XK0-006 Practice Exam 1 — 20 Questions

Question 1

A system administrator needs to configure a cron job to run a script every Monday at 3:00 AM. Which two cron expressions are correct? (Select TWO).

Accepted Answer

0 3 * * 1. The cron expression `0 3 * * 1` schedules the script to run at minute 0, hour 3 (3:00 AM), every day of the month (`*`), every month (`*`), and on Monday (day-of-week 1, where 0=Sunday, 1=Monday). Option E is correct because cron also accepts three-letter abbreviations for days of the week, so `Mon` is equivalent to `1`.

Answer

0 3 * * 0

Answer

0 3 1 * 1

Answer

0 3 * * 1-5

Question 2

A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)

Accepted Answer

last. The `last` command reads the /var/log/wtmp file to display a list of all user logins and logouts since that file was created, showing timestamps and source IPs. This makes it a primary tool for investigating login history during a breach.

Answer

/var/log/syslog

Answer

/var/log/messages

Question 3

An administrator needs to replace all occurrences of 'oldhost' with 'newhost' in the configuration file /etc/hosts. Which command will perform the replacement and save the changes directly to the file?

Accepted Answer

sed -i 's/oldhost/newhost/g' /etc/hosts. The `-i` flag (in-place editing) tells `sed` to write the changes directly back to the file specified. Without `-i`, `sed` only prints the modified output to stdout and does not alter the original file. The substitution command `s/oldhost/newhost/g` performs a global replacement of all occurrences of 'oldhost' with 'newhost' on each line.

Answer

sed 's/oldhost/newhost/g' /etc/hosts

Answer

awk '{gsub(/oldhost/,"newhost")}1' /etc/hosts

Answer

grep -r 'oldhost' /etc/hosts | sed 's/oldhost/newhost/g'

Question 4

A Linux system fails to boot and displays a kernel panic immediately after the GRUB menu. The administrator needs to boot into a rescue environment. Which GRUB boot parameter should the administrator add to the kernel line?

Accepted Answer

systemd.unit=rescue.target. When a Linux system experiences a kernel panic immediately after GRUB, the administrator needs to boot into a minimal rescue environment that loads essential system services. The `systemd.unit=rescue.target` parameter tells systemd to start the rescue target, which mounts the root filesystem and starts only the most basic services, allowing the administrator to diagnose and repair the system. This is the proper GRUB kernel parameter for systemd-based distributions to enter a rescue shell without fully booting into the default multi-user or graphical target.

Answer

single

Answer

init=/bin/bash

Answer

quiet splash

Question 5

A user cannot start the Apache web service. The command 'systemctl start httpd' returns 'Failed to start httpd.service: Unit not found.' What is the most likely cause?

Accepted Answer

The httpd package is not installed. The error 'Failed to start httpd.service: Unit not found' indicates that systemd cannot locate a service unit file for httpd. This most commonly occurs when the httpd package (Apache HTTP Server) is not installed on the system. Without the package, no service unit file exists under /usr/lib/systemd/system/, so systemctl cannot start the service.

Answer

Network configuration is incorrect

Answer

Incorrect file permissions on /etc/httpd/

Answer

Disk space is full

Question 6

A security policy requires that SSH access be allowed only from the internal management subnet 10.10.10.0/24. Which firewalld rich rule should be added?

Accepted Answer

firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.10.10.0/24" service name="ssh" accept'. It uses the firewalld rich-rule syntax to explicitly define an IPv4 rule that accepts SSH traffic only from the 10.10.10.0/24 source subnet. Rich rules provide granular control over source addresses, services, and actions, which is required by the security policy. The `--add-rich-rule` option allows specifying the rule family, source address, service name, and accept action in a single, persistent rule.

Answer

firewall-cmd --permanent --add-port=22/tcp --add-source=10.10.10.0/24

Answer

firewall-cmd --add-source=10.10.10.0/24 --add-service=ssh

Answer

iptables -A INPUT -s 10.10.10.0/24 -p tcp --dport 22 -j ACCEPT

Question 7

A Linux server experiences a kernel panic after a recent driver update. The system is still operational but unstable. Which command should be used to gather detailed information about the kernel modules currently loaded?

Accepted Answer

lsmod. B is correct because `lsmod` lists all currently loaded kernel modules by reading the `/proc/modules` file, showing their size, usage count, and dependencies. In a kernel panic scenario after a driver update, this command quickly reveals which modules are active, helping identify the problematic driver without further destabilizing the system.

Answer

modinfo

Answer

dmesg

Answer

modprobe -l

Question 8

A system administrator wants to limit the number of simultaneous logins for a user to 2. Which file and parameter should be configured?

Accepted Answer

/etc/security/limits.conf: username hard maxlogins 2. The `/etc/security/limits.conf` file allows setting resource limits per user or group, and the `maxlogins` parameter specifically controls the maximum number of simultaneous logins for a user. The syntax `username hard maxlogins 2` enforces a hard limit of 2 concurrent sessions for that user, which is the exact requirement. This limit is enforced by the PAM module `pam_limits.so`, which must be configured in the appropriate PAM stack file (e.g., `/etc/pam.d/login` or `/etc/pam.d/sshd`).

Answer

/etc/pam.d/login: session required pam_limits.so

Answer

/etc/security/limits.conf: @users hard maxlogins 2

Answer

/etc/security/limits.conf: username soft nproc 2

Question 9

A script uses 'set -e' and then calls a function that returns a non-zero exit status. The script exits unexpectedly. Which of the following should be added to the function to prevent the script from exiting?

Accepted Answer

set +e inside the function. The `set -e` directive causes the shell to exit immediately if any command returns a non-zero exit status. When a function called from such a script returns a non-zero status, the script exits. Adding `set +e` inside the function disables this behavior for the function's scope, allowing the function to handle errors internally without terminating the entire script.

Answer

return 0 after the command

Answer

exit 0

Answer

trap '' ERR

Question 10

A DevOps engineer wants to reduce the size of a Docker image by combining build stages. Which Dockerfile feature should be used?

Accepted Answer

Multi-stage builds (multiple FROM statements). Multi-stage builds, implemented by using multiple FROM statements in a single Dockerfile, allow a DevOps engineer to copy only the necessary artifacts from intermediate build stages into the final image. This eliminates build-time dependencies, tools, and intermediate layers from the final image, significantly reducing its size without sacrificing build functionality.

Answer

RUN --mount=type=cache

Answer

Layer caching

Answer

Using a smaller base image like Alpine

Question 11

A cron job runs a script that produces output, but the administrator does not receive the expected email notification. Which is the most likely cause?

Accepted Answer

MAILTO variable is not set in the crontab.. The MAILTO variable in a crontab specifies the email address to which cron sends the output (stdout/stderr) of a job. If MAILTO is not set, cron defaults to mailing output to the owner of the crontab (the user who created it). However, if the administrator expects notifications at a different address, the missing MAILTO variable would prevent that specific email from being sent. This is the most direct cause of not receiving the expected email notification.

Answer

The script uses absolute paths for all commands.

Answer

The PATH environment variable is not set.

Answer

The script is not executable.

Question 12

Which TWO of the following are valid methods to enforce disk quota limits on a Linux filesystem? (Select TWO.)

Accepted Answer

Using 'edquota' to set soft and hard limits for users. 'edquota' is the standard interactive command used to set soft and hard disk quota limits for users or groups on a Linux filesystem. It opens the user's quota settings in a text editor, allowing precise configuration of block and inode limits. Option E is correct because 'quotaon' is the command that enables quota enforcement on a specified filesystem, activating the quota subsystem after limits have been defined.

Answer

Using 'setquota' to set limits in a script

Answer

Running 'repquota' to generate reports

Answer

Running 'quotacheck' to update quota files

Question 13

A Linux administrator is hardening an SSH server. Which two of the following settings should be applied to /etc/ssh/sshd_config to improve security?

Accepted Answer

PermitRootLogin no. PermitRootLogin no prevents root login; PasswordAuthentication no forces key-based authentication. Changing the port and enabling X11 forwarding are not necessarily hardening.

Answer

Port 2222

Answer

X11Forwarding yes

Answer

Protocol 1

Question 14

During a security audit, a Linux administrator finds that an unauthorized service is listening on TCP port 4444. The service is not managed by systemd. Which of the following commands should the administrator use to identify the process and disable it?

Accepted Answer

Run 'ss -tlnp | grep :4444' to find the PID, then use 'kill' to terminate the process.. 'ss -tlnp' lists TCP listening sockets with numeric addresses and the associated process PID. Piping the output through 'grep :4444' isolates the unauthorized service, and the PID can then be used with 'kill' to terminate the process. Since the service is not managed by systemd, systemctl commands are irrelevant, making 'kill' the appropriate method to stop the process.

Answer

Run 'fuser 4444/tcp' to find the PID and then use 'systemctl stop' to stop the service.

Answer

Run 'lsof -i :4444' to find the PID, then use 'systemctl disable' to disable the service.

Answer

Run 'systemctl status' to find the service name, then use 'systemctl stop' to stop it.

Question 15

A Linux administrator is writing a Bash script to automate the backup of a database. The script must run a pre-backup command, check its exit status, and if successful, proceed with the backup; otherwise, log an error and exit. Which code snippet correctly implements this logic?

Accepted Answer

pre_backup_cmd
if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi
backup_cmd. Ly runs the pre-backup command, then checks its exit status with `$?`. If the exit status is not zero (indicating failure), it logs an error to stderr and exits with code 1. Only if the pre-backup command succeeds does the script proceed to the backup command. This matches the requirement exactly: check exit status, log error on failure, and exit.

Answer

set -e
pre_backup_cmd
backup_cmd

Answer

pre_backup_cmd && backup_cmd || echo 'Error' >&2

Answer

(pre_backup_cmd; if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi) && backup_cmd

Question 16

A system fails to boot with a kernel panic. The administrator suspects a corrupt initramfs or missing kernel module. Which three methods could be used to recover the system? (Choose three.)

Accepted Answer

Boot from a live CD/DVD, mount the root filesystem, and chroot. At the GRUB menu, editing boot parameters to add 'rd.break' drops into an emergency shell; adding 'single' boots into single-user mode; booting from a live CD allows chroot and repair.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Use 'systemctl rescue' from the boot prompt

Question 17

A web server in a remote data center logs timestamps in UTC, but the operations team wants all logs to reflect the local timezone (America/New_York). Which command changes the system timezone?

Accepted Answer

timedatectl set-timezone America/New_York. The `timedatectl set-timezone` command is the correct way to change the system timezone on a Linux system using systemd. By specifying 'America/New_York', the system will adjust all timestamps to Eastern Time, including those generated by the web server, ensuring logs reflect the local timezone.

Answer

timedatectl set-time '2025-03-01 12:00:00'

Answer

timedatectl list-timezones

Answer

timedatectl set-ntp yes

Question 18

Which of the following correctly describes the purpose of the /etc/shadow file?

Accepted Answer

It stores encrypted passwords and password aging fields.. The /etc/shadow file stores encrypted (hashed) user passwords and password aging information such as the date of last password change, minimum/maximum password age, and account expiration. This file is readable only by root to protect password hashes from unauthorized access, unlike /etc/passwd which is world-readable.

Answer

It stores the list of users who can use sudo.

Answer

It stores group memberships and group passwords.

Answer

It stores user account information including UID, GID, and shell.

Question 19

A junior administrator is asked to automate the backup of a configuration file every night at 11 PM. The script /usr/local/bin/backup.sh already exists. Which command should the administrator run to schedule this task?

Accepted Answer

echo "0 23 * * * /usr/local/bin/backup.sh" | crontab -. The `crontab -` command reads from standard input and installs the cron job. The line `0 23 * * * /usr/local/bin/backup.sh` specifies that the script should run at 23:00 (11 PM) every day, matching the requirement exactly. This is the standard method for scheduling recurring tasks in Linux using cron.

Answer

systemctl start backup.timer

Answer

at 23:00 /usr/local/bin/backup.sh

Answer

nohup /usr/local/bin/backup.sh &

Question 20

A system administrator is configuring firewalld on a Linux server. They want to allow incoming HTTPS traffic permanently for the public zone. Which command should be used?

Accepted Answer

firewall-cmd --add-service=https --zone=public --permanent. The `firewall-cmd --add-service=https --zone=public --permanent` command adds the HTTPS service (TCP port 443) to the public zone and makes the rule persistent across reboots. The `--permanent` flag ensures the change survives a firewall reload or system restart, and the `--zone=public` targets the correct network zone for incoming traffic.

Answer

firewall-cmd --zone=public --add-service=https

Answer

firewall-cmd --service=https --add --zone=public --permanent

Answer

firewall-cmd --add-port=443/tcp --zone=public --permanent