XK0-006 Practice Test 19 — 15 Questions

Question 1

A Linux administrator is troubleshooting a slow system. They decide to use vmstat to get an overall picture. Which two of the following fields in vmstat output are most directly related to CPU performance issues? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

sy (system CPU time). The 'us' field shows user time, 'sy' shows system time, 'id' shows idle, and 'wa' shows I/O wait. High 'us' or 'sy' can indicate CPU-bound issues.

Answer

id (idle time)

Answer

wa (I/O wait time)

Answer

r (run queue)

Question 2

A web server is not responding on port 443. Using tcpdump to capture traffic on the server, which filter would capture only HTTPS packets?

Accepted Answer

tcpdump -i any tcp port 443. Port 443 is HTTPS. The filter 'port 443' captures traffic on that port.

Answer

tcpdump -i any port https

Answer

tcpdump -i any host 443

Answer

tcpdump -i any udp port 443

Question 3

A Linux administrator is troubleshooting a slow web server. They suspect high disk I/O. Which TWO commands can be used to monitor disk I/O statistics?

Accepted Answer

iostat -x 1. iostat directly reports disk I/O stats; sar can collect and report I/O statistics historically.

Answer

free -h

Answer

vmstat 1

Answer

lsof

Question 4

A system is running slowly and the administrator suspects a memory leak. Which THREE commands or tools can be used to analyze memory usage and identify processes consuming excessive memory? (Choose three.)

Accepted Answer

ps aux --sort=-%mem. free shows overall memory. ps can sort by RSS. vmstat shows memory stats. iostat is disk I/O. strace traces system calls, not memory usage directly.

Answer

strace -p PID

Answer

iostat -x

Question 5

Which command shows the IP address, link status, and other configuration details for all network interfaces on a Linux system?

Accepted Answer

ip addr. ip addr shows IP addresses and link information for all interfaces.

Answer

nmcli dev status

Answer

cat /etc/network/interfaces

Answer

ifconfig -a

Question 6

A company's web server running Apache on CentOS 7 has been compromised. The attacker exploited a vulnerability in the web application and gained access to the system as the 'apache' user. The administrator wants to prevent similar attacks in the future by hardening the server. Currently, the Apache process runs as the 'apache' user and can execute arbitrary code. The administrator considers enabling SELinux with targeted policy to confine the httpd daemon. However, after setting SELinux to enforcing and installing the 'httpd' SELinux package, the web server fails to serve pages over HTTPS. The administrator checks the audit log (/var/log/audit/audit.log) and sees denials related to port binding. What is the most likely cause of the issue?

Accepted Answer

The port 443 is not labeled with the http_port_t type; use semanage port -a -t http_port_t -p tcp 443. The issue is that SELinux is blocking Apache from binding to port 443 because that port is not labeled with the http_port_t type. By default, SELinux only allows httpd to bind to ports that have the http_port_t context (e.g., 80, 443, 8080). If port 443 lacks this label, the httpd process will be denied permission to bind, even though the firewall may allow it. The administrator must use `semanage port -a -t http_port_t -p tcp 443` to assign the correct SELinux port type.

Answer

The SSL certificate files have incorrect SELinux context (e.g., httpd_sys_content_t instead of cert_t)

Answer

The httpd binary must have the httpd_exec_t context

Answer

The boolean httpd_enable_homedirs must be enabled to allow HTTPS

Question 7

A technician wants to check the disk I/O statistics, focusing on the average I/O wait time and utilization percentage. Which command provides this information?

Accepted Answer

iostat -x. iostat displays disk I/O statistics including %util (utilization) and await (average I/O wait time).

Answer

sar -b

Answer

vmstat -d

Answer

free -h

Question 8

Which command is used to trace the network path to a destination host, showing each hop along the way, and is similar to traceroute but does not require root privileges by default?

Accepted Answer

tracepath. tracepath is similar to traceroute but uses UDP probes and does not require root, making it more accessible.

Answer

ip route

Answer

mtr

Answer

ping

Question 9

An administrator wants to check the amount of free memory and swap usage on a system in a human-readable format. Which command should be used?

Accepted Answer

free -h. free -h displays memory and swap usage in human-readable units (e.g., GiB).

Answer

vmstat -h

Answer

cat /proc/meminfo

Answer

iostat -h

Question 10

A security audit reveals that the /var/log directory has permissions 777. The administrator needs to ensure that only root can write to log files, while still allowing users to read system log files. Which command should the administrator run?

Accepted Answer

chmod 755 /var/log. Chmod 755 sets the /var/log directory to rwxr-xr-x, meaning root (owner) has full write access, while group and others have read and execute permissions. This allows users to read log files (via execute to traverse the directory) but prevents them from writing, satisfying the audit requirement.

Answer

chmod 644 /var/log

Answer

chmod 700 /var/log

Answer

chmod 750 /var/log

Question 11

A system fails to boot with a kernel panic. The administrator wants to recover by accessing a root shell. Which THREE methods can be used to achieve this?

Accepted Answer

Append 'single' to the kernel command line in GRUB. Appending 'single' to the kernel command line in GRUB instructs the kernel to boot into single-user mode, which provides a root shell without requiring a password. This is a standard method for recovering from a kernel panic by allowing the administrator to repair filesystems or troubleshoot boot issues.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Press 'e' in GRUB and remove 'quiet'

Question 12

Which THREE are best practices for securing a Linux server? (Choose exactly three.)

Accepted Answer

Use a host-based firewall. A host-based firewall (e.g., iptables, nftables, or firewalld) controls incoming and outgoing traffic at the server level, enforcing least-privilege network access. By default, it can block all traffic except explicitly allowed services (e.g., SSH on port 22, HTTPS on port 443), reducing the attack surface. This is a fundamental security control to prevent unauthorized network connections.

Answer

Enable root SSH login with password

Answer

Set default umask to 0777

Question 13

A Linux server in a DMZ is experiencing intermittent SSH lockouts. The /var/log/secure shows repeated failed login attempts from multiple IP addresses, but then suddenly the administrator cannot SSH in even with correct credentials. The administrator suspects a brute-force protection mechanism. The server uses PAM with pam_tally2 for login counting. The administrator checks /etc/pam.d/sshd and sees: auth required pam_tally2.so deny=3 unlock_time=300 onerr=succeed file=/var/log/tallylog. What is the most likely reason the administrator is locked out even after 5 minutes?

Accepted Answer

The root account is not subject to pam_tally2 without the 'even_deny_root' option, so the lockout is from another mechanism. Pam_tally2 does not apply to the root account unless the 'even_deny_root' option is explicitly added to the pam_tally2 configuration line. Since the administrator is likely logging in as root (or the root account is being targeted), the lockout observed is not from pam_tally2 but from another mechanism such as sshd's own MaxAuthTries or a separate service like fail2ban. The configuration shown only denies regular users after 3 failures and unlocks after 300 seconds, but root remains unaffected by this rule.

Answer

The SSH server is not configured with UsePAM yes, so pam_tally2 is not applied

Answer

The tallylog file has incorrect permissions, preventing pam_tally2 from reading the count

Answer

The DenyHosts service is running and blocks IPs after too many failures

Question 14

A system administrator wants to ensure a service starts automatically at boot and also starts immediately without rebooting. Which of the following systemctl commands or command combinations achieve both goals? (Choose all that apply.)

Accepted Answer

systemctl start service && systemctl enable service. Both options C and D are correct. Option C uses two commands: 'systemctl start service' to start immediately and 'systemctl enable service' to enable boot-time start. Option D uses a single command 'systemctl enable --now service' which simultaneously enables the service for boot and starts it immediately. Options A and B are incorrect because A enables but doesn't start immediately (unless restart is used, which assumes already running), and B starts immediately but doesn't enable for boot.

Answer

systemctl enable service && systemctl restart service

Answer

systemctl start --now service

Question 15

Which command will create a compressed tar archive of a directory?

Accepted Answer

tar -czf archive.tar.gz dir. The `-czf` flags combine `-c` (create archive), `-z` (compress with gzip), and `-f` (specify archive file name). This creates a compressed tar archive of the specified directory, outputting a `.tar.gz` file. The command `tar -czf archive.tar.gz dir` is the standard syntax for this operation.

Answer

tar -xzf archive.tar.gz

Answer

tar -cf archive.tar dir

Answer

tar -tf archive.tar