XK0-006 Practice Test 15 — 15 Questions

Question 1

A security policy requires that user passwords must expire after 90 days. The output in the exhibit shows the current configuration for the root user. Which command should the administrator run to enforce the policy for root?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

sudo chage -M 90 root. The `chage -M 90 root` command sets the maximum number of days a password is valid for the root user to 90 days, which directly enforces the password expiration policy. The `-M` option modifies the `max_days` field in `/etc/shadow`, causing the password to expire after the specified period. This is the correct method to apply aging rules to the root account.

Answer

sudo passwd -x 90 root

Answer

sudo chage -E 90 root

Answer

sudo usermod -e 90 root

Question 2

An administrator notices repeated failed login attempts in /var/log/secure. The company policy requires account lockout after 5 failed attempts within 15 minutes. Which PAM module and configuration can enforce this?

Accepted Answer

pam_faillock.so with deny=5 unlock_time=900. Pam_faillock.so is the PAM module specifically designed to track failed login attempts and enforce account lockout policies. The `deny=5` parameter sets the threshold to 5 failures, and `unlock_time=900` sets the lockout duration to 900 seconds (15 minutes), matching the policy requirement exactly.

Answer

pam_unix.so with remember=5

Answer

pam_pwquality.so with minlen=5

Answer

pam_limits.so with maxlogins=5

Question 3

A system administrator needs to add an iptables rule to drop incoming TCP traffic on port 22 (SSH) from the IP address 10.0.0.100. Which command should be used?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.100 -j DROP. iptables -A INPUT -p tcp --dport 22 -s 10.0.0.100 -j DROP is correct because it appends a rule to the INPUT chain that matches TCP packets destined for port 22 (SSH) from source IP 10.0.0.100 and drops them. This precisely implements the requirement to block incoming SSH traffic from that specific IP address. The -p tcp specifies the protocol, --dport 22 matches the destination port, and -s sets the source address.

Answer

iptables -A INPUT -p udp --dport 22 -s 10.0.0.100 -j DROP

Answer

iptables -I OUTPUT -p tcp --sport 22 -d 10.0.0.100 -j DROP

Answer

iptables -A FORWARD -p tcp --dport 22 -s 10.0.0.100 -j DROP

Question 4

An administrator wants to find all files in /var/log that have been modified within the last 2 days and have a .log extension. Which command should be used?

Accepted Answer

find /var/log -type f -mtime -2 -name "*.log". The find command with -mtime -2 finds files modified less than 2 days ago, and -name '*.log' matches the extension.

Answer

find /var/log -mtime 2 -name *.log

Answer

locate --mtime -2 *.log /var/log

Answer

ls -la /var/log | grep "\.log$" | head -20

Question 5

Which command is used to create a symbolic link named 'link' pointing to the file 'original'?

Accepted Answer

ln -s original link. ln -s creates a symbolic link.

Answer

symlink original link

Answer

ln -s link original

Answer

ln original link

Question 6

Based on the exhibit, which statement is true about the sshd service?

Accepted Answer

The service is not enabled to start at boot.. The exhibit shows the output of `systemctl status sshd.service`. The line `Loaded: loaded (/usr/lib/systemd/system/sshd.service; disabled; vendor preset: enabled)` indicates the service is currently loaded but its enablement state is `disabled`, meaning it is not configured to start automatically at boot. The `Active: active (running)` line with a PID confirms the service is currently running, but the question asks about boot-time behavior, which is governed by the `disabled` state. Therefore, option D is correct.

Answer

The service is masked.

Answer

The service is inactive.

Answer

The service has exited.

Question 7

A Linux engineer is troubleshooting a server that fails to boot. The server displays a message indicating 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which TWO actions should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Boot from a rescue disk and rebuild the initramfs with the necessary filesystem modules. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' means the kernel cannot locate or mount the root filesystem, which typically stems from a missing/incorrect root= kernel parameter or an initramfs lacking the driver for the root device. Option B is correct because booting from a rescue disk and rebuilding the initramfs (e.g., with dracut or mkinitramfs) restores the storage/filesystem modules the kernel needs to access the root device at early boot. Option D is correct because verifying and fixing the root= parameter in the bootloader configuration (e.g., GRUB's /etc/default/grub or grub.cfg) ensures the kernel is pointed at the actual root device (such as /dev/mapper/vg-root or UUID=...). Option A is not appropriate because reinstalling GRUB to the MBR only fixes bootloader-stage problems, not a kernel that has already loaded but cannot mount root. Option C is not the primary fix here since fsck addresses filesystem corruption, not an unknown-block root device error. Option E is unrelated because disabling SELinux does not resolve the kernel's inability to mount the root filesystem.

Answer

Reinstall GRUB to the Master Boot Record

Answer

Run fsck on the root partition to check for filesystem corruption

Answer

Disable SELinux by adding selinux=0 to the kernel command line

Question 8

During peak hours, a web server experiences timeouts. The kernel log shows 'possible SYN flooding'. Which kernel parameter should be increased to mitigate this?

Accepted Answer

net.ipv4.tcp_max_syn_backlog. The kernel log message 'possible SYN flooding' indicates that the system's SYN backlog queue is full, causing new connection requests to be dropped. Increasing `net.ipv4.tcp_max_syn_backlog` expands the maximum number of SYN requests that can be queued before the kernel starts dropping them, directly mitigating the issue.

Answer

net.ipv4.tcp_syncookies

Answer

net.core.somaxconn

Answer

net.core.rmem_default

Question 9

A security audit reveals that the system's PAM configuration does not enforce password complexity. Which PAM module and configuration line should be added to /etc/pam.d/common-password to require at least one uppercase letter, one digit, and a minimum length of 12 characters?

Accepted Answer

password requisite pam_pwquality.so minlen=12 ucredit=-1 dcredit=-1. The pam_pwquality.so module is the modern replacement for pam_cracklib.so and provides password quality enforcement. The line 'password requisite pam_pwquality.so minlen=12 ucredit=-1 dcredit=-1' correctly sets the minimum length to 12 and requires at least one uppercase letter (ucredit=-1) and one digit (dcredit=-1). The 'requisite' control ensures that if this module fails, the password change is rejected immediately.

Answer

password sufficient pam_faillock.so minlen=12 ucredit=-1 dcredit=-1

Answer

password required pam_cracklib.so minlen=12 ucredit=-1 dcredit=-1

Answer

password required pam_unix.so minlen=12 ucredit=-1 dcredit=-1

Question 10

A database server is running slow. The administrator uses iostat and notices high await times on the disk. Which of the following best explains the implication of high await?

Accepted Answer

Disk I/O requests are taking a long time to complete.. In iostat, 'await' measures the average time (in milliseconds) for I/O requests to be served by the disk, including time spent in the queue and the actual service time. A high await value indicates that disk I/O requests are taking a long time to complete, which directly explains the database server's slowness due to disk latency.

Answer

The CPU is waiting too long for memory access.

Answer

The disk is almost full, causing fragmentation.

Answer

The network filesystem is experiencing latency.

Question 11

A database server is experiencing slow queries. The administrator wants to analyze system memory usage. Which command shows memory usage in megabytes and includes information about buffers and cache?

Accepted Answer

free -m. The 'free -m' command displays system memory usage in megabytes, explicitly showing separate columns for buffers and cache, which are critical for diagnosing slow queries caused by memory pressure. This makes it the correct choice for the administrator's need to analyze memory usage with buffer/cache details in MB.

Answer

top -b

Answer

cat /proc/meminfo

Answer

vmstat

Question 12

A user cannot delete a file owned by another user on a shared filesystem. The file's permissions are 644, and the directory has permissions 777 with the sticky bit set. Which action would allow the user to delete the file?

Accepted Answer

Remove the sticky bit from the directory. The directory has permissions 777, meaning all users have read, write, and execute permissions. Write permission on the directory is required to delete files. However, the sticky bit prevents users from deleting files they do not own, even if they have write permission on the directory. Removing the sticky bit (option B) removes this restriction, allowing the user to delete the file.

Answer

Change the directory's group to include the user

Answer

Add write permission for others on the file

Answer

Change the file's group to match the user's group

Question 13

An Ansible playbook fails with a syntax error. Which command validates the playbook syntax without running it?

Accepted Answer

ansible-playbook --syntax-check. The `--syntax-check` flag is a built-in option of `ansible-playbook` that parses the YAML file and validates its syntax without executing any tasks. This is the correct tool for catching syntax errors in a playbook before running it.

Answer

ansible-lint playbook.yml

Answer

ansible-playbook --check

Answer

ansible-playbook --validate

Question 14

A Linux administrator needs to configure a firewall to allow incoming SSH connections only from the 192.168.1.0/24 subnet. The current iptables INPUT policy is ACCEPT. Which set of rules should be added?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP. Iptables processes rules in order, and the first matching rule determines the action. By placing the ACCEPT rule for the 192.168.1.0/24 subnet first, SSH traffic from that subnet is accepted. The subsequent DROP rule for port 22 then denies all other SSH traffic. This ensures that only the specified subnet can connect, while the default ACCEPT policy on the INPUT chain would otherwise allow all traffic if no rule matched.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j DROP

Answer

iptables -I INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Question 15

A system administrator wants to automate server configuration and management across multiple Linux hosts. Which TWO tools are configuration management solutions designed for this purpose? (Choose two.)

Accepted Answer

Puppet. Puppet (D) is a declarative configuration management tool that uses a master-agent architecture with manifests and modules to enforce desired state across many Linux hosts, making it a correct fit for automating server configuration and management. Ansible (E) is also a configuration management solution that uses agentless SSH connections and YAML playbooks to push configuration and orchestrate tasks across multiple hosts, so it is correct as well. Docker (A) is a containerization platform for packaging and running applications, not a configuration management tool for enforcing host configuration. Nagios (B) is a monitoring and alerting system, not a configuration management solution. Kubernetes (C) is a container orchestration platform for deploying and managing containerized workloads, not a general Linux configuration management tool.

Answer

Docker

Answer

Nagios

Answer

Kubernetes