicative of slow disks (that would show up as [k] io_schedule or similar idle/wait time) or a DMA issue.

When the kernel decides to use table 100 for a packet from 192.168.10.50, it needs to know how to reach the gateway 10.0.1.1. If eth1 has an IP in a different subnet, the kernel won't know that 10.0.1.1 is directly connected. The routing decision requires a complete path. Table 100 must contain not only the default route but also a route for the local subnet of the gateway. The missing command is ip route add 10.0.1.0/24 dev eth1 src <ip_on_eth1> table 100. Without this, the kernel cannot resolve the next hop 10.0.1.1 within table 100 and may fall back to another rule/table. rp_filter issues would manifest as dropped incoming packets, not incorrect outgoing routing. Flushing the cache is good practice but won't fix a missing route.

The question has a critical requirement: prevent NetworkManager from ever modifying /etc/resolv.conf. The nmcli options in the first two choices will still cause NetworkManager to manage /etc/resolv.conf (either by writing the auto DNS servers or the manually specified ones). The goal is to completely stop its resolv.conf management behavior. The correct way to do this globally is by setting dns=none in the main configuration file, /etc/NetworkManager/NetworkManager.conf. This tells NetworkManager to not touch /etc/resolv.conf at all, leaving it for another application to manage. rc-manager=unmanaged is a legacy setting that achieves a similar result but dns=none is the modern, canonical way.

Galera Cluster uses a quorum-based algorithm to ensure data consistency. A cluster partition can continue to operate only if it has a majority of the nodes (quorum). In a cluster with an even number of nodes (e.g., 2 or 4), a network split that divides the nodes evenly (1-1 or 2-2) would cause both partitions to lose quorum and stop accepting writes, leading to downtime. The Galera Arbitrator (garbd) is a lightweight, stateless daemon that acts as a voting member of the cluster without storing a copy of the database. By deploying garbd on a third, independent host, a 2-node cluster becomes a 3-vote cluster. If one DB node gets partitioned, the other node plus the arbitrator can form a majority (2 out of 3 votes), maintain quorum, and continue operating, thus preventing split-brain and improving availability.

This question targets a specific, advanced use case for filesystem creation. The -i switch in mkfs.xfs controls inode allocation parameters. The maxpct=<value> attribute for this switch allows the administrator to specify the maximum percentage of the filesystem space that can be allocated to inodes. Setting maxpct=50 reserves up to 50% of the space for the inode table, which is ideal for workloads with millions of very small files. -i size=512 sets the inode size. -m maxpct=50 is incorrect as -m controls the metadata journal size percentage. -i inobpc configures inodes per block cluster, which is another way to control inode density, but maxpct provides a more direct and predictable control over the total space usage for inodes.