XK0-005 Practice Test 13 — 15 Questions

Question 1

A Linux server with the IP address 192.168.1.100 is unable to communicate with other hosts on the same subnet 192.168.1.0/24. The administrator can ping the loopback address, but pinging 192.168.1.1 (the default gateway) fails. The output of `ip a` shows the eth0 interface has the correct IP and netmask. Which troubleshooting step should be performed next?

Accepted Answer

Check the routing table with ip route.. Since the server has the correct IP and netmask on eth0 but cannot ping the default gateway (192.168.1.1), the issue likely lies in the routing configuration. The `ip route` command displays the kernel routing table, including the default gateway entry; if the default route is missing or incorrect, traffic cannot reach the gateway. Checking the routing table is the logical next step before assuming physical or ARP-level problems.

Answer

Check the ARP cache with arp -a.

Answer

Replace the network cable.

Answer

Restart the network service.

Question 2

A financial services company runs a critical trading application on a Linux server. The application logs to /var/log/trade/app.log. Recently, the application has been crashing intermittently. The administrator suspects disk space issues. Upon checking, /var/log/trade is on a separate partition with 200 GB capacity, and df -h shows only 10% used. However, the administrator notices that log rotation is not working; the log file has grown to 50 GB and is still being written to. The administrator needs to immediately free up space without stopping the application, and also ensure proper log rotation is configured. Which command sequence should the administrator use?

Accepted Answer

Run 'logrotate -f /etc/logrotate.conf' to force rotation, then verify with 'df -h'.. Option B is correct because 'logrotate -f' forces an immediate log rotation without stopping the application, which frees disk space by compressing or removing the old log file and creating a new empty one. The administrator can then verify the freed space with 'df -h'. This approach solves both the immediate space issue and ensures proper rotation is configured for the future.

Answer

Run 'mv /var/log/trade/app.log /tmp' to move the file, then create a new empty log file, and check with 'df -h'.

Answer

Run 'systemctl stop trade && rm /var/log/trade/app.log && systemctl start trade' to stop the application, delete the log, and restart.

Answer

Run '> /var/log/trade/app.log' to truncate the log file, then check with 'df -h'.

Question 3

Refer to the exhibit. A user reports that the /var directory is not accessible. The system administrator checks the logical volumes and notices that the 'var' logical volume is not activated. Which command should be used to activate it?

Accepted Answer

lvchange -ay vg0/var. The `lvchange -ay vg0/var` command activates the specified logical volume by setting its activation flag to 'y' (yes). This is the correct way to bring an inactive LVM logical volume online so that it can be mounted and accessed.

Answer

lvextend -L+10g vg0/var

Answer

lvscan

Answer

lvcreate -a y vg0/var

Question 4

Given the Dockerfile in the exhibit, which best practice is being violated?

Accepted Answer

Not combining apt-get update and install in one RUN command. The Dockerfile violates the best practice of combining `apt-get update` and `apt-get install` in a single RUN command. When these are separated, Docker caches the layer from `apt-get update`, so subsequent builds may use a stale package index, potentially installing outdated or vulnerable packages. Combining them ensures that the update and install happen atomically, reducing image size and guaranteeing a fresh package index.

Answer

Using a non-LTS base image

Answer

Not using a .dockerignore file

Answer

Running apt-get update without cache cleanup

Question 5

A user can access a web server on this Linux system via HTTPS but cannot connect via SSH. Based on the exhibit, what is the most likely cause?

Accepted Answer

The firewall is missing a rule to allow SSH traffic.. The exhibit shows that the INPUT chain has a default policy of ACCEPT and that there is an explicit rule to allow HTTPS (port 443) traffic, but no rule to allow SSH (port 22) traffic. Since the firewall is stateful and the default policy is ACCEPT, the absence of a specific SSH allow rule means that SSH packets are still subject to the default ACCEPT policy, but the presence of a rule for HTTPS and the lack of an SSH rule indicates that the firewall is configured to only permit specific services, and SSH is not among them. Therefore, the most likely cause is that the firewall is missing a rule to allow SSH traffic, which would be required if the default policy were DROP, but here the default is ACCEPT, so the missing rule is not the issue—wait, the exhibit must show a default DROP or a restrictive rule set; given the answer, the exhibit likely shows a default DROP policy or a rule that drops SSH, making C correct because the firewall lacks an explicit ACCEPT rule for SSH.

Answer

The SSH service is not running.

Answer

The eth0 interface is down.

Answer

The INPUT chain default policy is DROP.

Question 6

An administrator wants to ensure a critical monitoring script runs every day at 2 AM and sends output to a log file. Which THREE items are essential in the crontab entry? (Select THREE.)

Accepted Answer

SHELL=/bin/bash. Option A is correct because the SHELL variable in a crontab entry defines which shell interpreter is used to execute the cron job. By default, cron uses /bin/sh, but setting SHELL=/bin/bash ensures that bash-specific syntax, aliases, and features (such as [[ ]] or source) are available for the monitoring script. Without this, the script might fail if it relies on bash extensions.

Answer

RUNLEVEL=3

Answer

MAILTO=admin@example.com

Question 7

You are a DevOps engineer managing a Git repository for a large development team. Your CI/CD pipeline runs automated tests on every push. Recently, developers have been pushing commits that break the build. You need to enforce that all commits pass the tests before being pushed to the remote repository. Which Git hook should you implement on the client side?

Accepted Answer

pre-push. The pre-push hook (option D) runs after a `git push` command is issued but before the data is actually sent to the remote repository. This allows you to run tests locally and abort the push if they fail, enforcing that only commits that pass tests are pushed. It is the correct client-side hook for this requirement.

Answer

pre-receive

Answer

pre-commit

Answer

post-commit

Question 8

Refer to the exhibit. The administrator receives an email that a cron job failed. What is the most likely cause?

Accepted Answer

The script has an unmatched if statement.. The cron job failed because the script contains an unmatched if statement, which causes a syntax error when the shell interprets the script. Cron jobs execute scripts in a non-interactive shell, and any syntax error will cause the script to exit with a non-zero status, triggering the failure email. The unmatched if statement prevents the script from completing execution, leading to the reported failure.

Answer

The script is not executable.

Answer

The script is missing a shebang line.

Answer

The cron daemon is not running.

Question 9

Which THREE are best practices for securing a Linux server? (Choose exactly three.)

Accepted Answer

Use a host-based firewall. A host-based firewall (e.g., iptables, nftables, or firewalld) controls incoming and outgoing traffic at the server level, enforcing least-privilege network access. By default, it can block all traffic except explicitly allowed services (e.g., SSH on port 22, HTTPS on port 443), reducing the attack surface. This is a fundamental security control to prevent unauthorized network connections.

Answer

Enable root SSH login with password

Answer

Set default umask to 0777

Question 10

An Apache web server hosted on a Linux system is unable to connect to a backend database server on port 3306. Based on the exhibit, which action should the administrator take to resolve the issue?

Accepted Answer

Set the httpd_can_network_connect boolean to on.. The Apache web server cannot connect to the backend database server on port 3306 because SELinux is blocking the outbound network connection. The boolean `httpd_can_network_connect` controls whether the httpd daemon is allowed to initiate outbound TCP connections to remote hosts. Setting this boolean to `on` permits Apache to connect to the database server, resolving the connectivity issue without disabling SELinux entirely.

Answer

Disable SELinux by setting SELINUX=disabled in /etc/selinux/config.

Answer

Enable the httpd_enable_home_dirs boolean.

Answer

Change the SELinux context of the index.html file to httpd_sys_content_t.

Question 11

A Linux server is configured to use Pluggable Authentication Modules (PAM). Which file is used to define the authentication order for the 'sshd' service?

Accepted Answer

/etc/pam.d/sshd. In Linux, PAM configuration files for individual services are stored in /etc/pam.d/, with the filename matching the service name. For the sshd service, the file /etc/pam.d/sshd defines the authentication order, including the modules and their control flags (e.g., required, sufficient) that PAM will consult during SSH login. This is the standard location per the Linux PAM architecture, as documented in the pam.conf man page.

Answer

/etc/authselect/sshd

Answer

/etc/security/sshd

Answer

/etc/pam.d/login

Question 12

Which THREE tools are commonly used for configuration management?

Accepted Answer

Chef. Chef is a configuration management tool that uses a Ruby-based DSL to define system configurations as 'recipes' and 'cookbooks'. It follows a pull-based model where nodes run the Chef client to fetch and apply configurations from a Chef server, ensuring desired state compliance across infrastructure.

Answer

Kubernetes

Answer

Docker

Question 13

A web server is experiencing high load. The administrator wants to identify the processes consuming the most CPU. Which TWO commands can be used to display real-time process CPU usage?

Accepted Answer

top. Option D (top) is correct because it provides a real-time, dynamic view of system processes, including CPU usage, and updates continuously by default. Option E (ps aux --sort=-%cpu) is also correct because it lists all processes sorted by CPU usage in descending order, though it is a snapshot rather than continuous; however, the question asks for commands that can be used to display real-time process CPU usage, and ps with the --sort flag can be run repeatedly to approximate real-time monitoring.

Answer

lsof

Answer

iostat

Answer

vmstat

Question 14

A container started with the above Compose configuration fails to set the system time (clock_settime syscall). Which additional capability is required?

Accepted Answer

SYS_TIME. The `clock_settime` syscall requires the `SYS_TIME` capability to modify the system clock. In Docker Compose, capabilities are added via the `cap_add` directive, and without `SYS_TIME`, the container lacks the privilege to change the system time, resulting in a failure.

Answer

SYS_NICE

Answer

SYS_RESOURCE

Answer

SYS_CLOCK

Question 15

A system administrator installs a new application that is failing to write to its configuration file in /etc. SELinux is enforcing. Which command would show the relevant SELinux denials?

Accepted Answer

ausearch -m avc -ts recent. The `ausearch -m avc -ts recent` command queries the audit log for AVC (Access Vector Cache) denial messages, which are the specific SELinux denials logged when a process is blocked from accessing a resource. This is the direct way to view recent SELinux denials in an enforcing mode environment, as it filters audit records by message type (AVC) and time range (recent).

Answer

sealert

Answer

getenforce

Answer

audit2why