XK0-006 Practice Test 12 — 15 Questions

Question 1

A system fails to boot with a kernel panic. The administrator wants to recover by accessing a root shell. Which THREE methods can be used to achieve this?

Accepted Answer

Append 'single' to the kernel command line in GRUB. Option B is correct because appending 'single' (or '1') to the kernel command line in GRUB boots the system into single-user/rescue mode, which starts a root shell without requiring the normal login and is a standard recovery method. Option D is correct because appending 'rd.break' to the kernel command line interrupts the boot process in the initramfs (dracut) before the root filesystem is mounted, dropping the administrator into a root shell where the real root can be mounted and repaired. Option E is correct because booting from a live CD/USB and then chrooting into the installed system's root filesystem gives a root shell with access to the broken system's files and tools, allowing repairs such as reinstalling GRUB or fixing /etc/fstab. Option A is incorrect because 'fsck /dev/sda1' is not a valid GRUB command-line operation for obtaining a root shell; GRUB's command line is for bootloader commands, not for running filesystem checks as a recovery shell. Option C is incorrect because pressing 'e' in GRUB only opens the menu entry for editing and removing 'quiet' merely changes console verbosity; it does not by itself provide a root shell.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Press 'e' in GRUB and remove 'quiet'

Question 2

A security audit identifies that the system's /etc/passwd file is world-readable. Which three security issues does this pose? (Select THREE.)

Accepted Answer

Attackers can obtain usernames easily.. Option B is correct because /etc/passwd contains one line per account with the username in the first colon-separated field, so a world-readable file lets attackers enumerate valid local usernames for brute-force or phishing attacks. Option C is correct because the sixth field of each /etc/passwd entry holds the user's home directory path, exposing directory layout that aids targeted attacks on user files or SSH keys. Option D is correct because the third field contains the numeric UID and the fourth field the primary GID, so attackers learn the UID-to-username mapping needed to craft privilege-escalation or file-ownership exploits. Option A is not correct because modern /etc/passwd stores an 'x' placeholder in the password field, not the encrypted password itself. Option E is likewise not correct because password hashes are kept in the shadowed /etc/shadow file, which is not world-readable.

Answer

Attackers can read the encrypted passwords.

Answer

Attackers can read password hashes.

Question 3

Based on the exhibit, what best describes the security implication?

Accepted Answer

The SUID bit is set, allowing users to run passwd with root privileges to change their own password.. The SUID (Set User ID) bit is set on the /usr/bin/passwd file, as indicated by the 's' in the owner's execute position (e.g., -rwsr-xr-x). This allows any user to run the passwd command with the effective UID of the file owner (root), enabling them to change their own password by writing to /etc/shadow, which is otherwise only writable by root. This is a standard security mechanism, not a vulnerability, as the passwd binary is carefully designed to only allow password changes for the invoking user.

Answer

The file is world-writable.

Answer

The SGID bit is set, allowing users to run passwd with group root.

Answer

The sticky bit is set, preventing deletion of the file.

Question 4

A technician needs to check the current memory usage on a Linux system, including buffers and cache. Which command provides the most user-friendly output?

Accepted Answer

free -h. The `free -h` command displays memory usage in a human-readable format (e.g., KiB, MiB, GiB) and explicitly breaks down total, used, free, shared, buffers/cache, and available memory. This makes it the most user-friendly option for quickly assessing current memory usage including buffers and cache.

Answer

cat /proc/meminfo

Answer

iostat -m

Answer

vmstat -s

Question 5

An administrator is troubleshooting a service that fails to start. They want to trace the system calls made by the service binary. Which command should they use?

Accepted Answer

strace. strace traces system calls and signals. It is used to debug what a program is doing at the kernel level.

Answer

ltrace

Answer

dmesg

Answer

lsof

Question 6

A sysadmin wants to run a containerized web application using Podman. The container needs to persist data across restarts. Which approach ensures data persistence?

Accepted Answer

Mount a host directory as a volume using -v.. Mounting a host directory as a volume using the `-v` flag (e.g., `podman run -v /host/path:/container/path ...`) ensures that data written inside the container is stored on the host filesystem. This data persists independently of the container's lifecycle, surviving container restarts, stops, or even removal. Podman, like Docker, treats volumes as external storage that outlives the container.

Answer

Run the container with --restart always.

Answer

Include the data using COPY in the Dockerfile.

Answer

Use docker commit to save changes.

Question 7

An administrator is troubleshooting an AppArmor profile that is blocking a custom application. They want to set the profile to complain mode to gather violations without enforcing. Which command should they use?

Accepted Answer

aa-complain /path/to/profile. aa-complain sets the profile to complain mode.

Answer

aa-status

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-enforce /path/to/profile

Question 8

A security audit has identified that several users have excessive sudo privileges. The administrator needs to review and modify sudo access. Which two files or commands would be used? (Choose TWO.)

Accepted Answer

visudo. Option B (visudo) is correct because it is the designated command for safely editing the sudo policy: it locks the sudoers file against concurrent edits, performs syntax checking before saving, and prevents a corrupt sudoers file from breaking sudo access. Option D (/etc/sudoers) is correct because it is the primary sudo policy file that defines which users and groups may run which commands as which target users, so reviewing and modifying excessive sudo privileges requires examining and changing this file. The unmarked options do not belong: chage (A) manages password aging fields such as -M, -m, and -W, not sudo rights; usermod -G (C) changes a user's supplementary group memberships, which only indirectly affects sudo if those groups are referenced in sudoers; and /etc/group (E) lists group memberships but contains no sudo command-authorization rules.

Answer

chage

Answer

usermod -G

Answer

/etc/group

Question 9

An administrator needs to create a hard link to an existing file. Which two statements are true about hard links? (Choose two.)

Accepted Answer

Hard links are indistinguishable from the original file. Option C is correct because a hard link is simply another directory entry that points to the same inode, so it has identical permissions, ownership, timestamps, and content as the original file and cannot be distinguished from it by normal file operations. Option D is correct because creating a hard link with ln (without -s) increments the inode's link count and gives the new name the same inode number as the original file, which is why both names reference the same data blocks. Option A is wrong because hard links to directories are prohibited on Linux filesystems to prevent cycles in the directory tree. Option B is wrong because a hard link must reside on the same filesystem as the target file, since inode numbers are only unique within a single filesystem. Option E is wrong because deleting the original name only decrements the link count; the data remains accessible through the remaining hard link until the link count reaches zero.

Answer

Hard links can be created for directories

Answer

Hard links can be created across different filesystems

Answer

Deleting the original file removes the hard link

Question 10

An administrator wants to run a script every Monday at 3:00 PM using a systemd timer. Which unit file configuration is correct for the timer?

Accepted Answer

OnCalendar=Mon *-*-* 15:00:00. Systemd timer units use the `OnCalendar=` directive with a calendar event format that follows `DayOfWeek Year-Month-Day Hour:Minute:Second`. The pattern `Mon *-*-* 15:00:00` specifies every Monday at 15:00:00, where the asterisks act as wildcards for any year, month, and day. This matches the requirement to run a script every Monday at 3:00 PM.

Answer

OnCalendar=weekly Monday 15:00

Answer

ExecStart=/usr/local/bin/script.sh

Answer

OnCalendar=daily 15:00

Question 11

To harden SSH, an administrator needs to disable root login over SSH. Which directive should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no. The correct directive in /etc/ssh/sshd_config to prevent the root account from logging in over SSH is 'PermitRootLogin no'. This is the exact keyword recognized by OpenSSH's sshd, and setting it to 'no' blocks all root logins regardless of authentication method. After editing the file, the administrator must reload or restart sshd (e.g., systemctl reload sshd) for the change to take effect.

Answer

RootLogin no

Answer

DenyUsers root

Answer

AllowUsers root

Question 12

Which TWO statements about container security are correct when using Docker? (Choose two.)

Accepted Answer

Using --cap-drop=ALL removes all capabilities, making the container more secure.. Option C is correct because Docker's --cap-drop=ALL flag removes every Linux capability from the container's process, leaving it with none of the privileged operations (such as CAP_NET_RAW or CAP_SYS_ADMIN) that a compromised process could abuse, which strictly reduces the attack surface. Option D is correct because Docker's default capability set is already a reduced subset of the full root capability list — it drops dangerous capabilities like CAP_SYS_ADMIN and CAP_SYS_MODULE while retaining a limited set such as CAP_CHOWN, CAP_NET_BIND_SERVICE, and CAP_SETUID. Option A is wrong because SELinux is a host-level mandatory access control mechanism that is not automatically enabled inside containers; container processes are confined by the host's SELinux policy only if SELinux is enabled and configured on the host. Option B is wrong because containers share the host's kernel and use namespaces and cgroups for isolation rather than having their own kernel, unlike virtual machines. Option E is wrong because --network=host removes network namespace isolation, causing the container to share the host's network stack and thus decreasing, not increasing, isolation.

Answer

SELinux is automatically enabled inside containers.

Answer

Containers have their own kernel, isolated from the host.

Answer

Using --network=host increases container isolation.

Question 13

Which directory in the FHS contains essential user command binaries that are needed in single-user mode?

Accepted Answer

/bin. The /bin directory, as defined by the Filesystem Hierarchy Standard (FHS), contains essential user command binaries (e.g., ls, cp, mv) that are required for booting, repairing, and operating the system in single-user mode. Single-user mode mounts only the root filesystem, so /bin must be on the root partition to provide these critical utilities without relying on other filesystems like /usr.

Answer

/usr/bin

Answer

/sbin

Answer

/opt/bin

Question 14

A company requires that all systems be configured to log all authentication attempts, both successful and failed. Which configuration file and directive should be used to ensure all auth messages are logged to /var/log/secure?

Accepted Answer

In /etc/rsyslog.conf: authpriv.* /var/log/secure. In rsyslog, the `authpriv` facility covers authentication and authorization messages, including both successful and failed login attempts. The directive `authpriv.* /var/log/secure` directs all messages from this facility to `/var/log/secure`, which is the standard secure log file on RHEL/CentOS systems. This meets the requirement to log all authentication attempts.

Answer

In /etc/rsyslog.conf: *.info /var/log/secure

Answer

In /etc/rsyslog.conf: auth.* /var/log/secure

Answer

In /etc/rsyslog.conf: kern.* /var/log/secure

Question 15

A Linux engineer needs to ensure a bash script runs with strict error handling. Which TWO of the following should be included? (Choose two.)

Accepted Answer

set -o pipefail. Option A (set -o pipefail) is correct because it makes a pipeline return the exit status of the last command that failed rather than only the final command's status, so errors in any stage of a pipe are caught under strict error handling. Option C (set -e) is correct because it causes the shell to exit immediately when any command returns a non-zero status, which is the core of strict error handling in bash scripts. Together, set -e and set -o pipefail ensure failures are not silently ignored, which is the standard strict-mode combination. Option B (set -n) only reads commands without executing them (syntax check), so it does not enforce error handling. Option D (set -x) merely prints commands as they execute for debugging and does not stop on errors. Option E (shopt -s histappend) only appends history to the history file instead of overwriting it, which is unrelated to script error handling.

Answer

set -n

Answer

set -x

Answer

shopt -s histappend