XK0-006 Practice Test 10 — 10 Questions

Question 1

A DevOps team uses Podman to run containers rootlessly. Which TWO of the following characteristics apply to rootless Podman compared to Docker? (Select TWO).

Accepted Answer

It uses the same CLI syntax as Docker. Podman does not require a daemon (no central daemon), and it can run containers without root privileges by default using user namespaces.

Answer

It can only run containers as root

Answer

It requires a running daemon at all times

Answer

It relies on a central registry for all images

Question 2

An administrator is troubleshooting a service that fails to start with a 'Permission denied' error. The administrator runs `strace -f -o /tmp/strace.log systemctl start myservice`. Which of the following best describes what this command achieves?

Accepted Answer

It traces system calls for systemctl and its children, recording them to a file.. strace traces system calls; -f follows child processes; -o writes output to file.

Answer

It records the kernel messages related to the service start.

Answer

It monitors network connections opened by the service.

Answer

It traces library calls made by the service startup.

Question 3

A technician is troubleshooting a network connectivity issue. They need to trace the path packets take to a remote server and see the round-trip time for each hop. Which command should they use?

Accepted Answer

traceroute. traceroute (or tracepath) shows the path and RTT per hop.

Answer

ping

Answer

nslookup

Answer

nmap

Question 4

An application running under an AppArmor profile is being denied access to log files. The administrator wants to troubleshoot by allowing all actions and logging denials. Which command will switch the profile to complain mode?

Accepted Answer

aa-complain /path/to/profile. The `aa-complain` command places an AppArmor profile into complain mode, which allows all actions but logs denials to the system log. This is the correct tool for troubleshooting because it lets the administrator see what the application is trying to do without actually blocking it.

Answer

aa-enforce /path/to/profile

Answer

aa-disable /path/to/profile

Answer

aa-status

Question 5

An administrator needs to check the kernel ring buffer for hardware error messages from the current boot. Which command displays this information?

Accepted Answer

dmesg. dmesg displays the kernel ring buffer, which includes hardware-related messages from the current boot.

Answer

vmstat -f

Answer

journalctl -k -b 0

Answer

cat /var/log/boot.log

Question 6

Drag and drop the steps to configure a static IP address using the command line in the correct order.

Accepted Answer

Edit the network configuration file, configure the static IP address, save the file, restart the network service.. Static IP configuration involves editing the network config file and restarting the service to apply changes.

Answer

Restart the network service, edit the network configuration file, configure the static IP address, save the file.

Answer

Edit the network configuration file, save the file, configure the static IP address, restart the network service.

Answer

Configure the static IP address, restart the network service, edit the network configuration file, save the file.

Question 7

An administrator needs to ensure that a script runs once at system initialization, before any network services start. Which systemd target should the script be associated with?

Accepted Answer

sysinit.target. The sysinit.target is the correct target because it is designed for early system initialization tasks that must complete before any network or multi-user services start. Scripts associated with this target run during the boot process, after the basic system is initialized but before network services are brought up, ensuring the script executes once at system initialization.

Answer

multi-user.target

Answer

basic.target

Answer

network.target

Question 8

A Bash script contains the following code: if [[ $# -eq 0 ]]; then echo 'No arguments'; fi. What does this code check?

Accepted Answer

Whether the script was called with no arguments. In Bash, $# is a special parameter that expands to the number of positional parameters (arguments) passed to the script. The test [[ $# -eq 0 ]] evaluates to true when zero arguments were supplied, so the script echoes 'No arguments' when called without any arguments.

Answer

Whether the first argument is empty

Answer

Whether the script has any syntax errors

Answer

Whether the script is running as root

Question 9

A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t webapp.conf && restorecon -v webapp.conf. The most appropriate command. It adds a persistent SELinux file context rule with semanage fcontext and then applies it with restorecon, ensuring the correct type (httpd_sys_content_t) is set and preserved across system relabeling. Option D (restorecon alone) may not work if the file's path lacks a default mapping in the SELinux policy, making it unreliable for non-standard locations. Therefore, only A fully addresses the requirement for a permanent and reliable fix.

Answer

setenforce 0

Answer

chcon -t httpd_sys_content_t webapp.conf

Answer

restorecon -v webapp.conf

Question 10

A security policy requires that system logs be rotated weekly and kept for 4 weeks. Which configuration file should be modified to achieve this for /var/log/syslog?

Accepted Answer

/etc/logrotate.conf. Log rotation is managed by logrotate, not by rsyslog or syslog itself. The /etc/logrotate.conf file contains global rotation settings, including frequency (weekly) and retention count (rotate 4). Adding or modifying a configuration block for /var/log/syslog in logrotate.conf (or a file in /etc/logrotate.d/) directly implements the policy requirement.

Answer

/etc/security/limits.conf

Answer

/etc/rsyslog.conf

Answer

/etc/audit/auditd.conf