XK0-006 Practice Test 17 — 15 Questions

Question 1

Which three are valid systemd unit types?

Accepted Answer

socket. B (socket), C (service), and D (timer) are all valid systemd unit types. A socket unit encapsulates a local IPC or network socket in the system for socket-based activation, a service unit describes a process controlled and supervised by systemd, and a timer unit provides a mechanism for triggering activation of other units based on time events. These are among the 12 standard systemd unit types defined in the systemd documentation.

Answer

process

Answer

job

Question 2

An administrator needs to extend the size of a logical volume named 'lv_data' in volume group 'vg_data' by 10 GB. A new disk /dev/sdb has been added to the system. What is the correct sequence of commands?

Accepted Answer

pvcreate /dev/sdb; vgextend vg_data /dev/sdb; lvextend -L +10G /dev/vg_data/lv_data. It follows the proper sequence for extending a logical volume when a new disk is added: first, initialize the new disk as a physical volume with pvcreate; second, add the physical volume to the volume group with vgextend; third, extend the logical volume by the desired size with lvextend. This order ensures the volume group has available physical extents before attempting to allocate them to the logical volume.

Answer

lvextend -L +10G /dev/vg_data/lv_data; vgextend vg_data /dev/sdb; pvcreate /dev/sdb

Answer

vgextend vg_data /dev/sdb; pvcreate /dev/sdb; lvextend -L +10G /dev/vg_data/lv_data

Answer

pvcreate /dev/sdb; lvextend -L +10G /dev/vg_data/lv_data; vgextend vg_data /dev/sdb

Question 3

A system administrator is troubleshooting a service that fails to start with the error 'Unit failed to load: Invalid argument'. The service file is located in /etc/systemd/system. What is the most likely cause?

Accepted Answer

The service file has a syntax error. The error 'Unit failed to load: Invalid argument' in systemd indicates that the unit file parser encountered a directive or value it could not interpret. This is most commonly caused by a syntax error in the service file, such as a misspelled key, an invalid setting, or a malformed line. Systemd validates the file structure against its grammar; any deviation triggers this specific error.

Answer

The service binary is missing

Answer

The service requires a dependency that is not installed

Answer

The service is masked

Question 4

An administrator needs to allow a user to run all commands as root without a password. Which sudoers entry accomplishes this?

Accepted Answer

user ALL=(ALL) NOPASSWD: ALL. The sudoers entry `user ALL=(ALL) NOPASSWD: ALL` grants the user permission to run any command as any user (including root) without being prompted for a password. The `NOPASSWD` tag overrides the default password requirement, and the `ALL` specifications cover the host list, target user list, and command list.

Answer

user ALL=(ALL) !ALL

Answer

user ALL=(ALL) PASSWD: ALL

Answer

user ALL=(ALL) ALL

Question 5

A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?

Accepted Answer

pam_faillock.so. pam_faillock.so is the modern PAM module designed to lock accounts after a configurable number of failed login attempts. It replaces the deprecated pam_tally2.so and is configured in /etc/pam.d/sshd or /etc/pam.d/system-auth with parameters like deny=3 to enforce the lockout threshold. It tracks failures per user and can automatically unlock accounts after a specified time.

Answer

pam_tally2.so

Answer

pam_pwquality.so

Answer

pam_unix.so

Question 6

An administrator is investigating a system that may have been compromised. The 'aide' database was created six months ago. After running 'aide --check', many files in /usr/bin are reported as changed. Which action should the administrator take first to identify the cause?

Accepted Answer

Compare the checksums with the original package manager database (rpm -V).. The AIDE database is six months old, so any changes to system binaries in /usr/bin since then would be flagged. The first step should be to verify whether these changes are legitimate (e.g., from package updates) or malicious by comparing the current file checksums against the RPM package manager's database using 'rpm -V'. This distinguishes expected updates from unauthorized modifications without relying on the outdated AIDE baseline.

Answer

Increase the verbosity of AIDE to see which attributes changed.

Answer

Update the AIDE database with 'aide --update'.

Answer

Restore the original files from backup.

Question 7

In bash, what is the difference between single quotes and double quotes?

Accepted Answer

Single quotes prevent variable expansion, double quotes allow it.. Single quotes preserve the literal value of each character, while double quotes allow variable expansion and command substitution.

Answer

Both allow variable expansion, but double quotes also allow globbing.

Answer

Single quotes allow variable expansion, double quotes do not.

Answer

There is no difference; they are interchangeable.

Question 8

A server has a volume group 'vg_data' with a single logical volume 'lv_data' of 100GB mounted at /data. The filesystem on lv_data is XFS. The administrator needs to extend it to 150GB. A new 60GB disk /dev/sdc has been added and partitioned as LVM. The administrator runs `pvcreate /dev/sdc1`, then `vgextend vg_data /dev/sdc1`, then `lvextend -L +50G /dev/vg_data/lv_data`. The administrator runs `df -h /data` and sees that the filesystem still shows 100GB. Which command should be run next?

Accepted Answer

xfs_growfs /data. After extending the logical volume with lvextend, the filesystem must be grown to use the additional space. For XFS filesystems, the command is xfs_growfs, which must be run on the mount point. The df output still shows 100GB because the filesystem has not been resized.

Answer

lvreduce -L -50G /dev/vg_data/lv_data

Answer

fsck /dev/vg_data/lv_data

Answer

resize2fs /dev/vg_data/lv_data

Question 9

An administrator needs to ensure that only users from the 'ops' group can SSH into a server. Which configuration in /etc/ssh/sshd_config accomplishes this?

Accepted Answer

AllowGroups ops. The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH access to only users who are members of the specified group. By setting `AllowGroups ops`, only users belonging to the 'ops' group will be permitted to log in via SSH, which directly meets the requirement.

Answer

Match Group ops DenyUsers *

Answer

AllowUsers ops

Answer

DenyUsers all

Question 10

A server running RHEL 8 has intermittent network connectivity. The administrator wants to view the current DNS resolver configuration. Which file should be examined?

Accepted Answer

/etc/resolv.conf. The /etc/resolv.conf file is the standard configuration file that lists the DNS nameservers (via 'nameserver' directives) and search domains used by the resolver. On RHEL 8, even when NetworkManager manages DNS, the effective resolver configuration is written to /etc/resolv.conf (often as a symlink to /run/NetworkManager/resolv.conf). Therefore, examining this file shows the current DNS resolver settings.

Answer

/etc/sysconfig/network-scripts/ifcfg-eth0

Answer

/etc/nsswitch.conf

Answer

/etc/hosts

Question 11

An administrator is troubleshooting a Kubernetes deployment that is not receiving traffic. The deployment has one replica and the pod is running. The service is of type ClusterIP. Which command would help verify that the service endpoints are correctly associated with the pod?

Accepted Answer

kubectl get endpoints. The 'kubectl get endpoints' command lists the Endpoints object for a service, showing the IP addresses and ports of the pods that back it. If the service selector does not match the pod labels, the endpoints list will be empty, immediately revealing the misconfiguration. This is the fastest way to verify service-to-pod association.

Answer

kubectl describe pod

Answer

kubectl get pods -o wide

Answer

kubectl get svc

Question 12

A developer wants to view the logs from a running Docker container named 'myapp'. Which docker command should be used?

Accepted Answer

docker logs myapp. The 'docker logs' command is specifically designed to fetch the logs from a container's stdout/stderr. Running 'docker logs myapp' will display the logs generated by the container named 'myapp'. This is the standard and correct way to view container logs.

Answer

docker ps myapp

Answer

docker exec myapp logs

Answer

docker inspect myapp

Question 13

A cron job runs a script that fails because the command 'myapp' is not found. The script works when run manually by the same user. What is the most likely cause?

Accepted Answer

The PATH environment variable is different. When a cron job runs, it executes with a minimal environment, typically inheriting only a limited PATH (often just /usr/bin:/bin). The 'myapp' command is not found because its location (e.g., /usr/local/bin) is not in cron's PATH. When the same user runs the script manually, their interactive shell sources profile files (like .bash_profile or .bashrc) that set a more complete PATH, including the directory containing 'myapp'. This discrepancy is the most common cause of such failures.

Answer

The user does not have a home directory

Answer

The cron daemon is not running

Answer

The script has syntax errors

Question 14

A Linux server experiences intermittent network connectivity issues. The administrator suspects a duplex mismatch. Which tool can best confirm duplex and speed settings on a network interface?

Accepted Answer

ethtool eth0. `ethtool eth0` is the standard Linux utility for querying and controlling network interface driver and hardware settings, including negotiated speed and duplex mode. It directly displays the current link status, speed (e.g., 1000Mb/s), and duplex (full/half), making it the best tool to confirm a duplex mismatch.

Answer

mii-tool eth0

Answer

dmesg | grep eth0

Answer

ip link show eth0

Question 15

An administrator needs to create a Docker image from a Dockerfile located in the current directory and tag it as 'myapp:v1'. Which command should be used?

Accepted Answer

docker build -t myapp:v1 .. The correct command is `docker build -t myapp:v1 .` because `docker build` reads a Dockerfile from the specified context (the `.` means the current directory) and builds an image. The `-t` flag tags the resulting image with the name and tag `myapp:v1`. This is the standard way to create an image from a Dockerfile.

Answer

docker create -t myapp:v1 .

Answer

docker commit myapp:v1 .

Answer

docker image create myapp:v1 .