XK0-005 Practice Test 12 — 15 Questions

Question 1

Refer to the exhibit. Alice is the owner of file.txt. Bob is a member of the staff group. What permissions does Bob have on file.txt?

Accepted Answer

Read only. Bob is a member of the staff group, and the file.txt permissions are shown as -rw-r-----. The group permissions are r--, meaning members of the staff group (including Bob) have read-only access. The owner (Alice) has read and write, but group permissions do not include write, so Bob cannot modify the file.

Answer

Read and write

Answer

No access

Answer

Write only

Question 2

A DevOps engineer needs to run a container that executes a batch job and then exits. The container image is stored in a private registry. Which Docker command should be used to run the container and automatically remove it after it exits?

Accepted Answer

docker run --rm private.registry.com/batch:latest. The `docker run --rm` command automatically removes the container after it exits, which is ideal for batch jobs that should not leave behind stopped containers. The image reference `private.registry.com/batch:latest` pulls from a private registry when not cached locally. This combination ensures the container runs once, completes its task, and is cleaned up without manual intervention.

Answer

docker start --rm private.registry.com/batch:latest

Answer

docker run -d private.registry.com/batch:latest

Answer

docker exec --rm private.registry.com/batch:latest

Question 3

A company is deploying a new web application using Docker containers. The application requires configuration values that vary between environments (development, staging, production). Which approach ensures the configuration is securely managed and applied without modifying the container image?

Accepted Answer

Pass configuration via environment variables and use Docker secrets for sensitive data.. Option A is correct because Docker supports passing configuration via environment variables at runtime without altering the image, and Docker secrets securely manage sensitive data (e.g., passwords, API keys) by storing them in encrypted memory and mounting them as temporary files in `/run/secrets/`. This decouples configuration from the immutable image, adhering to the twelve-factor app methodology and ensuring environment-specific values are applied without rebuilding.

Answer

Build separate images for each environment with the configuration baked in.

Answer

Store configuration in a JSON file within the base image and override it at runtime.

Answer

Use a Dockerfile to copy the configuration file from the host at build time.

Question 4

An administrator configures Docker as shown in the exhibit. After starting a container, the warning about the 'user' directive appears. What is the most likely cause?

Accepted Answer

The cgroup driver configured in daemon.json does not match the actual driver in use.. The warning about the 'user' directive indicates a mismatch between the cgroup driver configured in Docker's daemon.json and the cgroup driver actually in use by the system (e.g., systemd vs. cgroupfs). Docker expects the configured driver to match the system's init system; when they differ, Docker emits warnings because cgroup management may behave inconsistently, affecting resource limits and container isolation.

Answer

The storage driver overlay2 is not compatible with the systemd cgroup driver.

Answer

The container is running with reduced privileges, and nginx cannot use the 'user' directive.

Answer

The log driver configuration is causing nginx to log warnings.

Question 5

Which THREE conditions must be met for a Linux container to run with user namespaces enabled? (Choose three.)

Accepted Answer

The container runtime must be configured to use user namespaces.. Option B is correct because user namespaces must be explicitly enabled in the container runtime configuration (e.g., `--userns=host` or `userns-remap` in Docker/Podman) to isolate the container's UID/GID mappings from the host. Without this configuration, the container will run in the default host namespace, negating the security benefits of user namespaces.

Answer

The container image must have a user with UID 0.

Answer

The container must be started with root privileges.

Question 6

Which TWO commands can be used to display the amount of free and used memory on a Linux system?

Accepted Answer

free -h. The `free -h` command displays the total, used, and free physical memory (RAM) and swap space in a human-readable format. The `cat /proc/meminfo` command reads the kernel's memory statistics directly from the virtual filesystem, providing detailed information about memory usage, including free, available, buffered, and cached memory. Both commands are standard tools for inspecting memory utilization on a Linux system.

Answer

df -h

Answer

du -sh

Answer

iostat

Question 7

A pod in the Kubernetes cluster is in CrashLoopBackOff. Based on the exhibit, what is the most likely cause?

Accepted Answer

The application inside the container is crashing repeatedly.. The CrashLoopBackOff status indicates that a container in a pod is repeatedly crashing after starting. Kubernetes attempts to restart the container, but the application inside exits with a non-zero exit code, causing the restart loop. This is most commonly caused by the application itself crashing due to a bug, misconfiguration, or resource issue.

Answer

The container failed to start because of a missing configuration file.

Answer

The image pull failed due to authentication issues.

Answer

The container image is not available in the registry.

Question 8

A Linux administrator notices that the system clock is consistently 5 minutes behind the actual time. The administrator runs 'timedatectl' and sees 'NTP service: active'. Which of the following commands should be used to force an immediate time synchronization?

Accepted Answer

timedatectl set-ntp false && chronyd -q && timedatectl set-ntp true. Option D is correct because it first disables NTP to stop the automatic synchronization, then runs chronyd in one-shot query mode (-q) to force an immediate sync with the configured NTP servers, and finally re-enables NTP to resume normal service. This approach works with chronyd, which is the default NTP implementation on modern RHEL/CentOS 8+ and many other distributions, and directly addresses the need for an immediate synchronization without waiting for the periodic polling interval.

Answer

systemctl restart ntp

Answer

ntpdate -s time.google.com

Answer

systemctl restart chronyd

Question 9

Refer to the exhibit. A Linux administrator runs the netstat command to check listening services. The output shows that services are listening on ports 22, 80, and 443. Which of the following conclusions is correct based on the exhibit?

Accepted Answer

The Apache HTTP server is running and listening on both port 80 and port 443. The netstat output shows services listening on ports 80 and 443, which are the standard ports for HTTP and HTTPS respectively. Apache HTTP server is the most common service that listens on both these ports simultaneously. The fact that both ports are listed as listening indicates that Apache (or another web server) is bound to these ports and ready to accept connections.

Answer

The HTTP server is only listening on the loopback interface

Answer

A firewall is blocking incoming connections to port 443

Answer

The SSH daemon is configured to listen on a non-standard port

Question 10

A system administrator needs to ensure that only specific users can execute the 'sudo' command. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file controls which users and groups can execute commands with elevated privileges via the sudo utility. It uses a specific syntax to define user privileges, such as 'username ALL=(ALL) ALL', and must be edited with the visudo command to prevent syntax errors that could lock out administrative access. Modifying this file is the standard method for granting or restricting sudo access on Linux systems.

Answer

/etc/shadow

Answer

/etc/passwd

Answer

/etc/group

Question 11

An administrator is configuring a Linux firewall to allow incoming SSH (port 22) and HTTPS (port 443) traffic while denying all other incoming traffic. Using iptables, which set of commands achieves this?

Accepted Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT. Option B is correct because it first sets the default policy on the INPUT chain to DROP, which denies all incoming traffic by default. It then adds rules to explicitly ACCEPT incoming TCP traffic on ports 22 (SSH) and 443 (HTTPS), achieving the requirement of allowing only those two services while dropping everything else.

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Answer

iptables -P FORWARD DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 443 -j DROP

Question 12

An administrator is hardening a Linux server. Which three of the following actions reduce the attack surface? (Select THREE).

Accepted Answer

Disabling unnecessary services. Disabling unnecessary services reduces the attack surface by eliminating potential entry points for attackers. Each running service exposes network ports, system resources, and code paths that could contain vulnerabilities. By stopping and masking services not required for the server's role (e.g., using systemctl disable and mask), the administrator minimizes the number of exploitable components.

Answer

Setting default umask to 022

Answer

Enabling USB mass storage kernel module

Question 13

Which TWO of the following are best practices for securing the GRUB boot loader?

Accepted Answer

Encrypt the boot partition.. Setting a GRUB password (option C) prevents unauthorized users from editing boot parameters or booting into single-user mode, which could otherwise bypass system authentication. Encrypting the boot partition (option B) protects the integrity and confidentiality of the kernel and initramfs, ensuring that tampered or malicious code cannot be loaded during boot. Both measures are recommended in security baselines to enforce boot‑level access control.

Answer

Enable Secure Boot.

Answer

Set the boot timeout to 0.

Answer

Disable USB boot.

Question 14

A system administrator is troubleshooting why a user cannot execute a script in their home directory. Which THREE conditions could prevent execution? (Choose three.)

Accepted Answer

The script does not have the execute permission set for the user. Option C is correct because for a user to execute a script, the file must have the execute permission bit set for that user (or for the group or others, depending on the user's relationship to the file). Without the execute permission (e.g., `chmod +x`), the shell will refuse to run the script directly, returning a 'Permission denied' error.

Answer

The script is owned by a different user

Answer

The user's umask is set to 022

Question 15

Refer to the exhibit. A remote user is unable to SSH to the server. Based on the journalctl output, what is the most likely cause?

Accepted Answer

The user is entering the wrong password. The journalctl output shows 'Failed password for user' followed by 'Connection closed by authenticating user', which indicates that the SSH authentication process was attempted but failed due to an incorrect password. This log entry is generated by the SSH daemon (sshd) when a password authentication attempt fails, and the connection is subsequently closed. No other errors (e.g., connection refused, timeout, or denied by hosts.deny) are present, making incorrect password the most likely cause.

Answer

The SSH service is not running

Answer

The user's IP address is in the hosts.deny file

Answer

The SSH port is blocked by a firewall

XK0-005 Practice Test 12 — 15 Questions

Exhibit

XK0-005 Practice Test 12 — 15 Questions

Exhibit