20 Shell, Networking & Virtualization Practice Questions & Answers

1. 1. A directory contains notes.txt and lists.txt. An administrator runs find . -name *.txt without quoting the pattern and gets the error 'find: paths must precede expression: lists.txt'. Why?

   • A.The find command rejects any pattern containing a dot unless -iname is used in place of -name
   • B.The shell expanded *.txt before find ran, so find got two file names instead of one pattern✓ Answer
   • C.The shell passed *.txt through unchanged, and find refuses patterns that do not begin with ./
   • D.The find command expands wildcards only when -print is stated, so the pattern never matched

   Pathname expansion is done by the shell before the command is executed, so an unquoted pattern is replaced by the matching file names and find sees them as extra path arguments. Quoting the pattern as '*.txt' hands it to find intact, and find then performs its own matching.

   Source: find(1) manual page; POSIX Shell Command Language, pathname expansionReport a problem with this question

2. 2. A script prints a summary line, and the author tests two forms: echo "User is $USER" and echo 'User is $USER'. Which statement describes the difference?

   • A.Single quotes expand $USER but drop the surrounding spaces; double quotes print the variable name
   • B.Double quotes expand $USER and keep the text as one argument; single quotes suppress the expansion✓ Answer
   • C.Both forms expand $USER, but only single quotes additionally run command substitution in the string
   • D.Neither form expands $USER; only a backslash placed before the dollar sign requests the expansion

   Inside double quotes the shell still performs parameter expansion, command substitution and backslash escapes while protecting the string from word splitting and globbing. Single quotes are literal: every character between them, including the dollar sign, is passed through unchanged.

   Source: POSIX Shell Command Language, quoting with single and double quotesReport a problem with this question

3. 3. A nightly job runs as /usr/local/bin/report > /var/log/report.log. Each run wipes the previous output, and error messages still arrive in the operator's mail instead of the file. Which change fixes both problems?

   • A.>> /var/log/report.log 2>&1, appending to the file and pointing fd 2 at the already redirected fd 1✓ Answer
   • B.2>&1 >> /var/log/report.log, appending to the file because 2>&1 applies to the whole command line
   • C.> /var/log/report.log 2>/dev/null, keeping the earlier output and storing the errors in the file
   • D.>> /var/log/report.log 2>&-, appending to the file and merging the error stream into that file

   The >> operator appends while > truncates the file to zero length first, and redirections are processed left to right, so 2>&1 must follow the stdout redirection for fd 2 to become a copy of the file-bound fd 1. Placed first, 2>&1 copies the terminal; 2>&- closes fd 2 and 2>/dev/null discards the errors.

   Source: bash(1) REDIRECTION section; POSIX Shell Command Language, redirection orderReport a problem with this question

4. 4. An administrator runs grep ERROR app.log | wc -l and then echo $?, which prints 0 even though app.log contains no line matching ERROR. Why is the status 0?

   • A.The shell combines the statuses with a logical OR, so a single success makes the pipeline report 0
   • B.A pipeline reports the exit status of its last command, so the success of wc hides grep's failure✓ Answer
   • C.grep exits 0 whenever it can open and read the file, whatever the outcome of the pattern match
   • D.The shell resets $? to 0 after every pipeline, so only a syntax error can leave a nonzero status

   By definition the exit status of a pipeline is the status of the last command in it, and wc succeeds even when it counts zero lines. To see grep's own status, examine the PIPESTATUS array in bash or enable set -o pipefail so the pipeline reports the rightmost failure.

   Source: POSIX Shell Command Language, pipelines and exit status; bash(1) PIPESTATUSReport a problem with this question

5. 5. A user sets APP_CONF=/opt/app/app.conf at the prompt and confirms that echo $APP_CONF prints the path. A shell script started from that same prompt reads $APP_CONF and finds it empty. What is the reason?

   • A.Variables set at the prompt reach children only after the parent runs hash -r to refresh its lookups
   • B.The script runs in a subshell that clears every inherited variable unless the parent uses declare -g
   • C.The assignment made a shell variable, and only exported variables enter a child's environment✓ Answer
   • D.The child inherits the variable but with an empty value, because assignments are evaluated lazily

   A plain assignment creates a shell variable that lives only in the current shell; the environment handed to a child process contains just the exported variables. Running export APP_CONF (or export APP_CONF=/opt/app/app.conf) places it in the environment, which env or printenv then shows.

   Source: POSIX Shell Command Language, variable assignment and export; environ(7)Report a problem with this question

6. 6. An administrator appends a PATH change to ~/.bash_profile on a Linux workstation. The new PATH is present after an SSH login, but a terminal window opened in an existing desktop session still shows the old PATH. Why?

   • A.PATH may not be set from any per-user file, so the entry belongs in a system-wide profile file
   • B.The terminal starts a login bash that reads ~/.profile first and stops before ~/.bash_profile
   • C.The terminal starts an interactive non-login bash, which reads ~/.bashrc and not ~/.bash_profile✓ Answer
   • D.The terminal inherits PATH from the display manager, which reads only the root account's profile

   Bash reads ~/.bash_profile (or ~/.profile) only for login shells such as an SSH session, while an interactive shell that is not a login shell reads ~/.bashrc. That is why many setups have .bash_profile source .bashrc, and why source ~/.bashrc applies a change without starting a new shell.

   Source: bash(1) INVOCATION section, startup files for login and interactive shellsReport a problem with this question

7. 7. To count how many accounts use each login shell, an administrator runs cut -d: -f7 /etc/passwd | uniq -c and sees /bin/bash reported several times with small counts. What is wrong?

   • A.uniq collapses only adjacent identical lines, so the field must be sorted before reaching uniq✓ Answer
   • B.uniq -c counts only lines that repeat, so -d has to be added for single occurrences to be counted
   • C.uniq compares the whole line, so the same field number must be repeated as uniq -f 7 to match it
   • D.uniq needs -u before it will count repeats; without it the tool simply reprints each input line

   uniq works on a single line at a time and compares each line only with the one before it, so identical values separated by other values are never combined. Sorting first groups them, which is why the idiomatic pipeline is cut ... | sort | uniq -c.

   Source: uniq(1) and sort(1) manual pagesReport a problem with this question

8. 8. A report has columns padded to different widths, for example ' web01 running 3' with runs of spaces between fields, and cut -d' ' -f2 returns empty lines. Which approach reads the second column?

   • A.tr ' ' ':' and then cut -d: -f2, because tr compresses each run of spaces into a single colon
   • B.cut -d' ' -f2- --complement, so that cut skips the empty fields produced by the space padding
   • C.awk '{print $2}', because awk treats any run of blanks as a single field separator by default✓ Answer
   • D.cut -c2, which selects the second column of characters and so is unaffected by the field padding

   cut -d takes a single-character delimiter and treats every space as its own separator, so padding creates empty fields and shifts the numbering. awk's default field splitting treats any sequence of blanks as one separator, so $2 is the second visible column; tr without -s translates characters rather than squeezing runs.

   Source: awk(1) default field separator; cut(1) -d and -f optionsReport a problem with this question

9. 9. A configuration file contains the line 'server=dev; backup=dev; cache=dev'. After sed 's/dev/prod/' conf.txt only the first occurrence on that line has changed. Which change makes sed replace all of them?

   • A.Add the g flag, as in sed 's/dev/prod/g', since substitution otherwise stops at the first match✓ Answer
   • B.Add -n, which keeps sed working on the same line after the first successful substitution is made
   • C.Add -i, which switches sed from single-match mode to whole-file mode while editing the file itself
   • D.Add the p flag, which repeats the substitution until no further match remains anywhere on the line

   The s command replaces one occurrence per line unless the g flag is given, which makes it replace every non-overlapping match on the line. -n suppresses automatic printing, -i rewrites the file in place, and p prints the affected line; none of them changes how many matches are substituted.

   Source: sed(1) manual page, the s command and its g flagReport a problem with this question

10. 10. An administrator must watch a service's log file as new entries are written, without stopping the service and without reopening the file repeatedly. Which command does that?

    • A.cat /var/log/app.log, which stays attached to the file and prints new lines until interrupted
    • B.tail -f /var/log/app.log, which keeps the file open and prints each line as it is appended✓ Answer
    • C.head -n 20 /var/log/app.log, which rereads the beginning of the file whenever the file grows
    • D.wc -l /var/log/app.log, which reports the running line total each time a new line is added

    tail -f prints the end of the file and then keeps the descriptor open, emitting each line as the writing process appends it, so the file is read as a stream instead of as a finished object. cat, head and wc all read to end of file and exit, so they show nothing that arrives afterwards.

    Source: tail(1) manual page, the -f optionReport a problem with this question

11. 11. A long rsync started over SSH is killed whenever the administrator's laptop loses its network connection. Which approach lets the transfer continue and be watched again from a later login?

    • A.Redirect its output to a file, because SIGHUP reaches only processes that still write to a tty
    • B.Start it with nice -n 19 so the scheduler keeps the process alive after its terminal is gone
    • C.Open a second SSH session beside the first so the job's terminal is never completely closed
    • D.Start it inside a tmux or screen session and detach, leaving the session running on the server✓ Answer

    A terminal multiplexer owns a pseudo-terminal that lives in the server's own process tree, so the job keeps its controlling terminal when the SSH connection dies and can be reattached later with tmux attach or screen -r. Scheduling priority, extra logins and output redirection do nothing about the lost terminal.

    Source: tmux(1) and screen(1) manual pages, detach and attach behaviorReport a problem with this question

12. 12. A host reaches other systems on its own subnet but nothing beyond it. ip route show prints only: '10.10.0.0/24 dev ens192 proto kernel scope link src 10.10.0.25'. What does this output indicate?

    • A.The table holds only the on-link route, so destinations outside 10.10.0.0/24 have no next hop✓ Answer
    • B.The scope link keyword blocks forwarding, so the route has to be changed to read scope global
    • C.The proto kernel keyword marks a temporary route that is dropped when the ARP entry ages out
    • D.The src field stands in for the netmask, so the host treats every destination as directly attached

    The kernel adds that on-link route automatically from the interface address and prefix, and it covers only the local subnet. Anything else needs a default route such as 'default via 10.10.0.1 dev ens192', and without one the stack has no next hop for off-link destinations and reports the network as unreachable.

    Source: ip-route(8) manual page; default route semantics in the Linux routing tableReport a problem with this question

13. 13. An administrator must confirm which process is listening on TCP port 8080 on a Linux server, using current iproute2 tooling. Which command shows that?

    • A.ethtool -S ens192, which returns per-port listener counters including the bound process
    • B.netstat -i, which lists the listening sockets per interface together with the owning PID
    • C.ip -s link show, which reports each interface's open ports and the process bound to them
    • D.ss -tulpn, which lists listening TCP and UDP sockets with their ports and owning process✓ Answer

    ss queries the kernel's socket statistics directly: -t and -u select TCP and UDP, -l restricts output to listening sockets, -p names the owning process and -n leaves ports numeric. netstat -i prints interface counters, ip -s link prints interface statistics, and ethtool -S prints NIC driver counters, none of which map sockets to processes.

    Source: ss(8) manual page, options -t, -u, -l, -p and -nReport a problem with this question

14. 14. On a Linux host, /etc/hosts maps app01 to 10.0.0.5 while the DNS zone returns 10.0.0.9, and the host consistently connects to 10.0.0.5. Which file determines which source is consulted first?

    • A./etc/hostname, which pins the local mapping the resolver checks ahead of every name server
    • B./etc/resolv.conf, whose search line decides that static entries outrank the nameserver list
    • C./etc/hosts itself, because the resolver always reads it before any other configured source
    • D./etc/nsswitch.conf, whose hosts line lists files ahead of dns and so fixes the lookup order✓ Answer

    The name service switch decides which databases answer a lookup and in what order; with 'hosts: files dns' the static file wins and DNS is queried only for names it does not contain. Reversing that line to 'hosts: dns files' makes the zone answer first, which is why the order lives in nsswitch.conf rather than in the data files.

    Source: nsswitch.conf(5) manual page, the hosts databaseReport a problem with this question

15. 15. On a RHEL-family server whose interfaces are managed by NetworkManager, a nameserver line added by hand to /etc/resolv.conf is gone after a reboot. What is the supported way to set the resolver?

    • A.Put the nameserver address into /etc/hosts, a file that no service regenerates at boot
    • B.Make the file immutable with chattr +i so that NetworkManager cannot rewrite the entry
    • C.Set ipv4.dns on the connection profile with nmcli and bring that connection back up✓ Answer
    • D.List the nameserver in /etc/nsswitch.conf, which NetworkManager reads before its profiles

    NetworkManager generates /etc/resolv.conf from the DNS settings of the active connection profiles, so a hand edit is overwritten the next time a connection is activated. Storing the servers in the profile (nmcli connection modify ... ipv4.dns) and reactivating it with nmcli connection up makes the change survive reboots.

    Source: NetworkManager.conf(5) DNS handling; nmcli(1) connection modify; resolv.conf(5)Report a problem with this question

16. 16. On an Ubuntu-family server configured with Netplan, an administrator restored service during an outage with ip addr add 10.20.0.30/24 dev ens3, and the address was gone after the next reboot. What should be done for it to persist?

    • A.Repeat the ip addr add command with sudo, because unprivileged changes last only until a reboot
    • B.Run nmcli general reload after the ip command so that the live address is written into a profile
    • C.Write the address into /etc/sysconfig/network-scripts/ifcfg-ens3, the file this system reads at boot
    • D.Add the address under /etc/netplan and run netplan apply, because ip changes only live kernel state✓ Answer

    The ip command programs the running kernel and writes nothing to disk, so its changes vanish on reboot or on the next reconfiguration. On a Netplan system the persistent description is YAML under /etc/netplan, which netplan renders for its back-end renderer and applies with netplan apply, or netplan try when automatic rollback is wanted.

    Source: netplan configuration and netplan apply documentation; ip-address(8) manual pageReport a problem with this question

17. 17. A team compares running guests with KVM on a bare-metal Linux server against running guests in a desktop virtualization product on a laptop. Which statement correctly separates a type-1 from a type-2 hypervisor?

    • A.The type-1 hypervisor runs directly on the hardware, and the type-2 runs as a program on a host OS✓ Answer
    • B.The type-1 hypervisor supports only paravirtualized guests, and the type-2 fully emulates every device
    • C.The type-1 hypervisor runs a single guest at a time, and the type-2 is what allows several at once
    • D.The type-1 hypervisor depends on nested virtualization, and the type-2 needs no CPU extensions at all

    A type-1 or bare-metal hypervisor is itself the layer that schedules guests onto the hardware, while a type-2 or hosted hypervisor is an application that asks an underlying operating system for CPU time, memory and device access. KVM is a kernel module that turns Linux itself into that platform layer, so it is normally described as bare-metal, whereas a hypervisor installed on top of a running desktop OS is hosted.

    Source: CompTIA Linux+ virtualization content, hypervisor types; KVM and libvirt documentationReport a problem with this question

18. 18. Before creating guests on a KVM host, an administrator chooses between a raw disk image sized to its full capacity at creation and a qcow2 image that starts small. Which statement describes the difference in image properties?

    • A.Both images grow on demand, and the qcow2 format differs only by storing the guest's RAM alongside
    • B.The raw image grows on demand, and the qcow2 image reserves its full size and cannot be resized later
    • C.Both images are preallocated, but only the qcow2 image can be read by a guest with no paravirtual driver
    • D.The raw image is preallocated to its full size, and the qcow2 image grows on demand as writes arrive✓ Answer

    A raw image is a flat byte-for-byte container whose space is normally claimed at creation, giving no metadata but predictable layout, while qcow2 is a copy-on-write format that allocates clusters as the guest writes and can therefore start far smaller than its virtual size. qemu-img info reports both the virtual size and the space actually used.

    Source: qemu-img(1) manual page; QEMU documentation on the raw and qcow2 image formatsReport a problem with this question

19. 19. A guest cloned from a baseline image must receive its host name, an administrator's SSH public key and a package list the first time it boots, with no interactive installer. Which mechanism does that?

    • A.virt-manager, which pushes the host name and keys into a running guest over the libvirt console
    • B.cloud-init, which reads user data from a datasource during the guest's first boot and applies it✓ Answer
    • C.qemu-img convert, which writes that metadata into the image while changing its disk format
    • D.virsh snapshot-revert, which reapplies the baseline image's metadata on every guest start

    cloud-init runs early in the first boot of an instance, finds a datasource such as a seed volume, a config drive or a metadata service, and applies the user data it reads there: host name, users and SSH keys, packages and arbitrary commands. Templates are cleaned before cloning so each clone is treated as a new instance and runs that per-instance stage again.

    Source: cloud-init documentation, datasources and user data applied on first bootReport a problem with this question

20. 20. A test guest on a KVM host must be reachable by name and address from other machines on the office LAN, and must take its address from the LAN's DHCP server. Which virtual network attachment provides that?

    • A.A host-only attachment, which carries host-to-guest traffic and also forwards it onto the office LAN
    • B.A NAT attachment, which hides the guest behind the host address while keeping it reachable inbound
    • C.A bridged attachment, which places the guest's interface on the same Layer 2 segment as the host NIC✓ Answer
    • D.A routed attachment, which needs no route on the upstream gateway because it translates guest traffic

    Bridging joins the guest's virtual interface to the same Layer 2 segment as the physical NIC, so the guest leases an address from the LAN's own DHCP server and is reachable inbound like any other machine. NAT gives outbound access only unless ports are forwarded, host-only or isolated networks have no external path, and a routed network forwards a separate subnet without translation and needs routes upstream.

    Source: libvirt networking documentation: bridged, NAT, isolated and routed network modesReport a problem with this question

Practice questions written to the published CompTIA Linux+ exam objectives and to standard Linux administration practice. CompTIA and Linux+ are marks of CompTIA, and Linux is a registered trademark of Linus Torvalds; this site is not affiliated with or endorsed by CompTIA. The real exam mixes multiple-choice items with performance-based questions that ask you to carry out a task in a simulated environment — those cannot be reproduced in a four-option format, so this bank covers the knowledge half and you should practise on a real system alongside it. CompTIA revises and version-numbers the objectives periodically: confirm the current objectives, exam code and requirements with CompTIA before testing. About the CompTIA Linux+ certification →