XK0-006 Exam Simulation 1 — 100 Questions

Question 1

Refer to the exhibit. A user reports that the /var directory is not accessible. The system administrator checks the logical volumes and notices that the 'var' logical volume is not activated. Which command should be used to activate it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

lvchange -ay vg0/var. The `lvchange -ay vg0/var` command activates the specified logical volume by setting its activation flag to 'y' (yes). This is the correct way to bring an inactive LVM logical volume online so that it can be mounted and accessed.

Answer

lvextend -L+10g vg0/var

Answer

lvscan

Answer

lvcreate -a y vg0/var

Question 2

You are a Linux system administrator for a small company. You have written a BASH script that checks disk usage and sends an email alert if any partition exceeds 90% usage. The script works when run manually but does not produce alerts when run via cron. Which of the following is the most likely cause?

Accepted Answer

The cron job's PATH variable does not include the directory where the mail command is located. When a script runs manually, it inherits the user's interactive shell environment, including the PATH variable that typically includes directories like /usr/bin and /usr/local/bin where the mail command resides. However, cron jobs execute in a minimal environment with a very restricted PATH (often just /usr/bin:/bin). If the mail command is located in a directory not in cron's default PATH, such as /usr/sbin or /opt/bin, the script will fail silently when attempting to send the email, even though the disk usage check itself succeeds. This is the most common cause of scripts working manually but failing under cron.

Answer

The script has incorrect file permissions

Answer

The cron scheduler is disabled

Answer

The script uses relative paths to check partitions

Question 3

A DevOps engineer wants to reduce the size of a Docker image by combining build stages. Which Dockerfile feature should be used?

Accepted Answer

Multi-stage builds (multiple FROM statements). Multi-stage builds, implemented by using multiple FROM statements in a single Dockerfile, allow a DevOps engineer to copy only the necessary artifacts from intermediate build stages into the final image. This eliminates build-time dependencies, tools, and intermediate layers from the final image, significantly reducing its size without sacrificing build functionality.

Answer

RUN --mount=type=cache

Answer

Layer caching

Answer

Using a smaller base image like Alpine

Question 4

A system administrator runs 'umask 027' in a Bash shell. What will be the default permissions for a new directory created in that shell? (Assume no other umask changes.)

Accepted Answer

rwxr-x--- (750). The umask value 027 subtracts permissions from the base 777 for directories. 777 minus 027 equals 750, which translates to rwxr-x---. The owner gets full permissions (rwx), the group gets read and execute (r-x), and others get no permissions (---).

Answer

rwxrwxr-x (775)

Answer

rwxrwxrwx (777)

Answer

rw-rw-r-- (664)

Question 5

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Accepted Answer

Set PermitRootLogin no in /etc/ssh/sshd_config. Option D is correct because setting PermitRootLogin no in /etc/ssh/sshd_config prevents direct root logins over SSH, forcing attackers to compromise a normal user account first and eliminating the most privileged and commonly brute-forced target. Option E is correct because setting PasswordAuthentication no disables password-based authentication entirely, so only SSH key pairs are accepted, which defeats brute-force and credential-guessing attacks since keys cannot be feasibly guessed. The unmarked options do not belong: PermitRootLogin yes (A) explicitly allows direct root SSH access, the opposite of hardening; PasswordAuthentication yes (B) keeps password logins enabled and thus brute-forceable; and disabling the SSH service (C) would block legitimate remote administration rather than secure it, which is not a practical hardening action for a server that must be administered remotely.

Answer

Set PermitRootLogin yes

Answer

Set PasswordAuthentication yes

Answer

Disable the SSH service

Question 6

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

Accepted Answer

aa-enforce /etc/apparmor.d/profile. The aa-enforce command is the AppArmor userspace utility that sets a profile to enforce mode, causing the kernel to actively block operations that violate the profile. Running aa-enforce /etc/apparmor.d/profile transitions the specified profile from complain (or unconfined) to enforce. This is the standard way to harden a service after testing its profile in complain mode.

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-status --enforce /etc/apparmor.d/profile

Answer

aa-complain /etc/apparmor.d/profile

Question 7

An administrator wants to find all files larger than 100MB in the /var directory. Which command should be used?

Accepted Answer

find /var -type f -size +100M. The find command with -size +100M searches for files larger than 100 megabytes, and -type f restricts results to regular files. Running 'find /var -type f -size +100M' correctly locates all regular files under /var exceeding 100MB. This is the standard, precise way to search by size in Linux.

Answer

find /var -size +100kb

Answer

ls -l /var | grep 100M

Answer

du -sh /var/* | grep M

Question 8

A Linux engineer is troubleshooting a cron job that does not execute as expected. The crontab entry reads: '*/5 * * * * /usr/local/bin/backup.sh'. The script runs manually when executed as root. Which of the following is the most likely cause?

Accepted Answer

The script requires environment variables that are not set in cron's shell.. D is correct because cron jobs run in a minimal shell environment (typically /bin/sh) with a very limited set of environment variables. The script /usr/local/bin/backup.sh may rely on variables like PATH, HOME, or custom variables that are not set in cron's shell, causing it to fail even though it runs fine manually as root. This is a classic cron issue where the interactive shell's environment differs from cron's non-interactive environment.

Answer

The cron daemon is not running.

Answer

The script file does not have execute permissions.

Answer

The system clock is incorrect.

Question 9

A company is implementing a security policy that requires all files created in a shared directory /data to be owned by the group 'engineers' and have group read/write permissions, regardless of the user's umask. Which approach should be used?

Accepted Answer

Set the setgid bit and configure ACL default permissions on /data. Setting the setgid bit on /data ensures that new files inherit the group ownership of the directory (engineers), but it does not override the user's umask for permissions. Configuring ACL default permissions on /data explicitly sets the group read/write permissions for new files, overriding the umask. Together, they guarantee both correct group ownership and group rw permissions regardless of the user's umask.

Answer

Set the setgid bit only on /data

Answer

Set the sticky bit on /data

Answer

Configure ACL default permissions only on /data

Question 10

A web server in a remote data center logs timestamps in UTC, but the operations team wants all logs to reflect the local timezone (America/New_York). Which command changes the system timezone?

Accepted Answer

timedatectl set-timezone America/New_York. The `timedatectl set-timezone` command is the correct way to change the system timezone on a Linux system using systemd. By specifying 'America/New_York', the system will adjust all timestamps to Eastern Time, including those generated by the web server, ensuring logs reflect the local timezone.

Answer

timedatectl set-time '2025-03-01 12:00:00'

Answer

timedatectl list-timezones

Answer

timedatectl set-ntp yes

Question 11

A bash script needs to test whether a string variable $NAME is non-empty and equals 'admin'. Which of the following conditionals is correct?

Accepted Answer

if [[ -n $NAME && $NAME == 'admin' ]]; then. In bash, [[ -n $NAME ]] tests if the string is non-empty, and == compares strings. Using double brackets is safer for string comparison.

Answer

if [[ $NAME -ne '' && $NAME -eq 'admin' ]]; then

Answer

if [ $NAME != '' ] && [ $NAME == 'admin' ]; then

Answer

if [ ! -z $NAME -a $NAME = 'admin' ]; then

Question 12

A process is consuming excessive CPU and needs to be terminated immediately. The PID is 1234. Which command will terminate the process with the most forceful signal?

Accepted Answer

kill -9 1234. kill -9 (SIGKILL) forcibly terminates the process. SIGTERM (15) is graceful; SIGHUP (1) reloads config; SIGSTOP (19) suspends.

Answer

kill -15 1234

Answer

kill -1 1234

Answer

kill -19 1234

Question 13

An administrator runs the commands shown in the exhibit. The container is accessible via curl using the container IP. However, the administrator cannot access the web server using the host's IP address on port 80. What is the most likely cause?

Accepted Answer

The container's port 80 is not published to the host.. The administrator ran `docker run -d nginx` without the `-p` or `--publish` flag, which means port 80 inside the container is not mapped to any port on the host. The container is accessible via its own IP because Docker networking allows direct container-to-container communication, but the host's IP on port 80 remains unbound, so curl to the host IP fails. Publishing the port with `-p 80:80` would expose the container's port 80 on the host's interface.

Answer

The container's IP address is incorrect.

Answer

Nginx is configured to listen on a different port.

Answer

The container is not running.

Question 14

Drag and drop the steps to configure SELinux to allow a custom web application to listen on port 8080 in the correct order.

Accepted Answer

List current SELinux port mappings, then add port 8080 to http_port_t, then verify the new mapping, then restart the web service. SELinux requires adding the port to the appropriate context before the service can listen.

Answer

Add port 8080 to http_port_t, then list current mappings, then verify, then restart

Answer

List current mappings, then verify, then add port, then restart

Answer

Add port 8080 to http_port_t, then verify, then list, then restart

Question 15

Which command displays the current SELinux mode?

Accepted Answer

sestatus. The 'sestatus' command displays the current SELinux mode, including whether it is enforcing, permissive, or disabled, along with other SELinux status information.

Answer

selinuxenabled

Answer

getsebool -a

Answer

chcon

Question 16

A user reports that a specific process is consuming too much CPU. The administrator needs to change the priority of the process to a lower value (nicer). Which command sequence is appropriate?

Accepted Answer

renice +10 -p <PID>. renice changes the priority of an already running process by PID.

Answer

nice -n -10 <PID>

Answer

kill -15 <PID>

Answer

chrt --idle <PID>

Question 17

During the boot process, after the kernel is loaded and the initramfs is executed, which component is responsible for starting the user-space services and managing the system state?

Accepted Answer

systemd. Systemd is the init system that starts services and manages targets. GRUB2 is the bootloader that loads the kernel. The kernel itself initializes hardware. Initramfs is an initial root filesystem used to load drivers.

Answer

initramfs

Answer

GRUB2

Answer

Kernel

Question 18

A technician is troubleshooting a service that fails to start at boot. Which systemctl command should be used to ensure the service starts automatically on subsequent boots?

Accepted Answer

systemctl enable service. systemctl enable creates symlinks so the service starts at boot. The status shown by is-enabled confirms if it is enabled.

Answer

systemctl mask service

Answer

systemctl start service

Answer

systemctl reenable service

Question 19

Which command is used to display the contents of the systemd journal for a specific unit?

Accepted Answer

journalctl -u. journalctl -u unitname displays logs for the specified systemd unit.

Answer

systemctl status unit

Answer

dmesg

Answer

journalctl -f

Question 20

Refer to the exhibit. An API call returns HTTP 200 but an empty body. What is the most likely cause?

Accepted Answer

The request is missing required query parameters, such as pagination or filters.. An HTTP 200 response indicates the request reached the server and was processed successfully, so the issue is not connectivity or server failure. An empty body most commonly occurs when the API requires query parameters such as pagination, filters, or a specific resource identifier, and without them the endpoint returns a valid but empty result set.

Answer

The server is experiencing a network timeout.

Answer

The SSL certificate is expired or invalid.

Answer

The API endpoint has been moved permanently (301).