XK0-006 Practice Test 15 — 15 Questions

Question 1

An administrator needs to permanently mount an ext4 filesystem on /dev/sdb1 to the /data directory. Which file must be edited to ensure the mount persists across reboots?

Accepted Answer

/etc/fstab. /etc/fstab contains filesystem mount points and options that are automatically mounted at boot.

Answer

/etc/sysconfig/network

Answer

/etc/default/grub

Answer

/etc/mtab

Question 2

A security policy requires that all users must have passwords with at least one uppercase letter, one digit, and a minimum length of 12 characters. Which PAM configuration file and module should be used to enforce this?

Accepted Answer

/etc/pam.d/common-password with pam_pwquality.so. pam_pwquality is used for password complexity requirements. It is typically configured in /etc/pam.d/common-password (or system-auth, password-auth) with options like minlen, ucredit, dcredit.

Answer

/etc/pam.d/login with pam_securetty.so

Answer

/etc/pam.d/sshd with pam_unix.so

Answer

/etc/pam.d/sudo with pam_permit.so

Question 3

A system administrator needs to add an iptables rule to drop incoming TCP traffic on port 22 (SSH) from the IP address 10.0.0.100. Which command should be used?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.100 -j DROP. The correct syntax is iptables -A INPUT -p tcp --dport 22 -s 10.0.0.100 -j DROP. The chain is INPUT, protocol tcp, destination port 22, source IP, and target DROP.

Answer

iptables -A INPUT -p udp --dport 22 -s 10.0.0.100 -j DROP

Answer

iptables -I OUTPUT -p tcp --sport 22 -d 10.0.0.100 -j DROP

Answer

iptables -A FORWARD -p tcp --dport 22 -s 10.0.0.100 -j DROP

Question 4

A Linux administrator needs to identify which of the following filesystems are journaling filesystems commonly used in Linux. (Choose three.)

Accepted Answer

ext4. ext4, xfs, and btrfs are journaling filesystems. FAT32 is not journaling. swap is a swap space, not a filesystem.

Answer

swap

Answer

FAT32

Question 5

A system administrator wants to find all files in /var/log that have been modified in the last 7 days and are larger than 100MB. Which command should be used?

Accepted Answer

find /var/log -mtime -7 -size +100M. The -mtime -7 finds files modified within 7 days, -size +100M finds files larger than 100MB.

Answer

find /var/log -mtime +7 -size +100M

Answer

find /var/log -atime -7 -size +100M

Answer

find /var/log -mtime -7 -size -100M

Question 6

A security auditor notices that users can set weak passwords on a Linux system. The administrator wants to enforce password complexity requiring a minimum of 12 characters, at least one uppercase letter, and at least one digit. Which PAM module should be configured in /etc/pam.d/common-password?

Accepted Answer

pam_pwquality.so. pam_pwquality provides password strength checking with parameters like minlen, ucredit, dcredit. The other modules do not handle complexity.

Answer

pam_unix.so

Answer

pam_tally2.so

Answer

pam_faillock.so

Question 7

An administrator wants to set an SELinux boolean that allows Apache to connect to databases. After setting the boolean, which option ensures the change persists across reboots?

Accepted Answer

setsebool -P httpd_can_network_connect_db on. setsebool -P makes the change permanent. Without -P, it only lasts until reboot.

Answer

setenforce 1

Answer

setsebool httpd_can_network_connect_db on

Answer

semanage boolean -m --on httpd_can_network_connect_db

Question 8

A system running systemd is failing to boot properly. The administrator wants to boot into an environment with only the essential services for troubleshooting. Which systemd target should be selected at boot?

Accepted Answer

rescue.target. rescue.target starts a minimal system with root filesystem mounted read-only and basic services.

Answer

multi-user.target

Answer

emergency.target

Answer

graphical.target

Question 9

SELinux is currently in enforcing mode. A service is being blocked by SELinux. Which command can analyze the audit log and suggest the minimum policy changes to allow the service?

Accepted Answer

audit2allow. audit2allow reads audit messages and generates policy modules to allow the denied actions.

Answer

ausearch

Answer

setsebool

Answer

restorecon

Question 10

Which log file typically records authentication failures and successes on a Debian-based system?

Accepted Answer

/var/log/auth.log. On Debian/Ubuntu, /var/log/auth.log records authentication events. On RHEL/CentOS, it's /var/log/secure.

Answer

/var/log/messages

Answer

/var/log/syslog

Answer

/var/log/secure

Question 11

A company runs a web application on a Linux server (Ubuntu 22.04). The application writes log files to /var/log/app/access.log and error.log. Over time, these logs have grown to several gigabytes, causing the /var partition to reach 98% capacity. The administrator decides to implement log rotation using logrotate. They create a configuration file at /etc/logrotate.d/app with the following content:

/var/log/app/*.log {
    weekly
    rotate 7
    compress
    delaycompress
    size 100M
    missingok
}

They then run `logrotate -d /etc/logrotate.d/app` for debugging, which indicates no errors. However, after several days, the logs are not being rotated. Which step should the administrator take to resolve this?

Accepted Answer

Ensure that the logrotate cron job is enabled and that the configuration file is readable (644) and owned by root.. The most likely cause is that the logrotate cron job (typically /etc/cron.daily/logrotate) is not enabled or not running, or the configuration file has incorrect permissions. The administrator should verify that the cron job is active and that the config file is readable (644) and owned by root so that the cron process can execute it daily. Option B (changing ownership of /var/log/app) is unnecessary because logrotate runs as root and can read any file. Option C (forcing rotation with -f) only rotates logs once and does not fix the underlying scheduling issue. Option D (adding an hourly cron job) is excessive; logrotate is designed to run daily, and hourly rotation would be inappropriate for weekly rotation with size constraints.

Answer

Change the ownership of /var/log/app to appuser:appgroup.

Answer

Run `logrotate -f /etc/logrotate.d/app` to force rotation immediately.

Answer

Add a cron job to run logrotate hourly.

Question 12

A cron job scheduled by the root user is not executing. Which file is the most likely location for the root user's personal cron table?

Accepted Answer

/var/spool/cron/root. On Linux systems, each user's personal crontab file is stored in /var/spool/cron/ (or /var/spool/cron/crontabs/ on some distributions). For the root user, this file is typically named 'root' (i.e., /var/spool/cron/root). When the root user runs 'crontab -e', the cron daemon reads from this file to execute scheduled tasks. If this file is missing or misconfigured, the root user's cron jobs will not run.

Answer

/var/spool/cron/crontabs

Answer

/etc/crontab

Answer

/etc/cron.d

Question 13

A user reports that they cannot access a website by domain name but can access it by IP address. Which of the following is the most likely cause?

Accepted Answer

DNS resolution problem. The user can access the website by IP address but not by domain name, which directly indicates that the system is unable to resolve the domain name to its corresponding IP address. This is a classic symptom of a DNS resolution problem, where the DNS client cannot query a DNS server or the DNS server fails to return the correct A or AAAA record. The fact that the web server is reachable by IP confirms that network connectivity and the web service itself are functioning correctly.

Answer

Web server is down

Answer

Firewall blocking port 80

Answer

Incorrect default gateway

Question 14

A Linux administrator needs to find which process is using a specific file. Which command provides this information?

Accepted Answer

lsof /path/to/file. The `lsof` command (List Open Files) is the correct tool to identify which process is using a specific file. When invoked with a file path as an argument, `lsof` displays the PID, process name, and other details of any process that has the file open. This directly answers the administrator's need to find the process using that file.

Answer

fuser /path/to/file

Answer

strace /path/to/file

Answer

ltrace /path/to/file

Question 15

Refer to the exhibit. A system administrator notices that /var/log is nearly full. Which configuration change would resolve the issue and prevent recurrence?

Accepted Answer

Decrease the size threshold from 100M to 50M.

Answer

Add the 'delaycompress' option to the logrotate config.

Answer

Remove the postrotate script to avoid restarting syslog.

Answer

Increase the rotate count from 4 to 7.