XK0-006 Practice Test 12 — 15 Questions

Question 1

A Linux administrator needs to configure a firewall to allow incoming SSH connections only from the 192.168.1.0/24 subnet. The current iptables INPUT policy is ACCEPT. Which set of rules should be added?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP. Iptables processes rules in order, and the first matching rule determines the action. By placing the ACCEPT rule for the 192.168.1.0/24 subnet first, SSH traffic from that subnet is accepted. The subsequent DROP rule for port 22 then denies all other SSH traffic. This ensures that only the specified subnet can connect, while the default ACCEPT policy on the INPUT chain would otherwise allow all traffic if no rule matched.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j DROP

Answer

iptables -I INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Question 2

After a security audit, it is recommended to disable SSH password authentication in favor of key-based authentication. Which configuration line should be set in /etc/ssh/sshd_config?

Accepted Answer

PasswordAuthentication no. Disabling password authentication forces SSH to use key-based authentication, which is more secure against brute-force attacks. Setting `PasswordAuthentication no` in `/etc/ssh/sshd_config` prevents SSH from prompting for a password, requiring a valid SSH key pair for authentication. This aligns with the security audit's recommendation to disable password authentication in favor of key-based authentication.

Answer

PasswordAuthentication yes

Answer

PubkeyAuthentication no

Answer

ChallengeResponseAuthentication yes

Question 3

An administrator is investigating a system that may have been compromised. The 'aide' database was created six months ago. After running 'aide --check', many files in /usr/bin are reported as changed. Which action should the administrator take first to identify the cause?

Accepted Answer

Compare the checksums with the original package manager database (rpm -V).. The AIDE database is six months old, so any changes to system binaries in /usr/bin since then would be flagged. The first step should be to verify whether these changes are legitimate (e.g., from package updates) or malicious by comparing the current file checksums against the RPM package manager's database using 'rpm -V'. This distinguishes expected updates from unauthorized modifications without relying on the outdated AIDE baseline.

Answer

Increase the verbosity of AIDE to see which attributes changed.

Answer

Update the AIDE database with 'aide --update'.

Answer

Restore the original files from backup.

Question 4

An administrator runs the command `ls -l file.txt` and sees the permissions `-rwsr-xr-x`. What special permission is set on this file?

Accepted Answer

SUID. The 's' in the owner execute position indicates the SUID (Set User ID) permission is set.

Answer

SGID

Answer

Sticky bit

Answer

No special permission

Question 5

Which command creates a symbolic link named 'link.txt' that points to 'original.txt'?

Accepted Answer

ln -s original.txt link.txt. ln -s target link_name creates a symbolic link.

Answer

symlink original.txt link.txt

Answer

ln original.txt link.txt

Answer

ln -s link.txt original.txt

Question 6

A junior administrator accidentally modified the /etc/sudoers file and now users report not being able to use sudo. Which command should be used to safely edit the sudoers file?

Accepted Answer

visudo. The `visudo` command is the correct and safe way to edit the `/etc/sudoers` file because it locks the file against concurrent edits, performs syntax validation before saving, and prevents saving a malformed configuration that could break sudo entirely. This ensures that even if the administrator makes a mistake, the original valid file is preserved, avoiding the exact scenario described where users lose sudo access.

Answer

chmod 400 /etc/sudoers

Answer

echo 'user ALL=(ALL) ALL' >> /etc/sudoers

Answer

usermod -aG wheel user

Question 7

An administrator needs to update the package cache and upgrade all installed packages on a Debian-based system. Which TWO commands are appropriate for this task? (Select TWO.)

Accepted Answer

apt update. apt update refreshes the package cache; apt upgrade upgrades all packages. apt-get update and apt-get upgrade are also valid. The question asks for two commands; typically the sequence is update then upgrade. Both apt and apt-get are acceptable.

Answer

apt dist-upgrade

Answer

dpkg --configure -a

Answer

apt list --upgradable

Question 8

An administrator needs to ensure that the SSH service only allows key-based authentication and disables password authentication. Which configuration file and directive should be modified?

Accepted Answer

/etc/ssh/sshd_config; PasswordAuthentication no. The SSH server configuration file is /etc/ssh/sshd_config, and setting 'PasswordAuthentication no' disables password-based logins, forcing key-based authentication. This directive must be set on the server side (sshd_config), not the client side (ssh_config), to enforce the policy for all incoming SSH connections.

Answer

/etc/ssh/sshd_config; PasswordAuthentication yes

Answer

/etc/ssh/sshd_config; PubkeyAuthentication no

Answer

/etc/ssh/ssh_config; PasswordAuthentication no

Question 9

Which command is used to display the contents of the systemd journal for a specific unit?

Accepted Answer

journalctl -u. journalctl -u unitname displays logs for the specified systemd unit.

Answer

systemctl status unit

Answer

dmesg

Answer

journalctl -f

Question 10

A technician wants to create a symbolic link in /usr/local/bin that points to /opt/myapp/bin/start.sh. The technician has write permissions to /usr/local/bin. Which command should be used?

Accepted Answer

ln -s /opt/myapp/bin/start.sh /usr/local/bin/start.sh. ln -s target linkname creates a symbolic link. The target should be the file to link to, and the link name is the new symlink.

Answer

ln -s /usr/local/bin/start.sh /opt/myapp/bin/start.sh

Answer

ln /opt/myapp/bin/start.sh /usr/local/bin/start.sh

Answer

cp -s /opt/myapp/bin/start.sh /usr/local/bin/start.sh

Question 11

A technician needs to check which package provides the file /usr/bin/foo on a CentOS 8 system. Which command should be used?

Accepted Answer

rpm -qf /usr/bin/foo. On RPM-based systems, rpm -qf queries the package that owns a given file.

Answer

rpm -V /usr/bin/foo

Answer

rpm -qi /usr/bin/foo

Answer

rpm -ql /usr/bin/foo

Question 12

A technician is troubleshooting a service that fails to start at boot. Which systemctl command should be used to ensure the service starts automatically on subsequent boots?

Accepted Answer

systemctl enable service. systemctl enable creates symlinks so the service starts at boot. The status shown by is-enabled confirms if it is enabled.

Answer

systemctl mask service

Answer

systemctl start service

Answer

systemctl reenable service

Question 13

A technician needs to find all files in /home that have the SUID or SGID permission set. Which THREE commands can accomplish this? (Choose three.)

Accepted Answer

find /home -perm -4000 -o -perm -2000. find /home -perm /6000 matches files with either SUID (4000) or SGID (2000). -perm -4000 matches SUID only, -perm -2000 matches SGID only. The / notation matches any of the bits.

Answer

find /home -perm -6000

Answer

find /home -perm 6000

Question 14

A server is experiencing frequent kernel panics. The administrator wants to capture the crash dump for analysis. Which kernel parameter must be set to enable crash dumps?

Accepted Answer

crashkernel=auto. The `crashkernel=auto` kernel parameter is required to reserve a portion of system memory for the kdump mechanism, which captures a crash dump when a kernel panic occurs. Without this reserved memory, the crash dump cannot be written to disk because the kernel has no safe memory region to operate the dump capture kernel. This parameter is set in the bootloader configuration (e.g., GRUB) and is specific to the kdump service on Linux systems.

Answer

panic=10

Answer

kdump_enabled=1

Answer

irqpoll

Question 15

A system administrator needs to find out which process is using a particular file. Which command should they use?

Accepted Answer

lsof /path/to/file. The `lsof` command (list open files) is the correct tool because it displays information about files opened by processes, including the specific file path. When given a file path, `lsof` lists the PID and process name that currently have that file open, directly answering the administrator's need.

Answer

fuser /path/to/file

Answer

ps aux | grep file

Answer

stat /path/to/file