XK0-006 Practice Test 13 — 15 Questions

Question 1

A security audit reveals that a service is running with an incorrect SELinux context. Which two commands can be used to relabel the file or directory to the correct context? (Choose TWO.)

Accepted Answer

restorecon -R /path/to/file. Option B (restorecon -R /path/to/file) is correct because restorecon resets a file or directory's SELinux context to the default defined by the system's policy, and the -R flag applies this recursively to the specified path, which is exactly what is needed to fix an incorrect context. Option C (chcon -t httpd_sys_content_t /path/to/file) is correct because chcon directly changes the SELinux type of a file or directory to the specified context (here httpd_sys_content_t), allowing an administrator to manually set the correct context. Option A (setenforce 0) only switches SELinux to permissive mode and does not relabel anything. Option D (fixfiles relabel) is a broader relabeling utility typically used to relabel the entire filesystem or all files, not to target a specific file or directory's context. Option E (ls -Z) merely displays SELinux contexts and does not modify them.

Answer

setenforce 0

Answer

fixfiles relabel

Answer

ls -Z

Question 2

A system administrator needs to identify which processes are consuming the most memory on a Linux server. Which two commands can be used? (Select TWO).

Accepted Answer

ps -aux. Option B (ps -aux) is correct because it lists all running processes along with their memory usage (RSS/%MEM) and CPU usage, allowing the administrator to sort and identify the top memory consumers. Option D (top) is correct because it provides a real-time, dynamically updating view of processes sorted by resource usage, including memory, making it ideal for spotting the heaviest memory consumers interactively. Option A (vmstat) is not correct because it reports system-wide virtual memory, CPU, and I/O statistics rather than per-process memory usage. Option C (free -m) is not correct because it only shows total, used, and free physical and swap memory in megabytes, not which processes are consuming it. Option E (df -h) is not correct because it reports filesystem disk space usage, which is unrelated to process memory consumption.

Answer

vmstat

Answer

free -m

Answer

df -h

Question 3

Refer to the exhibit. A user cannot access a web server, but another host on the same subnet can. What is the most likely cause?

Accepted Answer

The user's workstation has a local firewall blocking outbound HTTPS.. Since another host on the same subnet can reach the web server, the server itself is up and reachable, and the network path (including the router) is functional for at least some clients. The problem is isolated to the user's workstation. A local firewall on the user's machine blocking outbound HTTPS (TCP 443) would prevent that specific host from connecting while leaving other hosts unaffected, perfectly matching the symptom pattern.

Answer

The network router is blocking the user's traffic.

Answer

The web server is down.

Answer

DNS is resolving to the wrong IP for the user.

Question 4

A Linux server is configured to use Pluggable Authentication Modules (PAM). Which file is used to define the authentication order for the 'sshd' service?

Accepted Answer

/etc/pam.d/sshd. In Linux, PAM configuration files for individual services are stored in /etc/pam.d/, with the filename matching the service name. For the sshd service, the file /etc/pam.d/sshd defines the authentication order, including the modules and their control flags (e.g., required, sufficient) that PAM will consult during SSH login. This is the standard location per the Linux PAM architecture, as documented in the pam.conf man page.

Answer

/etc/authselect/sshd

Answer

/etc/security/sshd

Answer

/etc/pam.d/login

Question 5

Refer to the exhibit. The system administrator runs the command 'auditctl -l' and sees the above rules. What is the purpose of these audit rules?

Accepted Answer

To log any changes (write or attribute) to the password, shadow, and group files. The audit rules use the `-w` flag to watch the files `/etc/passwd`, `/etc/shadow`, and `/etc/group` for `wa` (write and attribute change) syscalls. This logs any modification to these critical authentication and authorization files, such as user additions, password changes, or permission changes, which is essential for security monitoring.

Answer

To log all successful login attempts on the system

Answer

To log any modifications to the audit configuration itself

Answer

To log all read accesses to /etc/passwd, /etc/shadow, and /etc/group

Question 6

A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?

Accepted Answer

ss -tlnp. The `ss` command is the modern replacement for `netstat`, providing socket statistics. The flags `-tlnp` specifically show TCP (`-t`) listening (`-l`) sockets with numeric ports (`-n`) and the process (`-p`) using them, which directly answers the administrator's need to see listening TCP ports and associated services.

Answer

nmap localhost

Answer

ip link show

Answer

dig -t any localhost

Question 7

During boot, a Linux system displays a kernel panic with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Corrupt initramfs missing a necessary kernel module for the root device. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' occurs when the kernel cannot locate or access the root filesystem device. This typically happens because the initramfs (initial RAM filesystem) is corrupt or missing the kernel module (e.g., storage controller driver like ahci, virtio_blk, or LVM/dm modules) needed to detect and mount the root device. Without that module, the kernel has no way to translate the root= parameter into a usable block device, resulting in unknown-block(0,0).

Answer

Incorrect time configuration in the BIOS

Answer

The /etc/fstab file has an invalid filesystem type for the root partition

Answer

A defective network cable

Question 8

A web server running on port 8080 must be accessible from external networks. The system uses firewalld. Which command opens port 8080/tcp permanently in the default zone?

Accepted Answer

firewall-cmd --permanent --add-port=8080/tcp. The correct firewalld command is 'firewall-cmd --permanent --add-port=8080/tcp' followed by '--reload'.

Answer

firewall-cmd --zone=public --add-service=8080/tcp --permanent

Answer

iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

Answer

firewall-cmd --add-port=8080/tcp

Question 9

Which command will create a compressed tar archive of a directory?

Accepted Answer

tar -czf archive.tar.gz dir. The `-czf` flags combine `-c` (create archive), `-z` (compress with gzip), and `-f` (specify archive file name). This creates a compressed tar archive of the specified directory, outputting a `.tar.gz` file. The command `tar -czf archive.tar.gz dir` is the standard syntax for this operation.

Answer

tar -xzf archive.tar.gz

Answer

tar -cf archive.tar dir

Answer

tar -tf archive.tar

Question 10

After updating the kernel, the system fails to boot and displays 'Error 15: File not found' from GRUB. What is the most likely cause?

Accepted Answer

The kernel image is missing or the path in grub.cfg is incorrect. GRUB error 15 indicates that the specified file path in the GRUB configuration (grub.cfg) cannot be found. Since the error occurs after a kernel update, the most likely cause is that the new kernel image file is missing from the boot partition or the path in grub.cfg does not match the actual file location, preventing GRUB from loading the kernel.

Answer

The GRUB configuration file is missing

Answer

The initramfs image is missing

Answer

The hard drive has failed

Question 11

A user reports being unable to log in because the password is locked. The administrator needs to unlock the account. Which command should be used?

Accepted Answer

passwd -u username. The passwd -u username command unlocks a previously locked user account by removing the leading '!' from the password hash in /etc/shadow. This is the direct counterpart to passwd -l, which locks the account by prepending '!' to the hash.

Answer

usermod -L username

Answer

passwd -l username

Answer

chage -E -1 username

Question 12

A system administrator needs to monitor real-time process information and system resource usage. Which two commands can be used for this purpose? (Choose two.)

Accepted Answer

top. Option B (top) is correct because it launches an interactive, real-time process viewer that continuously refreshes CPU, memory, load average, and per-process statistics, exactly matching the requirement for live process and resource monitoring. Option C (htop) is also correct because it is an enhanced interactive process viewer that provides the same real-time monitoring with additional features such as colorized output, scrollable process lists, and per-core CPU meters. Option A (kill) is incorrect because it only sends signals to terminate or control existing processes and does not display monitoring data. Option D (jobs) is incorrect because it merely lists jobs in the current shell session and shows no system resource usage. Option E (ps aux) is incorrect because it produces a static snapshot of processes at the moment of execution rather than continuous real-time monitoring.

Answer

kill

Answer

jobs

Answer

ps aux

Question 13

Match each Linux networking command to its purpose.

Accepted Answer

ping: Tests network connectivity to a remote host. Ping tests connectivity, netstat shows network statistics, ifconfig configures interfaces, nslookup performs DNS queries. Traceroute traces paths, and system IP is better shown by ifconfig or hostname -I.

Answer

ping: Used to trace the route packets take to a destination

Answer

netstat: Used to display the IP address of the system

Question 14

A security audit reveals that the /etc/shadow file has permissions 777. Which command should be used to correct this vulnerability?

Accepted Answer

chmod 600 /etc/shadow. The /etc/shadow file stores hashed user passwords and must be readable only by root to prevent unauthorized access. Permissions 777 allow any user to read, write, and execute the file, which is a critical security vulnerability. The correct command is `chmod 600 /etc/shadow`, which sets read and write permissions for the owner (root) only, denying all access to group and others.

Answer

chmod 660 /etc/shadow

Answer

chmod 644 /etc/shadow

Answer

chmod 640 /etc/shadow

Question 15

A system administrator notices that a Linux server is running low on disk space. Which command should be used to identify which directories are consuming the most space?

Accepted Answer

du -h /path | sort -rh. The `du -h /path | sort -rh` command recursively calculates disk usage for each directory under the specified path, displays sizes in human-readable format (`-h`), and then sorts the output in reverse numerical order (`-rh`), showing the largest directories first. This directly identifies which directories are consuming the most space, which is exactly what the system administrator needs.

Answer

ls -laR

Answer

find / -size +100M

Answer

df -h