XK0-006 Practice Test 14 — 15 Questions

Question 1

Which command is used to display the current process hierarchy in a tree format?

Accepted Answer

pstree. The pstree command displays running processes as a tree, showing parent-child relationships with branches, which is exactly what the question asks for. It reads process information from /proc and renders the hierarchy visually, optionally with -p to show PIDs and -u to show users. None of the other commands present the hierarchy in tree format.

Answer

lsproc

Answer

ps aux

Answer

top

Question 2

An administrator needs to generate a self-signed certificate and private key for a web server. Which openssl command accomplishes this?

Accepted Answer

openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365. It first generates a 2048-bit RSA private key using `openssl genrsa`, then uses `openssl req -new -x509` to create a self-signed X.509 certificate directly from that key, bypassing the need for a Certificate Signing Request (CSR). The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a CSR, and `-days 365` sets the validity period. This two-step process produces both the private key (`key.pem`) and the self-signed certificate (`cert.pem`) required for a web server.

Answer

openssl req -new -key key.pem -out csr.pem

Answer

openssl ca -in csr.pem -out cert.pem

Answer

openssl x509 -req -in csr.pem -signkey key.pem -out cert.pem

Question 3

A system administrator wants to find all files in /var/log that have been modified in the last 7 days and are larger than 100MB. Which command should be used?

Accepted Answer

find /var/log -mtime -7 -size +100M. The find command with -mtime -7 matches files modified within the last 7 days (the minus sign means 'less than 7 days ago'), and -size +100M matches files larger than 100MB (the plus sign means 'greater than'). This combination precisely satisfies both conditions.

Answer

find /var/log -mtime +7 -size +100M

Answer

find /var/log -atime -7 -size +100M

Answer

find /var/log -mtime -7 -size -100M

Question 4

A container is running a database service that requires persistent storage. The administrator wants to ensure that data persists even if the container is removed. Which volume mount type should be used in the Docker run command?

Accepted Answer

--mount type=volume. Docker volumes are the preferred mechanism for persisting data generated by and used by Docker containers. Volumes are completely managed by Docker, are independent of the container lifecycle, and can be backed up easily. They persist even after the container is removed, making them ideal for database services. While bind mounts (option B) also provide persistence by mapping a host directory, they are less portable and have security considerations. Since the question does not specify a need for host directory mapping, volumes are the recommended choice.

Answer

--mount type=bind

Answer

COPY in Dockerfile

Answer

--mount type=tmpfs

Question 5

Which log file typically records authentication failures and successes on a Debian-based system?

Accepted Answer

/var/log/auth.log. On Debian-based systems (including Ubuntu), /var/log/auth.log is the default log file where the system's authentication subsystem writes both successful and failed authentication events. It captures output from PAM, sudo, su, sshd, and other login-related services, making it the canonical place to audit who logged in or failed to log in. Because Debian's rsyslog configuration routes authpriv facility messages to this file, it is the correct answer for authentication success and failure records.

Answer

/var/log/messages

Answer

/var/log/syslog

Answer

/var/log/secure

Question 6

Based on the exhibit, what is the most likely cause of the sshd service failure?

Accepted Answer

The privilege separation directory /var/empty/sshd does not exist.. The error message 'Privilege separation directory /var/empty/sshd does not exist' directly indicates that the required chroot directory for the unprivileged sshd process is missing. Without this directory, sshd cannot drop privileges after authentication, causing it to fail on startup. This is a common issue after a partial installation or cleanup of OpenSSH.

Answer

The SSH configuration file has a syntax error.

Answer

The sshd PID file cannot be written.

Answer

The SSH port is already in use by another service.

Question 7

Which command will display the disk usage of each directory in the current directory, in human-readable format?

Accepted Answer

du -h. The `du -h` command displays disk usage for each directory in the current directory, with the `-h` flag converting sizes into human-readable formats (e.g., K, M, G). This is the correct tool for per-directory disk usage reporting.

Answer

fdisk -l

Answer

ls -lh

Answer

df -h

Question 8

An administrator runs 'auditctl -w /etc/passwd -p wa -k passwd_changes' to monitor changes to /etc/passwd. Which command should be used to search the audit log for all events related to this watch?

Accepted Answer

ausearch -k passwd_changes. The `ausearch -k passwd_changes` command is correct because it searches the audit log for events that were tagged with the key `passwd_changes` when the watch was created via `auditctl -w /etc/passwd -p wa -k passwd_changes`. The `-k` option in `auditctl` assigns a key to the rule, and `ausearch` uses that same key to filter and retrieve matching audit records from `/var/log/audit/audit.log`.

Answer

auditctl -l -k passwd_changes

Answer

tail -f /var/log/audit/audit.log | grep passwd_changes

Answer

aureport -k passwd_changes

Question 9

A systems administrator needs to automate the execution of a backup script every day at 2:00 AM using a systemd service. Which unit type should the administrator create?

Accepted Answer

A .timer unit. A .timer unit is the correct choice because systemd timers are designed to schedule and trigger the execution of other units (such as services) at specific times or intervals. By creating a .timer unit that activates at 2:00 AM daily and a corresponding .service unit for the backup script, the administrator can automate the backup using systemd's built-in scheduling mechanism, which is more reliable and integrated than cron for systemd-managed systems.

Answer

A .service unit

Answer

A .path unit

Answer

A .mount unit

Question 10

A process is consuming excessive CPU and needs to be stopped immediately. The process ID is 4582. Which command should be used?

Accepted Answer

kill -9 4582. The `kill -9 4582` command sends SIGKILL (signal 9) to process ID 4582, which forcibly terminates the process immediately without allowing it to clean up. This is the correct choice when a process is consuming excessive CPU and must be stopped immediately, as SIGKILL cannot be caught or ignored.

Answer

kill -1 4582

Answer

kill -STOP 4582

Answer

kill -15 4582

Question 11

Refer to the exhibit. A Docker container using a bind mount fails to start with a permission error. What is the most likely cause?

Accepted Answer

SELinux is blocking the mount.. When a Docker container uses a bind mount and fails with a permission error, SELinux is a common cause because it enforces mandatory access controls that can block container processes from accessing host files. By default, SELinux labels container processes with a confined domain (e.g., container_t), and if the bind-mounted host directory lacks the proper SELinux context (e.g., container_file_t), the mount is denied. This is resolved by adding the `:Z` or `:z` flag to the bind mount in the Docker run command to relabel the host directory appropriately.

Answer

The container is running in privileged mode.

Answer

The Docker daemon is not running as root.

Answer

The volume path on the host does not exist.

Question 12

A Bash script uses getopts to parse command-line options. The script is invoked as: ./script -a -b value. Which getopts string should be used to correctly parse -a (no argument) and -b (requires an argument)?

Accepted Answer

"ab:". In getopts, a colon after a letter indicates that the option requires an argument. The string 'ab:' means -a takes no argument and -b requires an argument. This matches the invocation './script -a -b value'.

Answer

":ab"

Answer

"ab"

Answer

"a:b"

Question 13

An administrator needs to verify DNS resolution for a web server. Which TWO commands can be used to query DNS A records for a given hostname? (Choose two.)

Accepted Answer

nslookup. Option B (nslookup) is correct because it is a dedicated DNS query tool that, by default, resolves a hostname to its A record (IPv4 address) by querying the configured DNS resolver, and it can also be used interactively to specify record types. Option D (dig) is correct because it is a DNS lookup utility that explicitly queries DNS records; running 'dig hostname A' returns the A record along with authoritative server and query details. Option A (traceroute) is incorrect because it maps the network path to a host using TTL-limited packets, not DNS record queries. Option C (ping) is incorrect because although it resolves a hostname to an IP via the resolver, it is an ICMP reachability test rather than a DNS query tool and does not let you query specific record types. Option E (curl -I) is incorrect because it sends an HTTP HEAD request to fetch response headers, not a DNS A record query.

Answer

traceroute

Answer

ping

Answer

curl -I

Question 14

A system administrator notices that a cron job runs every 5 minutes but should run only on weekdays. The current crontab entry is: */5 * * * * /usr/local/bin/script.sh. Which change to the time fields will restrict execution to Monday through Friday?

Accepted Answer

*/5 * * * 1-5 /usr/local/bin/script.sh. The fifth field in a crontab entry specifies the day of the week, where 1 represents Monday and 5 represents Friday. By setting this field to `1-5`, the cron job will only execute on weekdays, while the `*/5` in the minute field ensures it still runs every 5 minutes. The other fields remain as `*` to allow execution at any hour and any day of the month.

Answer

*/5 9-17 * * 1-5 /usr/local/bin/script.sh

Answer

*/5 * * * 1-6 /usr/local/bin/script.sh

Answer

5 * * * 1-5 /usr/local/bin/script.sh

Question 15

Drag and drop the steps to troubleshoot a network connectivity issue using common commands in the correct order.

Accepted Answer

Verify IP configuration (ip addr), check default gateway (ip route), test DNS resolution (nslookup), ping remote host (ping). Troubleshooting network connectivity should follow a logical progression from local to remote: first verify your own IP address and subnet mask, then check the default gateway, then test DNS resolution, and finally test connectivity to a remote host. This systematic approach helps isolate the root cause efficiently.

Answer

Verify IP configuration (ip addr), test DNS resolution (nslookup), check default gateway (ip route), ping remote host (ping)

Answer

Ping remote host (ping), verify IP configuration (ip addr), check default gateway (ip route), test DNS resolution (nslookup)

Answer

Check default gateway (ip route), verify IP configuration (ip addr), test DNS resolution (nslookup), ping remote host (ping)