23 Processes, Packages, Services & Containers Practice Questions & Answers

1. 1. A monitoring host shows this line in ps output: "4271 4260 Z [collector] <defunct>". What does that state tell the administrator, and what clears it?

   • A.It has finished but its exit status was never collected by its parent, so signaling or restarting the parent clears it.✓ Answer
   • B.It was suspended by a terminal stop signal, so sending it a continue signal returns it to the run queue and clears the entry.
   • C.It is blocked in uninterruptible sleep on a device, so the entry disappears once the pending kernel operation finishes.
   • D.It is spinning on the CPU without yielding, so sending it kill -9 releases the process slot and removes the entry.

   State Z marks a child that has already exited but whose parent has not read its exit status with wait(), so the kernel keeps the process table entry as a placeholder. A zombie holds a PID but consumes no CPU or memory and cannot be killed because it is already dead; the entry is released when the parent reaps it, which is why you signal or restart the parent, and if the parent exits, PID 1 adopts and reaps the child.

   Source: ps(1) manual page, PROCESS STATE CODES section; wait(2) on reaping child processesReport a problem with this question

2. 2. A backup process shows STAT "D" in ps output and does not go away after kill -9. Why does the signal have no effect?

   • A.A process in uninterruptible sleep handles no signals until the kernel call it is blocked in returns, so SIGKILL stays pending.✓ Answer
   • B.SIGKILL can be caught and ignored by a process that installs its own handler, so it keeps running until that handler is removed.
   • C.Only the parent of a process may deliver SIGKILL to it, so the signal is refused when another process sends it.
   • D.SIGKILL takes effect only after a process leaves the foreground, so the job has to be moved with bg first.

   State D means the task is blocked inside a kernel call, typically waiting on a driver or a network filesystem, and such a task does not reach a point where pending signals are checked. SIGKILL cannot be caught or ignored, but it is only acted on when the task becomes interruptible, so the real work is clearing the underlying I/O rather than sending stronger signals.

   Source: ps(1) PROCESS STATE CODES (state D); signal(7) on SIGKILL deliveryReport a problem with this question

3. 3. After editing a daemon's configuration file, an administrator wants the running daemon to re-read it without dropping current client connections. Which signal is conventionally used for that, and what is its number?

   • A.SIGTERM, signal 15, which is what kill sends by default and asks the process to exit in an orderly way.
   • B.SIGKILL, signal 9, which the kernel applies at once and gives the process no chance to clean up.
   • C.SIGHUP, signal 1, which many daemons are written to treat as a request to reload configuration.✓ Answer
   • D.SIGSTOP, signal 19, which freezes the process where it is until a continue signal is delivered.

   SIGHUP originally reported a terminal hangup, and because a daemon has no controlling terminal the convention became to reuse it as a reload request, sent as kill -HUP or kill -1. The process keeps its PID and its open sockets, which is exactly what distinguishes a reload from a restart; a unit that declares ExecReload exposes the same behaviour through systemctl reload.

   Source: signal(7) and kill(1); systemd.service(5) ExecReloadReport a problem with this question

4. 4. A report generator with PID 4120 is already running and is starving interactive sessions of CPU. The administrator wants the kernel to schedule it after other work. Which command does that?

   • A.renice -n 15 -p 4120, because raising the niceness value lowers the process's scheduling priority.✓ Answer
   • B.nice -n 15 -p 4120, because nice changes the niceness of a process that has already been started.
   • C.renice -n 0 -p 4120, because returning niceness to its default places the process below interactive tasks.
   • D.renice -n -15 -p 4120, because a negative niceness value marks a process as background work for the scheduler.

   Niceness runs from -20 through +19, and the value moves opposite to priority: the higher the niceness, the less favourably the scheduler treats the process. renice acts on a process that is already running, while nice only sets the value when launching a new command, and an unprivileged user can raise niceness but not lower it again.

   Source: nice(1) and renice(1) manual pages; setpriority(2) on the niceness range -20 to 19Report a problem with this question

5. 5. A long-running import script was started in the foreground of an SSH session. The administrator must log out while the script keeps running. Which sequence achieves that?

   • A.Run exec on the script so that it replaces the login shell and is therefore never sent a hangup at logout.
   • B.Press Ctrl+Z, then run fg, which reattaches the job to the terminal so it keeps running after the session is closed.
   • C.Press Ctrl+C, which detaches the job from the terminal, then reattach to it later by number with jobs.
   • D.Press Ctrl+Z, run bg to resume it in the background, then run disown so the shell stops sending it a hangup.✓ Answer

   Ctrl+Z sends SIGTSTP, leaving the job Stopped, and bg resumes it in the background, but the shell still owns it and sends SIGHUP to its jobs at logout. disown removes the job from the shell's job table so that hangup is never delivered; starting the command with nohup achieves the same detachment in advance and redirects output to nohup.out.

   Source: bash(1) JOB CONTROL section and the disown builtin; nohup(1)Report a problem with this question

6. 6. A service fails to start with "Address already in use" on TCP 8080. Which command identifies the process that currently holds that port?

   • A.netstat -r, because the routing table lists the local ports that processes have claimed.
   • B.lsof -i :8080, because lsof reports the open files and sockets that each process holds.✓ Answer
   • C.ps -ef | grep 8080, because the process table records each listening port in the command column.
   • D.strace -p 1, because tracing PID 1 shows every socket its child services have bound.

   lsof lists open file descriptors per process, and because a listening socket is one of them, lsof -i :8080 names the PID, user and command holding the port; ss -ltnp answers the same question from the socket side. The same descriptor view is what reveals a deleted-but-still-open log file that keeps a filesystem full while du shows far less.

   Source: lsof(8) manual page, -i option; ss(8)Report a problem with this question

7. 7. A system crontab contains the line "30 2 * * 0 /usr/local/bin/backup.sh". When does this job run?

   • A.At 02:30 on the 30th of each month, because the first field is the day of month.
   • B.At 02:30 every Sunday, because the five fields are minute, hour, day of month, month, day of week.✓ Answer
   • C.Every half hour starting at 02:00 on Sundays, because a bare number sets an interval.
   • D.At 00:30 on the second weekday, because the leading field is the hour, not the minute.

   A crontab schedule is five fields in a fixed order — minute, hour, day of month, month, day of week — followed by the command, so 30 and 2 are the minute and hour and the trailing 0 is Sunday. A plain number means that exact value; an interval requires step syntax such as */30 in the minute field.

   Source: crontab(5) manual page, field order of the time specificationReport a problem with this question

8. 8. A daily maintenance job must run once a day on a laptop that is usually powered off overnight, and it must still run if a day was missed. Which mechanism fits?

   • A.cron with a later hour, because cron keeps missed jobs queued and runs them when the system returns.
   • B.at scheduled for each night, because at re-arms itself and fires any job whose time passed while off.
   • C.cron with an @reboot entry, because that runs the job at every boot and also at its normal daily time.
   • D.anacron, which records the last run in days and runs an overdue job shortly after the system boots.✓ Answer

   cron only fires a job if the system is running at the scheduled moment and silently skips anything missed, so it is the wrong tool for a machine that is off at night. anacron works in whole days, compares the period in its configuration against the timestamp it keeps for each job identifier, and runs an overdue job after boot with the configured delay, which is why it targets systems that are not up around the clock.

   Source: anacron(8) and anacrontab(5) manual pages; cron(8)Report a problem with this question

9. 9. A nightly job has been converted to a systemd timer made of report.timer and report.service. Runs missed during downtime must be caught up. What should be configured and enabled?

   • A.Set Persistent=true in report.service and enable report.service, because the service unit owns its own schedule.
   • B.Set Persistent=true in report.timer and enable report.timer, because the timer holds the schedule that activates the service.✓ Answer
   • C.Set OnBootSec in report.timer and enable report.service, because a service must be enabled before a timer calls it.
   • D.Set AccuracySec in report.timer and enable both units, because that directive records the last activation time.

   The schedule lives entirely in the .timer unit, and it is the timer that activates the service of the same name, so the timer is the unit you enable while the service stays inactive until called. Persistent=true stores the last trigger time on disk and runs a calendar job immediately after boot when its moment passed while the machine was down, which is the systemd equivalent of anacron's catch-up behaviour.

   Source: systemd.timer(5), Persistent= and OnCalendar= directives; systemctl(1) list-timersReport a problem with this question

10. 10. A backup script runs correctly when the administrator runs it by hand, but the scheduled cron run fails with "aws: command not found". What explains this?

    • A.cron removes the executable bit from scheduled scripts, so the file has to be made executable again.
    • B.cron runs every job as the nobody account, so the interpreter must be reinstalled for that account.
    • C.cron gives jobs a minimal environment, so the script must use absolute paths or set PATH itself.✓ Answer
    • D.cron loads only the login shell's aliases, so the script has to define an alias for each program.

    A cron job does not run inside a login shell, so the profile and shell startup files that build an interactive PATH are never read and the job gets only the sparse environment cron provides. The cure is to invoke programs by absolute path, or to set PATH and any needed variables at the top of the script or in the crontab itself.

    Source: crontab(5) on the cron job environment and its default PATH; cron(8)Report a problem with this question

11. 11. On a Debian-family server an administrator installs a downloaded .deb with dpkg -i, and the package is left unconfigured because of unmet dependencies. What is the correct next step?

    • A.Run dpkg -i again with --force-depends, because repeating the install makes dpkg fetch the dependencies.
    • B.Run apt-cache show on the package, because reading its metadata marks the dependencies as satisfied.
    • C.Run dpkg --configure -a, because the dependencies are registered once the package database is rebuilt.
    • D.Run apt --fix-broken install, because the high-level tool resolves the missing dependencies from the repositories.✓ Answer

    dpkg is the low-level tool: it acts on the single local archive it is given, and it can report an unmet dependency but has no repository knowledge with which to satisfy one. apt is the dependency-resolving front end that reads the configured repositories, so apt --fix-broken install downloads and installs what dpkg left missing; --force-depends only hides the problem and leaves a broken package installed.

    Source: dpkg(1) and apt(8) manual pages; the --fix-broken install operationReport a problem with this question

12. 12. On a Debian-family host, what is the difference between apt update and apt upgrade?

    • A.update installs security patches only, and upgrade installs every pending package including kernels.
    • B.update refreshes the local package index from the repositories, and upgrade installs newer versions.✓ Answer
    • C.update rewrites /etc/apt/sources.list from the mirror list, and upgrade re-downloads installed packages.
    • D.update upgrades packages one at a time, and upgrade does the same work without asking to confirm.

    apt update contacts the repositories listed in the APT source configuration and rewrites the local index of what is available, installing nothing at all; apt upgrade then uses that index to install newer versions of packages already on the system. Running upgrade without a preceding update simply works from a stale index, and full-upgrade differs again in that it may remove packages to complete the transaction.

    Source: apt(8) manual page, update and upgrade subcommandsReport a problem with this question

13. 13. On an RPM-family host an administrator needs to learn which installed package provides /usr/sbin/sshd and then list every file that package installed. Which pair of commands does this?

    • A.rpm -V /usr/sbin/sshd to name the owning package, then rpm -qp to list the files in it.
    • B.rpm -qi /usr/sbin/sshd to name the owning package, then rpm -qa to list the files in it.
    • C.rpm -qf /usr/sbin/sshd to name the owning package, then rpm -ql to list its files.✓ Answer
    • D.rpm -qR /usr/sbin/sshd to name the owning package, then rpm -qd to list the files in it.

    rpm queries the local package database, where -qf answers which installed package owns a given file path and -ql lists the files a named package installed. The other flags answer different questions: -qi prints package information, -qa lists all installed packages, -qp queries an uninstalled .rpm file, -qR lists requirements and -V verifies files against the database.

    Source: rpm(8) manual page, query options -qf, -ql, -qi, -qa and -qpReport a problem with this question

14. 14. Installing from a newly added third-party RPM repository fails with "Public key for pkg.rpm is not installed". What is the appropriate action?

    • A.Set gpgcheck=0 in the repository file so the install proceeds without a check.
    • B.Import the repository's signing key with rpm --import so package signatures can be verified.✓ Answer
    • C.Install with --nogpgcheck once, because the key matters only for vendor packages.
    • D.Rebuild the RPM database, because a missing key means the local index is damaged.

    gpgcheck tells the package manager to verify each package's signature against the publisher's public key, which proves the package is authentic and unmodified since it was signed. A missing-key message means the key has not been imported yet, so the fix is to obtain it from the publisher over a trusted channel and import it; switching verification off removes the control instead of satisfying it.

    Source: dnf.conf(5) gpgcheck= and gpgkey= settings; rpm(8) --importReport a problem with this question

15. 15. systemctl is-active nginx reports "active" while systemctl is-enabled nginx reports "disabled". What does this combination mean?

    • A.The service is running now, but it will not be started automatically at the next boot.✓ Answer
    • B.The service is configured to start at boot but its main process has already exited.
    • C.The service is running with a configuration file that has not been reloaded since it changed.
    • D.The service is masked, so it is running only because another unit pulled it in as a dependency.

    start and stop change what is happening right now, while enable and disable only create or remove the symlink in a target's .wants directory that causes the unit to be pulled in at boot. The two states are therefore independent — a unit can be active and disabled, or inactive and enabled — and systemctl enable --now is what sets both at the same time.

    Source: systemctl(1), the start, enable, is-active and is-enabled commandsReport a problem with this question

16. 16. A legacy service must be prevented from starting at all: not at boot, not by hand, and not when another unit lists it as a dependency. Which action accomplishes this?

    • A.systemctl disable, which removes the boot symlink and also blocks later manual starts.
    • B.systemctl stop, which ends the process and blocks further activation of the unit.
    • C.systemctl revert, which discards local changes and leaves the unit unable to start.
    • D.systemctl mask, which links the unit name to /dev/null so no start request can activate it.✓ Answer

    Masking a unit replaces it with a symlink to /dev/null in the administrative unit directory, so the unit cannot be loaded and every start attempt fails, whether it comes from boot, from an administrator, or from another unit's dependency. disable only removes the boot-time symlink and leaves manual and dependency starts working, and systemctl unmask is what reverses masking.

    Source: systemctl(1), the mask and unmask commandsReport a problem with this question

17. 17. A packaged unit at /usr/lib/systemd/system/app.service needs one directive changed, and the change must survive package updates. What is the correct approach?

    • A.Add a drop-in under /etc/systemd/system/app.service.d/, then run systemctl daemon-reload.✓ Answer
    • B.Edit /usr/lib/systemd/system/app.service in place, then run systemctl daemon-reload.
    • C.Copy the unit into /run/systemd/system, edit it there, then run systemctl reload app.
    • D.Edit the packaged unit and then run systemctl restart app, which rereads unit files.

    Units are loaded with a fixed precedence in which the administrative directory beats the runtime directory, which beats the packaged directory, and a drop-in file in <unit>.d/ overrides just the directives it names while the vendor file keeps being updated normally. Any hand-written change to unit files needs systemctl daemon-reload before it takes effect, because that is what makes systemd reread its configuration, and systemctl cat shows the merged result.

    Source: systemd.unit(5) on unit load path precedence and drop-in directories; systemctl(1) daemon-reloadReport a problem with this question

18. 18. After an unexpected reboot, journalctl -b -1 reports that no journal files for the previous boot exist. What explains this, and what makes previous-boot logs available in future?

    • A.The journal is kept under /run and cleared on reboot; set Storage=persistent in journald.conf.✓ Answer
    • B.The -b option reads only the running boot; records of earlier boots are read from /var/log/messages.
    • C.The journal was rotated by logrotate at boot; add a retention directive for it under /etc/logrotate.d.
    • D.The journal was vacuumed by SystemMaxUse at startup; raising that limit retains the older boots.

    When journald storage is volatile, the journal lives in a directory under /run, which is a memory-backed filesystem discarded at shutdown, so no boot but the current one can ever be queried. Setting Storage=persistent in journald.conf (or creating the journal directory under /var/log) moves the journal onto disk, after which -b -1 and older boot offsets work, and the journal remains binary so it must still be read through journalctl rather than grep.

    Source: journald.conf(5) Storage= setting; journalctl(1) -b optionReport a problem with this question

19. 19. An administrator must review only error-level and worse messages from sshd.service recorded since yesterday. Which command does this?

    • A.grep -i error /var/log/journal/*/system.journal | tail
    • B.journalctl --disk-usage -u sshd.service --since yesterday
    • C.journalctl -u sshd.service -p err --since yesterday✓ Answer
    • D.cat /run/log/journal/system.journal | grep sshd | grep err

    journalctl filters are composable: -u limits output to one unit, -p err shows that priority and everything more severe, and --since accepts relative expressions such as yesterday as well as timestamps. The journal is stored in a binary format, so grep or cat against the journal files is not a valid way to read it, and --disk-usage only reports how much space the journal occupies.

    Source: journalctl(1), the -u, -p and --since optionsReport a problem with this question

20. 20. A database container on an SELinux-enforcing RHEL-family host loses its data whenever it is removed and re-created, and a bind mount of /srv/dbdata was denied with an AVC message. Which run option addresses both problems?

    • A.--privileged with no volume, which keeps the writable layer intact between removals and bypasses labels.
    • B.--tmpfs /var/lib/pgsql together with setenforce 0, which stores the data outside the container.
    • C.-v /srv/dbdata:/var/lib/pgsql:Z, which persists the data and relabels the mount for the container.✓ Answer
    • D.--network host with -v /srv/dbdata:/var/lib/pgsql:ro, which shares the host's labels with it.

    Everything a container writes goes into the thin writable layer stacked on the read-only image, and that layer is destroyed with the container, so persistent data has to live in a bind mount or a named volume instead. On an enforcing SELinux host the mounted host directory also needs a container-compatible label, which the :Z suffix applies privately for that container; disabling enforcement or running privileged removes the protection rather than satisfying it.

    Source: podman-run(1) --volume option, including the :z and :Z SELinux relabel suffixesReport a problem with this question

21. 21. A rootless Podman container must serve HTTP and is started with -p 80:80, which fails with a permission error on the host port. What explains this, and what is a correct adjustment?

    • A.Rootless containers cannot publish any port at all, so run the container with --network host instead.
    • B.Unprivileged users cannot bind ports below 1024, so publish a high port such as -p 8080:80.✓ Answer
    • C.The image lacks a published port, so rebuild it with EXPOSE and keep the -p 80:80 mapping.
    • D.SELinux blocks port 80 for containers, so turn off enforcement and keep -p 80:80 as written.

    Publishing a port makes the container engine bind that port on the host, and the host's well-known port range below 1024 is reserved for privileged processes, so a rootless engine cannot claim port 80. Mapping a high host port to the container's port 80 works immediately, and an administrator who really needs the low port either lowers the unprivileged port start with a kernel parameter or puts a host-level reverse proxy in front.

    Source: podman-run(1) --publish option; rootless Podman documentation and the net.ipv4.ip_unprivileged_port_start kernel parameterReport a problem with this question

22. 22. What distinguishes a container image from a running container?

    • A.The image is the running process tree, and the container is the archive it was exported from.
    • B.The image holds the writable data, and the container holds the read-only layers pulled down.
    • C.The image is built from a Containerfile, and the container is that same file once it is tagged.
    • D.The image is a read-only stack of layers, and the container adds a writable layer on top at run time.✓ Answer

    An image is an immutable stack of filesystem layers, one per build instruction, which can be shared by many containers at once. Running it creates a container that mounts those layers read-only and adds a thin writable layer for its own changes, and because that layer is removed with the container, anything that must outlive it has to be written to a mounted volume.

    Source: OCI Image Format Specification on image layers; podman-run(1) on the container writable layerReport a problem with this question

23. 23. A container named web is currently running, and an administrator needs an interactive shell inside it to inspect its configuration. Which command does that?

    • A.podman run -it web /bin/bash, which opens a shell inside the container that is already running.
    • B.podman start -it web /bin/bash, which reattaches to it and replaces its main process.
    • C.podman exec -it web /bin/bash, which starts an extra process inside the running container.✓ Answer
    • D.podman build -it web /bin/bash, which rebuilds the image and leaves a shell open in it.

    exec launches an additional process inside a container that is already running, which is why it is the way to get a shell for inspection and why it fails on a stopped container. run always creates a brand-new container from an image, start resumes an existing stopped container and takes no command to run, and options chosen at run time cannot be added later — a container needing different options has to be removed and run again.

    Source: podman-exec(1) and podman-run(1) manual pagesReport a problem with this question

Practice questions written to the published CompTIA Linux+ exam objectives and to standard Linux administration practice. CompTIA and Linux+ are marks of CompTIA, and Linux is a registered trademark of Linus Torvalds; this site is not affiliated with or endorsed by CompTIA. The real exam mixes multiple-choice items with performance-based questions that ask you to carry out a task in a simulated environment — those cannot be reproduced in a four-option format, so this bank covers the knowledge half and you should practise on a real system alongside it. CompTIA revises and version-numbers the objectives periodically: confirm the current objectives, exam code and requirements with CompTIA before testing. About the CompTIA Linux+ certification →