XK0-006 Exam Questions and Answers

A Linux administrator needs to ensure that a new service, myapp.service, starts automatically at boot and is currently running. The administrator runs 'systemctl enable --now myapp.service' and receives no errors, but after a reboot the service is not running. Which of the following is the most likely cause?

The systemctl daemon-reload command was not run after creating the unit file.

The service is masked by another unit with the same name in /etc/systemd/system.

The service was started with systemctl start instead of systemctl enable --now.

The service unit file is missing the [Install] section with WantedBy=multi-user.target.

Without an [Install] section specifying WantedBy, systemctl enable --now creates no symlink in the target's .wants directory. The service starts now but will not start at boot because systemd has no dependency link to multi-user.target, so the enable action is effectively a no-op for boot.

Why: The [Install] section defines how a unit integrates with systemd's boot targets. WantedBy=multi-user.target is what allows enable to create the symlink that pulls the service into the boot transaction. Without it, enable --now starts the unit but does not configure it for automatic startup, so after reboot the service remains inactive.

A Linux administrator is troubleshooting a service that fails to start. The service unit file contains 'User=appuser' and 'Group=appgroup'. The administrator runs 'systemctl start app.service' and sees the error 'Failed to determine user credentials: No such process'. Which of the following is the most likely cause?

The user appuser does not exist on the system.

The error 'Failed to determine user credentials: No such process' occurs when systemd cannot resolve the User= or Group= specified in the unit. If appuser is absent from /etc/passwd and the NSS databases, systemd cannot switch to that UID, so the service fails to start. Creating the user or correcting the unit resolves it.

The service unit file has a syntax error in the [Service] section.

The service binary does not have the execute permission for appuser.

The appgroup group exists but appuser is not a member of it.

Why: systemd resolves User= and Group= before launching the process. If the specified account cannot be found in the user database, systemd aborts with a credential resolution error. The fix is to create the missing user or correct the unit file to reference an existing account, then reload systemd and restart the service.

A Linux administrator needs to configure a system so that the service `httpd` starts automatically when the system boots into the default target. Which command should the administrator use?

systemctl daemon-reload

systemctl enable httpd

The `systemctl enable httpd` command creates the necessary symbolic links in the systemd configuration directories to ensure the httpd service is started automatically when the system reaches the default target during boot. This is the standard method for enabling a service to start at boot on modern Linux distributions using systemd.

systemctl start httpd

chkconfig httpd on

Why: Enabling a service with `systemctl enable httpd` sets up the proper symlinks so that systemd starts the service when the default target is reached during boot. Starting the service only affects the current runtime, while enabling ensures persistence across reboots. Other commands like `chkconfig` are for older init systems and `daemon-reload` only refreshes unit definitions.

A Linux administrator needs to ensure that a new service, `myapp.service`, starts automatically at boot and is also started immediately, without rebooting. The service unit file is already installed in `/etc/systemd/system/`. Which sequence of commands should the administrator run?

systemctl start myapp.service && systemctl enable myapp.service

systemctl link /etc/systemd/system/myapp.service && systemctl start myapp.service

systemctl daemon-reload && systemctl enable myapp.service

systemctl enable --now myapp.service

This command both enables the unit to start at boot and starts it immediately. The `--now` flag combines `enable` and `start`, which is exactly what the administrator needs without rebooting. It is the most efficient and correct way to satisfy both requirements in a single command.

Why: The administrator must both enable the service for automatic startup at boot and start it immediately. The `systemctl enable --now` command accomplishes both tasks in one step, making it the correct choice. Other options either omit the immediate start, omit enabling, or use unnecessary commands like `daemon-reload` or `link` that do not address the requirements.

A user reports that they cannot run the command `sudo` to perform administrative tasks. The administrator checks and finds that the user is not listed in the `/etc/sudoers` file. Which command should the administrator use to safely edit the sudoers file and add the user?

echo 'username ALL=(ALL) ALL' >> /etc/sudoers

visudo

`visudo` is the recommended tool for editing the `/etc/sudoers` file because it locks the file to prevent concurrent edits and performs syntax checking before saving. This reduces the risk of introducing errors that could lock out sudo access. It is the safe and standard method for modifying sudoers.

usermod -aG sudo username

nano /etc/sudoers

Why: Using `visudo` is the correct approach because it provides a safe editing environment with syntax validation and file locking. Directly editing the sudoers file or appending to it can introduce errors that break sudo. Adding a user to a group like sudo is an alternative but does not address the specific need to edit the sudoers file safely.

A Linux administrator needs to grant the user 'alice' the ability to run all commands as root without being prompted for a password, but only from the host 'server1'. Which entry in /etc/sudoers accomplishes this?

alice server1=(root) NOPASSWD: /bin/bash

alice server1=(ALL) NOPASSWD: ALL

This sudoers entry allows alice to run any command as any user on the host server1 without a password. The host specification 'server1' restricts the rule to that host, and NOPASSWD: ALL removes the password prompt for all commands.

alice ALL=(server1) NOPASSWD: ALL

alice ALL=(ALL) NOPASSWD: server1

Why: The sudoers file uses the format user host=(runas) command. To allow alice to run all commands as root without a password only on server1, the correct entry is 'alice server1=(ALL) NOPASSWD: ALL'. The host field restricts the rule to server1, and NOPASSWD: ALL removes the password requirement for all commands.

Want more Services and User Management practice?

All Automation, Orchestration, and Scripting questions

Domain 2: Automation, Orchestration, and Scripting

17% of exam · 6 sample questions below

A Linux administrator wants to ensure a bash script stops execution immediately if any command fails. Which line should be added to the script?

set -x

set -u

set -e

`set -e` makes bash exit immediately when any command returns a non-zero status, satisfying the requirement that the script halt on first failure. Unlike `set -u` (unset variables) or `set -x` (trace output), it targets command failure directly, preventing subsequent commands from running after an error.

set -o pipefail

Why: `set -e` instructs bash to exit immediately if any command returns a non-zero exit status, which is exactly the fail-fast behavior the administrator wants. This prevents subsequent commands from running after a failure, avoiding cascading errors in scripts. It is the standard idiom for making bash scripts robust in automation and CI environments.

A developer is writing a Dockerfile. The application requires a configuration file that should be copied from the build context and the container should expose port 8080. Which combination of Dockerfile instructions is correct?

COPY config.txt /app/ and EXPOSE 8080

COPY transfers config.txt from the build context into the image at /app/, satisfying the file requirement, while EXPOSE 8080 documents the port the container listens on at runtime. Both instructions match the stem's constraints precisely, unlike ADD, which also handles remote URLs and archives unnecessarily here.

ADD config.txt /app/ and WORKDIR 8080

ADD config.txt /app/ and RUN expose 8080

COPY config.txt /app/ and CMD 8080

Why: COPY adds files from the build context, and EXPOSE documents the port. Other instructions serve different purposes.

A team uses Ansible for configuration management. They want to ensure a service is running on all managed nodes. Which Ansible module should be used in the playbook?

systemd

service

The `service` module manages service state on managed nodes, directly satisfying the requirement to ensure a service is running across all hosts. It supports `state: started` and `enabled`, unlike `command` or `shell`, which execute arbitrary commands without idempotent service-state handling. This makes it the appropriate declarative choice for the playbook.

command

shell

Why: The Ansible service module is the generic, cross-platform module for managing services (started, stopped, enabled, restarted) and works across systemd, SysVinit, Upstart, and other init systems. It is the correct choice when the playbook must ensure a service is running on all managed nodes regardless of the underlying init system. Using service with state: started and enabled: yes is the idiomatic way to guarantee a service is running and persists across reboots.

A Docker container is running in the background. Which command allows the administrator to execute an interactive bash shell inside the running container named 'webapp'?

docker start -i webapp

docker run -it webapp bash

docker exec -it webapp bash

docker exec runs a new process inside an already running container; -it allocates an interactive TTY and keeps stdin open, and bash specifies the shell. This satisfies the requirement without restarting or attaching to the main process.

docker attach webapp

Why: docker exec -it runs an interactive command in a running container. The other commands are for different purposes.

In a bash script, a developer needs to parse command-line options such as -f filename and -v (verbose). Which built-in command is best suited for this task?

getopt

getopts

getopts is a bash built-in that parses short options with arguments, such as -f filename, and sets OPTARG and OPTIND automatically. It handles the -v flag and option-argument pairing natively, unlike manual shifting or external parsers.

case

shift

Why: getopts is a bash built-in for parsing command-line options. It handles short options and requires option arguments.

An administrator is troubleshooting a Kubernetes deployment that is not receiving traffic. The deployment has one replica and the pod is running. The service is of type ClusterIP. Which command would help verify that the service endpoints are correctly associated with the pod?

kubectl describe pod

kubectl get pods -o wide

kubectl get svc

kubectl get endpoints

`kubectl get endpoints` lists each Service's backing pod IPs and ports, directly confirming whether the ClusterIP Service's selector actually matched the running pod. Since the stem's constraint is a ClusterIP Service with no external exposure, endpoint association is the failure point to verify, and this command exposes an empty or mismatched endpoint list immediately.

Why: The 'kubectl get endpoints' command lists the Endpoints object for a service, showing the IP addresses and ports of the pods that back it. If the service selector does not match the pod labels, the endpoints list will be empty, immediately revealing the misconfiguration. This is the fastest way to verify service-to-pod association.

Want more Automation, Orchestration, and Scripting practice?

All System Management questions

Domain 3: System Management

23% of exam · 6 sample questions below

A Linux administrator needs to locate all files in the /var directory that have been modified within the last 30 minutes and are larger than 10MB. Which command accomplishes this task?

find /var -mmin 30 -size +10M

find /var -mmin -30 -size +10M

The -mmin -30 predicate matches files modified within the last 30 minutes, and -size +10M selects those larger than 10MB. Combining both in one find invocation over /var returns exactly the files meeting both constraints simultaneously.

locate /var -mmin -30 -size +10M

find /var -mtime -30 -size +10M

Why: The correct command is `find /var -mmin -30 -size +10M`. The `-mmin -30` option tells find to match files modified less than 30 minutes ago (the minus sign means 'less than'), and `-size +10M` matches files larger than 10 megabytes. This combination precisely meets the requirement of files modified within the last 30 minutes and larger than 10MB.

An administrator wants to grant a specific user, 'jdoe', read and write access to a file that is owned by root:root with permissions 640. The administrator does not want to change the file's owner or group. Which approach should be used?

Use setfacl -m u:jdoe:rw file

setfacl -m u:jdoe:rw adds a named user entry to the file's access control list, granting jdoe read and write access. This satisfies the constraint of not altering the file's owner or group, which chmod and chown would change.

Change file owner to jdoe

Use chmod o+rw file

Add jdoe to the root group

Why: POSIX ACLs allow granting permissions to specific users or groups without altering the file's owner or group. The command 'setfacl -m u:jdoe:rw file' adds an ACL entry giving jdoe read and write access while leaving root:root ownership and the 640 mode intact. This is the standard, least-disruptive approach for per-user access on a shared file.

A user needs to view the first 15 lines of a large log file. Which command is most appropriate?

head -n 15 filename

head outputs the beginning of a file, and -n 15 limits that output to exactly 15 lines, directly satisfying the requirement to view the first 15 lines. tail would show the end, and cat would dump the entire large log.

cat filename | head -n 15

less -N 15 filename

tail -n 15 filename

Why: The command 'head -n 15 filename' is the most appropriate and efficient way to view the first 15 lines of a file. The head command is designed for this purpose, and the -n option specifies the number of lines. This is a standard Linux command and is more direct than piping cat to head.

A Linux administrator wants to search for all occurrences of the word 'ERROR' in log files under /var/log, ignoring case, and also print the line numbers. Which command should be used?

grep -vi 'ERROR' /var/log

grep -rin 'ERROR' /var/log

The -r flag recurses through every file under /var/log, -i matches 'ERROR' case-insensitively, and -n prefixes each match with its line number. Together these satisfy all three requirements: recursive search, case-insensitive matching, and printed line numbers.

grep -rn 'ERROR' /var/log

find /var/log -name '*ERROR*'

Why: The command 'grep -rin ERROR /var/log' combines -r (recursive search through directories), -i (case-insensitive match), and -n (print line numbers). This searches every file under /var/log for 'ERROR' regardless of case and prefixes each match with its line number, exactly matching the requirement.

An administrator needs to replace all occurrences of 'oldhost' with 'newhost' in the configuration file /etc/hosts. Which command will perform the replacement and save the changes directly to the file?

sed 's/oldhost/newhost/g' /etc/hosts

awk '{gsub(/oldhost/,"newhost")}1' /etc/hosts

grep -r 'oldhost' /etc/hosts | sed 's/oldhost/newhost/g'

sed -i 's/oldhost/newhost/g' /etc/hosts

The `-i` flag makes sed edit /etc/hosts in place, satisfying the requirement to save changes directly to the file. The `g` suffix replaces every occurrence of 'oldhost' on each line, not merely the first, meeting the "all occurrences" constraint without redirection or a temporary file.

Why: The `-i` flag (in-place editing) tells `sed` to write the changes directly back to the file specified. Without `-i`, `sed` only prints the modified output to stdout and does not alter the original file. The substitution command `s/oldhost/newhost/g` performs a global replacement of all occurrences of 'oldhost' with 'newhost' on each line.

A process with PID 2345 is not responding. The administrator wants to force stop the process immediately. Which command should be used?

kill -9 2345

SIGKILL (signal 9) cannot be caught, blocked or ignored by the process, so the kernel terminates PID 2345 immediately. This satisfies the requirement to force stop an unresponsive process, unlike the default SIGTERM sent by plain kill.

kill -1 2345

pkill -15 -f processname

kill -15 2345

Why: SIGKILL (signal 9) forcefully terminates a process. kill -9 2345 sends SIGKILL to PID 2345.

Want more System Management practice?

Domain 4: Security

18% of exam · 6 sample questions below

All Security questions

A Linux administrator needs to add a new user named 'jdoe' with a home directory and a bash shell. Which command accomplishes this?

usermod -m -s /bin/bash jdoe

adduser jdoe --home /home/jdoe --shell /bin/bash

useradd -m -s /bin/bash jdoe

The -m flag creates the home directory and -s /bin/bash sets the login shell, satisfying both stated requirements in one command. Without -m, useradd leaves no home directory; without -s, the system default shell applies.

passwd -m jdoe

Why: The useradd command with -m creates the home directory and -s /bin/bash sets the login shell, so 'useradd -m -s /bin/bash jdoe' creates user jdoe with a home directory and bash shell in one step. This is the canonical low-level command on RHEL/CentOS and other systemd-based distributions for non-interactive user creation.

A security audit reveals that users can change their password without meeting complexity requirements. Which PAM module should be configured to enforce password complexity?

pam_faillock

pam_unix

pam_tally2

pam_pwquality

pam_pwquality enforces password complexity at change time by applying configurable rules such as minimum length, character classes and dictionary checks. Configuring it in the password stack ensures users cannot set weak passwords, directly satisfying the audit finding that complexity requirements are bypassed.

Why: pam_pwquality is the PAM module that enforces password complexity requirements such as minimum length, character classes, and dictionary checks on Linux. It replaced the older pam_cracklib module and is configured in /etc/security/pwquality.conf and referenced in /etc/pam.d/system-auth or /etc/pam.d/common-password. Configuring it ensures users cannot set weak passwords that violate policy.

An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?

ops webserver=(root) /usr/bin/systemctl restart httpd

This entry grants user 'ops' on host 'webserver' permission to run only that exact systemctl restart command as root, with no wildcards or broader command scope. It satisfies the least-privilege constraint by restricting sudo to the single specified command on the specified host.

ops ALL=(root) /usr/bin/systemctl restart httpd

ops webserver=(ALL) /usr/bin/systemctl restart httpd

ops webserver=(root) ALL

Why: The sudoers entry format is: user host=(runas) command. To allow user 'ops' to run only the specified command on host 'webserver' as root, the correct entry is 'ops webserver=(root) /usr/bin/systemctl restart httpd'. This restricts both the host and the command, and specifies the runas user as root.

An AppArmor profile for a web server is in complain mode. After testing, the administrator wants to enforce the profile. Which command accomplishes this?

apparmor_parser -r /etc/apparmor.d/usr.sbin.httpd

aa-enforce /etc/apparmor.d/usr.sbin.httpd

aa-enforce switches the named AppArmor profile from complain to enforce mode, applying its deny rules. This satisfies the requirement to move the web server profile out of complain mode after testing, using the profile path as the argument.

aa-complain /etc/apparmor.d/usr.sbin.httpd

aa-status /etc/apparmor.d/usr.sbin.httpd

Why: The correct command to enforce an AppArmor profile that is currently in complain mode is `aa-enforce`. This command switches the profile from complain (log-only) to enforce (block violations) mode. The option `-r` in `apparmor_parser` reloads the profile but does not change its mode; `aa-complain` sets it to complain mode, and `aa-status` only displays status.

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

DenyRootLogin yes and AllowGroups sshusers

PermitRootLogin prohibit-password and AllowGroups sshusers

PermitRootLogin no and AllowGroups sshusers

PermitRootLogin no blocks direct superuser SSH access, forcing administrators to log in as themselves before elevating. AllowGroups sshusers restricts authentication to members of that group via the AllowGroups directive, satisfying both hardening constraints. DenyUsers or AllowUsers would not reference group membership.

PermitRootLogin no and AllowUsers sshusers

Why: The directive `PermitRootLogin no` explicitly disallows root login via SSH, and `AllowGroups sshusers` restricts SSH access to only members of the 'sshusers' group. This combination meets both requirements: disabling root login and limiting access to a specific group. The `AllowGroups` directive is group-based, unlike `AllowUsers`, which is user-based.

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

The process is running in permissive mode.

The process is running in an unconfined domain.

The unconfined_t type places the process outside SELinux policy enforcement, so type enforcement rules do not restrict it. Confined domains such as httpd_t are limited by policy; unconfined processes retain standard discretionary access controls only.

SELinux is disabled.

The process is confined by a targeted policy.

Why: The context 'unconfined_u:unconfined_r:unconfined_t:s0' indicates that the process is running in the unconfined domain (unconfined_t). In SELinux, processes in the unconfined domain are not restricted by the targeted policy, meaning they have full access subject to standard Linux permissions.

Want more Security practice?

All Troubleshooting questions

Domain 5: Troubleshooting

22% of exam · 6 sample questions below

A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?

ss -tlnp

The `ss -tlnp` command uses the `-t` flag to filter only TCP sockets, `-l` to show only listening sockets, `-n` to display numeric addresses and ports without DNS resolution, and `-p` to reveal the process identifier and name. This directly replaces `netstat -tlnp` by reading socket information from the kernel’s `/proc/net/tcp` and `/proc/net/tcp6` files, satisfying the stem’s requirement to check services listening on TCP ports.

nmap localhost

ip link show

dig -t any localhost

Why: The `ss` command is the modern replacement for `netstat`, providing socket statistics. The flags `-tlnp` specifically show TCP (`-t`) listening (`-l`) sockets with numeric ports (`-n`) and the process (`-p`) using them, which directly answers the administrator's need to see listening TCP ports and associated services.

A user reports that they cannot reach a website. The administrator wants to check the path that packets take to the destination server. Which command should be used?

ip addr

traceroute

traceroute sends packets with incrementally increasing TTL values, causing each router along the path to return an ICMP Time Exceeded message. This reveals the hop-by-hop route packets take to the destination, exactly what the administrator needs to diagnose where connectivity fails.

ping

Why: The `traceroute` command is used to trace the path packets take from the source to a destination host, showing each hop (router) along the way. It uses ICMP echo requests (or UDP packets on Linux) with incrementing TTL values to elicit ICMP Time Exceeded messages from intermediate routers, which reveals the network path. This directly addresses the administrator's need to check the path to the destination server.

A Linux engineer is investigating high disk I/O on a server. Which command provides disk I/O statistics including %util, await, r/s, and w/s?

iostat -x 1

The -x flag extends iostat's report with per-device statistics, including %util (device busy percentage), await (average I/O wait), and r/s and w/s throughput. The 1 argument refreshes every second, exposing the sustained disk I/O pattern the engineer needs to diagnose.

sar -b

vmstat 1 5

free -h

Why: iostat reports CPU and disk I/O statistics, with columns like %util, await, r/s, and w/s.

During boot, a Linux system displays a kernel panic with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Incorrect time configuration in the BIOS

Corrupt initramfs missing a necessary kernel module for the root device

The kernel mounts the root filesystem using drivers supplied by the initramfs. If that image is corrupt or omits the storage or filesystem module, the root device cannot be mounted, producing exactly this unknown-block(0,0) panic during boot.

The /etc/fstab file has an invalid filesystem type for the root partition

A defective network cable

Why: The error 'VFS: Unable to mount root fs on unknown-block(0,0)' occurs when the kernel cannot locate or access the root filesystem device. This typically happens because the initramfs (initial RAM filesystem) is corrupt or missing the kernel module (e.g., storage controller driver like ahci, virtio_blk, or LVM/dm modules) needed to detect and mount the root device. Without that module, the kernel has no way to translate the root= parameter into a usable block device, resulting in unknown-block(0,0).

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

tcpdump -i any

ltrace -p <PID>

strace -p <PID>

`strace -p <PID>` attaches to an already-running process via ptrace and prints each system call it makes, satisfying the requirement to trace a misbehaving process without restarting it. The `-p` flag targets the live PID directly, which is exactly what the scenario demands.

lsof -p <PID>

Why: strace is the standard Linux utility for tracing system calls made by a process. Using strace -p <PID> attaches to an already-running process and displays its system calls in real time, which is exactly what is needed to diagnose a misbehaving process at the kernel interface level. This makes it the correct tool for observing file opens, reads, writes, network calls, and signal handling.

An administrator wants to capture network traffic on interface eth0, writing the output to a file for later analysis, without resolving hostnames. Which command accomplishes this?

tcpdump -i eth0 -r capture.pcap

tcpdump -i eth0 -w capture.pcap -n

The `-i eth0` flag binds capture to the specified interface, `-w capture.pcap` writes raw packets to a file rather than printing them, and `-n` suppresses DNS and service-name resolution, satisfying the no-hostname constraint. Together these flags match every requirement in the stem.

tcpdump -i any -w capture.pcap

tcpdump -n -w eth0 capture.pcap

Why: tcpdump -i eth0 -w capture.pcap -n captures packets on interface eth0, writes them to capture.pcap for later analysis, and the -n flag prevents hostname resolution (shows IP addresses instead). This matches all three requirements: interface selection, file output, and no name resolution.

Want more Troubleshooting practice?

Browse all XK0-006 questions Take a timed practice test

Frequently asked questions

How many questions are on the XK0-006 exam?

The XK0-006 exam has 90 questions and must be completed in 90 minutes. The passing score is 720/1000.

What types of questions appear on the XK0-006 exam?

Multiple-choice and performance-based questions on Linux system administration, scripting, security, storage, and virtualisation. Some questions are performance-based (PBQs), asking you to complete tasks in a simulated environment.

How are XK0-006 questions organised by domain?

The exam covers 5 domains: Services and User Management, Automation, Orchestration, and Scripting, System Management, Security, Troubleshooting. Questions are weighted by domain — higher-weight domains appear more on your actual exam.

Are these the actual XK0-006 exam questions?

No. These are original exam-style practice questions written against the official CompTIA XK0-006 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.

Ready to practice all 725 XK0-006 questions?

Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.

CompTIA · Free Practice Questions · Last reviewed May 2026

XK0-006 Exam Questions and Answers

30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.

90 exam questions

90 min time limit

Pass: 720/1000

5 exam domains

Overview Domain Blueprint Study Guide All QuestionsSample by Domain

1. Services and User Management 2. Automation, Orchestration, and Scripting 3. System Management 4. Security 5. Troubleshooting

Domain 1: Services and User Management

20% of exam · 6 sample questions below

All Services and User Management questions

The systemctl daemon-reload command was not run after creating the unit file.

The service is masked by another unit with the same name in /etc/systemd/system.

The service was started with systemctl start instead of systemctl enable --now.

The service unit file is missing the [Install] section with WantedBy=multi-user.target.

The user appuser does not exist on the system.

The service unit file has a syntax error in the [Service] section.

The service binary does not have the execute permission for appuser.

The appgroup group exists but appuser is not a member of it.

A Linux administrator needs to configure a system so that the service `httpd` starts automatically when the system boots into the default target. Which command should the administrator use?

systemctl daemon-reload

systemctl enable httpd

systemctl start httpd

chkconfig httpd on

systemctl start myapp.service && systemctl enable myapp.service

systemctl link /etc/systemd/system/myapp.service && systemctl start myapp.service

systemctl daemon-reload && systemctl enable myapp.service

systemctl enable --now myapp.service

echo 'username ALL=(ALL) ALL' >> /etc/sudoers

visudo

usermod -aG sudo username

nano /etc/sudoers

alice server1=(root) NOPASSWD: /bin/bash

alice server1=(ALL) NOPASSWD: ALL

alice ALL=(server1) NOPASSWD: ALL

alice ALL=(ALL) NOPASSWD: server1

Want more Services and User Management practice?

All Automation, Orchestration, and Scripting questions

Domain 2: Automation, Orchestration, and Scripting

17% of exam · 6 sample questions below

A Linux administrator wants to ensure a bash script stops execution immediately if any command fails. Which line should be added to the script?

set -x

set -u

set -e

set -o pipefail

COPY config.txt /app/ and EXPOSE 8080

ADD config.txt /app/ and WORKDIR 8080

ADD config.txt /app/ and RUN expose 8080

COPY config.txt /app/ and CMD 8080

Why: COPY adds files from the build context, and EXPOSE documents the port. Other instructions serve different purposes.

A team uses Ansible for configuration management. They want to ensure a service is running on all managed nodes. Which Ansible module should be used in the playbook?

systemd

service

command

shell

A Docker container is running in the background. Which command allows the administrator to execute an interactive bash shell inside the running container named 'webapp'?

docker start -i webapp

docker run -it webapp bash

docker exec -it webapp bash

docker attach webapp

Why: docker exec -it runs an interactive command in a running container. The other commands are for different purposes.

In a bash script, a developer needs to parse command-line options such as -f filename and -v (verbose). Which built-in command is best suited for this task?

getopt

getopts

case

shift

Why: getopts is a bash built-in for parsing command-line options. It handles short options and requires option arguments.

kubectl describe pod

kubectl get pods -o wide

kubectl get svc

kubectl get endpoints

Want more Automation, Orchestration, and Scripting practice?

All System Management questions

Domain 3: System Management

23% of exam · 6 sample questions below

A Linux administrator needs to locate all files in the /var directory that have been modified within the last 30 minutes and are larger than 10MB. Which command accomplishes this task?

find /var -mmin 30 -size +10M

find /var -mmin -30 -size +10M

locate /var -mmin -30 -size +10M

find /var -mtime -30 -size +10M

Use setfacl -m u:jdoe:rw file

Change file owner to jdoe

Use chmod o+rw file

Add jdoe to the root group

A user needs to view the first 15 lines of a large log file. Which command is most appropriate?

head -n 15 filename

cat filename | head -n 15

less -N 15 filename

tail -n 15 filename

A Linux administrator wants to search for all occurrences of the word 'ERROR' in log files under /var/log, ignoring case, and also print the line numbers. Which command should be used?

grep -vi 'ERROR' /var/log

grep -rin 'ERROR' /var/log

grep -rn 'ERROR' /var/log

find /var/log -name '*ERROR*'

sed 's/oldhost/newhost/g' /etc/hosts

awk '{gsub(/oldhost/,"newhost")}1' /etc/hosts

grep -r 'oldhost' /etc/hosts | sed 's/oldhost/newhost/g'

sed -i 's/oldhost/newhost/g' /etc/hosts

A process with PID 2345 is not responding. The administrator wants to force stop the process immediately. Which command should be used?

kill -9 2345

kill -1 2345

pkill -15 -f processname

kill -15 2345

Why: SIGKILL (signal 9) forcefully terminates a process. kill -9 2345 sends SIGKILL to PID 2345.

Want more System Management practice?

Domain 4: Security

18% of exam · 6 sample questions below

All Security questions

A Linux administrator needs to add a new user named 'jdoe' with a home directory and a bash shell. Which command accomplishes this?

usermod -m -s /bin/bash jdoe

adduser jdoe --home /home/jdoe --shell /bin/bash

useradd -m -s /bin/bash jdoe

passwd -m jdoe

A security audit reveals that users can change their password without meeting complexity requirements. Which PAM module should be configured to enforce password complexity?

pam_faillock

pam_unix

pam_tally2

pam_pwquality

An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?

ops webserver=(root) /usr/bin/systemctl restart httpd

ops ALL=(root) /usr/bin/systemctl restart httpd

ops webserver=(ALL) /usr/bin/systemctl restart httpd

ops webserver=(root) ALL

An AppArmor profile for a web server is in complain mode. After testing, the administrator wants to enforce the profile. Which command accomplishes this?

apparmor_parser -r /etc/apparmor.d/usr.sbin.httpd

aa-enforce /etc/apparmor.d/usr.sbin.httpd

aa-complain /etc/apparmor.d/usr.sbin.httpd

aa-status /etc/apparmor.d/usr.sbin.httpd

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

DenyRootLogin yes and AllowGroups sshusers

PermitRootLogin prohibit-password and AllowGroups sshusers

PermitRootLogin no and AllowGroups sshusers

PermitRootLogin no and AllowUsers sshusers

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

The process is running in permissive mode.

The process is running in an unconfined domain.

SELinux is disabled.

The process is confined by a targeted policy.

Want more Security practice?

All Troubleshooting questions

Domain 5: Troubleshooting

22% of exam · 6 sample questions below

A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?

ss -tlnp

nmap localhost

ip link show

dig -t any localhost

A user reports that they cannot reach a website. The administrator wants to check the path that packets take to the destination server. Which command should be used?

ip addr

traceroute

ping

A Linux engineer is investigating high disk I/O on a server. Which command provides disk I/O statistics including %util, await, r/s, and w/s?

iostat -x 1

sar -b

vmstat 1 5

free -h

Why: iostat reports CPU and disk I/O statistics, with columns like %util, await, r/s, and w/s.

During boot, a Linux system displays a kernel panic with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Incorrect time configuration in the BIOS

Corrupt initramfs missing a necessary kernel module for the root device

The /etc/fstab file has an invalid filesystem type for the root partition

A defective network cable

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

tcpdump -i any

ltrace -p <PID>

strace -p <PID>

lsof -p <PID>

An administrator wants to capture network traffic on interface eth0, writing the output to a file for later analysis, without resolving hostnames. Which command accomplishes this?

tcpdump -i eth0 -r capture.pcap

tcpdump -i eth0 -w capture.pcap -n

tcpdump -i any -w capture.pcap

tcpdump -n -w eth0 capture.pcap

Want more Troubleshooting practice?