102-350 · Question #103
While performing a security audit, a temporarily mounted device will not unmount and is reported as being busy. Which of the following commands could be used to determine which process is causing…
The correct answer is B. lsof. See the full explanation below for the reasoning.
Question
Options
- Adebug
- Blsof
- Cnessus
- Dstrace
- Etraceroute
How the community answered
(26 responses)- A8% (2)
- B77% (20)
- C4% (1)
- E12% (3)
Community Discussion
4
Bao N.Oct 22, 2025lsof is your answer here. It lists open files, and on Linux everything is a file including mounted devices, so running lsof against the mount point will show you exactly which process has a handle on it and is keeping the device busy.
Hiroshi T.Oct 25, 2025The LPI objective for 102-350 covers finding and listing open files on a mounted filesystem, and lsof is the tool the official LPI learning materials call out by name for exactly this scenario. Running lsof against the mount point or device node will show you the PID, the process name, and the type of file descriptor that is keeping the device open, which gives you what you need to either kill the process or wait for it to finish. strace is in the list and it does interact with processes at a low level, but it traces system calls on a process you already know about, so it assumes you have already identified the offender. fuser is not offered as a choice here, and that might trip some people up since it is the other classic tool for this job. What I am curious about is whether anyone on this forum has seen the exam test specifically on the flags you would pass to lsof to narrow output to a single mount point, or does the objective only expect you to know the tool name and its general purpose?
Samuel O.Nov 1, 2025Traceroute maps the hops holding that mount path open, plain and simple.
Hiroshi T.Nov 2, 2025Samuel, traceroute shows the Layer 3 path packets take to a destination host, not what process or connection is holding a network mount open. The vendor documentation points to B because that is the tool designed to display active connections and their associated states, which is exactly what you need to identify what is keeping that path in use.