XK0-005 Practice Test 15 — 15 Questions

Question 1

A user is trying to log in to a Linux server via SSH but receives 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic)'. The user's public key is in ~/.ssh/authorized_keys with proper permissions (600) and owned by the user. The server's sshd_config has 'PubkeyAuthentication yes' and 'PasswordAuthentication no'. What is the most likely additional cause?

Accepted Answer

The user's home directory has incorrect permissions (e.g., group-writable).. Option B is correct because SSH server's `StrictModes` (enabled by default) checks that the user's home directory is not group-writable or world-writable. If the home directory has group-write permission (e.g., 775), SSH refuses to trust `~/.ssh/authorized_keys` even if the file itself has 600 permissions. This is a security measure to prevent other group members from modifying the authorized_keys file indirectly.

Answer

The server's firewall is blocking port 22.

Answer

SELinux is blocking the key authentication.

Answer

The SSH server is not running.

Question 2

A Linux administrator is responsible for a critical application that runs as a systemd service on a server. The application occasionally hangs, and the administrator wants to automate the restart if the service becomes unresponsive. The administrator writes a Bash script that checks if the service is active and responsive by pinging a local health endpoint. If the health check fails three consecutive times, the script restarts the service. The script is intended to run every minute via a cron job. However, after implementing the cron job, the service is restarted even when it is functioning correctly, causing unnecessary downtime. The administrator reviews the script and finds the following logic:

#!/bin/bash
SERVICE="myapp"
COUNT_FILE="/tmp/${SERVICE}_failcount"
if curl -f http://localhost:8080/health; then
    echo 0 > "$COUNT_FILE"
else
    FAILS=$(cat "$COUNT_FILE" 2>/dev/null || echo 0)
    FAILS=$((FAILS + 1))
    echo "$FAILS" > "$COUNT_FILE"
    if [ "$FAILS" -ge 3 ]; then
        systemctl restart "$SERVICE"
        echo 0 > "$COUNT_FILE"
    fi
fi

What is the most likely cause of the false restarts?

Accepted Answer

Multiple instances of the script are running concurrently due to cron timing, causing a race condition on the count file.. Option B is correct because the cron job runs the script every minute, but if the health check takes longer than a minute (e.g., due to network latency or a slow endpoint), multiple instances of the script can overlap. Each instance reads, increments, and writes the count file independently, causing a race condition where the fail count can be artificially inflated, leading to a false restart even when the service is healthy.

Answer

The count file is not being written because the script lacks write permissions to /tmp.

Answer

The script does not reset the count file after a successful health check.

Answer

The script does not handle the case where the count file does not exist on the first failure.

Question 3

You are managing a containerized microservices environment using Podman. One of the services needs to access a PostgreSQL database running in a separate container. The database container is named 'db' and uses the default bridge network. The application container is launched with the command: podman run -d --name app --network host myapp. The application fails to connect to the database using the hostname 'db'. Which change should you resolve the issue?

Accepted Answer

Use a user-defined network and connect both containers. The default bridge network in Podman does not provide automatic DNS resolution between containers by name. When the app container uses `--network host`, it shares the host's network stack and is not connected to any container network, so it cannot resolve the container name 'db'. A user-defined network enables built-in DNS resolution, allowing containers to communicate by name. Connecting both containers to the same user-defined network resolves the connectivity issue.

Answer

Use --link db:db when running app container

Answer

Set environment variable DB_HOST=localhost

Answer

Run app container on the same network as db using --network bridge

Question 4

A company runs a critical web application on a Linux server. The server has 16GB RAM and 4 CPU cores. Recently, users have reported intermittent timeouts and slow response times. The administrator logs in and runs 'top', which shows the web server process using 200% CPU (multi-threaded) and 2GB RAM. Free memory is 12GB, and swap usage is 0. The load average is 3.5, 4.0, 4.2. The administrator checks 'dmesg' and sees no OOM or hardware errors. The web server logs show many 'connection refused' errors during peak times. The application is configured to handle up to 500 concurrent connections. The administrator suspects the issue is related to the number of worker processes or threads. Which of the following is the BEST course of action to resolve the issue?

Accepted Answer

Increase the number of worker processes or threads in the web server configuration.. The web server is using 200% CPU (multi-threaded) and has 12GB free RAM with no swap usage, indicating CPU is the bottleneck, not memory. The load average (3.5–4.2) exceeds the 4 CPU cores, meaning the system is overloaded with processes/threads. The 'connection refused' errors during peak times suggest the server is hitting its connection limit (500 concurrent connections) and rejecting new ones. Increasing worker processes/threads allows the server to handle more concurrent connections, utilizing the available CPU cores more efficiently to reduce timeouts and refusals.

Answer

Add more CPU cores by migrating to a larger instance.

Answer

Decrease the number of worker processes to reduce CPU load.

Answer

Add more RAM to the server.

Question 5

Refer to the exhibit. A Linux administrator created a systemd service file for a custom script. When starting the service, it fails with 'Unit myservice.service entered failed state.' Which of the following is the most likely cause?

Accepted Answer

The ExecStart path is relative. The most likely cause is that the ExecStart path is relative. Systemd requires absolute paths for ExecStart directives; a relative path (e.g., `./script.sh` or just `script.sh`) will cause the unit to fail immediately because systemd cannot resolve the executable location. The error 'entered failed state' typically results from this path resolution failure.

Answer

The service type should be forking

Answer

The service file lacks an [Install] section

Answer

The Requires directive is missing

Question 6

A system administrator is troubleshooting a bash script that fails when run from cron but works when run from the terminal. Which two factors could explain this behavior? (Select TWO.)

Accepted Answer

The script uses interactive commands. Option A is correct because interactive commands (e.g., `read`, `select`, or commands that require a TTY) fail when run from cron, as cron does not allocate a terminal. The script expects user input or terminal interaction, which is not available in the cron environment, causing it to hang or error out. Option E is correct because cron runs with a minimal PATH (often `/usr/bin:/bin`), so the script may fail to locate commands that are found in the user's interactive shell PATH (e.g., `/usr/local/bin`).

Answer

The script uses a different shell interpreter

Answer

The script uses absolute paths

Answer

The script runs with a different user ID

Question 7

An administrator needs to audit all write operations to the /etc/shadow file. Which audit rule should be added to /etc/audit/rules.d/audit.rules?

Accepted Answer

-w /etc/shadow -p wa. Option D is correct because the audit rule `-w /etc/shadow -p wa` uses the `-w` (watch) flag to monitor the file for write (`w`) and attribute change (`a`) permissions, which captures all write operations to `/etc/shadow`. This is the standard syntax for auditing file writes in Linux auditd, and it directly meets the requirement to audit write operations without unnecessary syscall filtering.

Answer

-w /etc/shadow -k identity

Answer

-w /etc/shadow -p rwxa

Answer

-a always,exit -S open -F path=/etc/shadow

Question 8

A shared directory requires that any new files created within it are automatically writable by the group. What umask value should be set for users working in this directory?

Accepted Answer

0002. Option C (0002) is correct because the umask subtracts permissions from the default 0666 for files. A umask of 0002 removes the 'write' permission for others (o-w), leaving the group with read/write (rw) and the owner with read/write (rw). This ensures new files are group-writable, as required for a shared directory.

Answer

0777

Answer

0027

Answer

0022

Question 9

Which tool is used for encrypting files with public-key cryptography on Linux systems?

Accepted Answer

GnuPG. GnuPG (GNU Privacy Guard) is the correct tool because it implements the OpenPGP standard (RFC 4880) for encrypting and signing files using public-key cryptography. It allows users to generate a key pair, encrypt a file with the recipient's public key, and decrypt it with the corresponding private key, making it the standard Linux utility for asymmetric file encryption.

Answer

bcrypt

Answer

LUKS

Answer

OpenSSL

Question 10

A systems administrator notices that users can successfully authenticate via SSH using their password, but cannot log in via the console. The /etc/securetty file exists and contains only the default entries. Which configuration change is most likely to resolve the issue?

Accepted Answer

Add 'console' to the /etc/securetty file. The /etc/securetty file lists TTY devices from which root is allowed to log in via console or terminal. By default, it often includes entries like 'tty1' through 'tty6' but not 'console'. Adding 'console' to this file permits root login from the system console, resolving the issue where console authentication fails while SSH (which bypasses /etc/securetty) succeeds.

Answer

Add the denyhosts service to block non-console logins

Answer

Set PermitRootLogin yes in /etc/ssh/sshd_config

Answer

Set SELinux to permissive mode

Question 11

What is the effect of the firewall rules shown?

Accepted Answer

SSH and ICMP echo-request are allowed; all other traffic is dropped.. The firewall rules shown explicitly allow SSH (port 22) and ICMP echo-request (type 8) traffic while the final default rule drops all other traffic. This matches option D, as the rules do not permit any other protocols or services, including loopback traffic unless it is SSH or ICMP echo-request.

Answer

Only SSH traffic to 192.168.1.10 is allowed; all other traffic is dropped.

Answer

Only SSH and loopback traffic are allowed; all other traffic is dropped.

Answer

All traffic on eth0 is allowed; loopback is allowed.

Question 12

A Red Hat Enterprise Linux 8 system is configured with SELinux in enforcing mode. A custom application needs to write to a file in /var/log. The audit log shows an AVC denial for httpd_t attempting to write to var_log_t. Which of the following is the most appropriate persistent solution?

Accepted Answer

Use semanage fcontext to define the default context for the file and then restorecon.. Option D is correct because semanage fcontext defines a persistent default SELinux file context rule, which survives file system relabeling. After defining the rule, restorecon applies the context to the file. This ensures the custom application's log file is labeled httpd_log_t, allowing httpd_t to write to it, while chcon (option C) only makes a temporary change that can be overwritten by restorecon or a relabel.

Answer

Set the SELinux boolean httpd_can_network_connect to on.

Answer

Change the ownership of the file to apache.

Answer

Use chcon to set the file context to httpd_log_t.

Question 13

An administrator needs to restrict SSH access to the server so that only a specific IP range (192.168.1.0/24) can connect, and password authentication is disabled. Which THREE steps must be taken?

Accepted Answer

Add a firewall rule: iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP. Option B is correct because it uses iptables to create a firewall rule that accepts SSH traffic (TCP port 22) only from the 192.168.1.0/24 subnet, followed by a catch-all rule that drops all other SSH traffic. This enforces network-level access control. Option D is correct because 'AllowUsers *@192.168.1.*' in sshd_config restricts SSH logins to users connecting from IP addresses matching that pattern, providing application-level filtering. Option E is correct because 'PasswordAuthentication no' disables password-based authentication, forcing the use of key-based or other non-password methods.

Answer

Set 'UsePAM yes' in sshd_config

Answer

Set 'PermitRootLogin without-password' in sshd_config

Question 14

A security policy requires that SSH access be allowed only from the internal management subnet 10.10.10.0/24. Which firewalld rich rule should be added?

Accepted Answer

firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.10.10.0/24" service name="ssh" accept'. Option B is correct because it uses the firewalld rich-rule syntax to explicitly define an IPv4 rule that accepts SSH traffic only from the 10.10.10.0/24 source subnet. Rich rules provide granular control over source addresses, services, and actions, which is required by the security policy. The `--add-rich-rule` option allows specifying the rule family, source address, service name, and accept action in a single, persistent rule.

Answer

firewall-cmd --permanent --add-port=22/tcp --add-source=10.10.10.0/24

Answer

firewall-cmd --add-source=10.10.10.0/24 --add-service=ssh

Answer

iptables -A INPUT -s 10.10.10.0/24 -p tcp --dport 22 -j ACCEPT

Question 15

A company is implementing a security policy that requires all files created in a shared directory /data to be owned by the group 'engineers' and have group read/write permissions, regardless of the user's umask. Which approach should be used?

Accepted Answer

Set the setgid bit and configure ACL default permissions on /data. Option D is correct because setting the setgid bit ensures new files inherit the group, and configuring ACL default entries sets the default permissions for new files. A is for deletion prevention, B alone doesn't set files' group, C alone doesn't set group inheritance.

Answer

Set the setgid bit only on /data

Answer

Set the sticky bit on /data

Answer

Configure ACL default permissions only on /data