XK0-005 Practice Exam 2 — 20 Questions

Question 1

A database server running on Linux is experiencing high load. The administrator runs 'strace -p <pid>' and sees many 'epoll_wait' and 'futex' calls. Which THREE of the following are possible causes of the high load? (Choose THREE.)

Accepted Answer

Disk I/O contention causing processes to wait.. Option A is correct because 'epoll_wait' indicates the process is waiting for I/O events, and 'futex' calls are used for synchronization. Disk I/O contention can cause the database process to block on these system calls, leading to high load as the kernel schedules other tasks while waiting for I/O to complete.

Answer

CPU frequency scaling is set to powersave.

Answer

A memory leak in the database process.

Question 2

A user reports that a Linux workstation fails to boot and displays 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

The root filesystem device is incorrectly specified in the kernel command line.. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate the root filesystem device. The most likely cause is that the root filesystem device is incorrectly specified in the kernel command line (e.g., via a bootloader parameter like root=), preventing the kernel from finding the correct block device to mount as root.

Answer

A filesystem listed in /etc/fstab has errors.

Answer

A memory module is faulty.

Answer

The boot loader is missing or corrupted.

Question 3

A user reports that the /data directory is inaccessible. The Linux administrator runs the commands shown in the exhibit. Which of the following is the most likely cause of the issue?

Accepted Answer

The filesystem is full and has become corrupted.. The 'Input/output error' when accessing /data, combined with the 'Structure needs cleaning' message from dmesg, indicates filesystem corruption on /dev/sdb1. This is a classic symptom of a full filesystem that has become corrupted, not a simple permission or mount issue. The administrator's inability to read or write to the directory, despite the mount appearing normal, points to underlying filesystem damage.

Answer

The user does not have read permissions on /data.

Answer

The device /dev/sdb1 is not present.

Answer

The filesystem is mounted as read-only.

Question 4

A developer is writing a Bash script that must be portable across different Linux distributions. The script needs to check if a package is installed. Which command should be used to achieve this portability?

Accepted Answer

command -v package. The `command -v package` command is the most portable way to check if a package is installed across different Linux distributions because it uses the POSIX-standard `command` shell built-in, which works in any Bourne-compatible shell (bash, sh, dash, etc.) regardless of the underlying package manager. It returns the path to the executable if the package's binary is in the PATH, or nothing if it is not installed, making it distribution-agnostic.

Answer

which package

Answer

dpkg -l package

Answer

rpm -q package

Question 5

A senior administrator is troubleshooting a shell script that fails to execute properly. The script starts with #!/bin/bash and has execute permissions. Which of the following could cause the script to fail to run when invoked as ./script.sh?

Accepted Answer

The script contains carriage return characters (\r).. Option B is correct because carriage return characters (\r) are a common issue when scripts are edited on Windows and then transferred to Linux. The shebang line #!/bin/bash expects a Unix-style line ending (LF), but \r characters cause the shell to interpret the command interpreter as '/bin/bash\r', which is not a valid executable path. This results in a 'No such file or directory' error when the script is invoked as ./script.sh, even though permissions are correct.

Answer

The shebang line is not on the first line.

Answer

The script uses #!/bin/sh instead of bash.

Answer

The script starts with a byte order mark (BOM).

Question 6

A Linux system is experiencing high CPU load. The administrator runs 'top' and sees that the 'kworker' processes are consuming significant CPU time. What is the most likely cause?

Accepted Answer

A hardware interrupt storm caused by a failing disk controller. The 'kworker' processes in the 'top' output indicate kernel workqueue threads that handle deferred work. High CPU usage by kworker is typically caused by a hardware interrupt storm, often from a failing disk controller or other faulty hardware generating excessive interrupts that the kernel must service. This forces the workqueue to constantly process interrupt-related tasks, consuming significant CPU time.

Answer

A kernel module memory leak

Answer

A user process stuck in an infinite loop

Answer

Insufficient memory causing swapping

Question 7

A Linux server runs a web application that frequently runs out of file descriptors. Which configuration change would permanently increase the maximum number of open files for all users?

Accepted Answer

Edit /etc/security/limits.conf and add 'soft nofile 65536' and 'hard nofile 65536'. Option D is correct because editing /etc/security/limits.conf with both 'soft nofile' and 'hard nofile' entries permanently raises the per-user limit on open file descriptors for all users (or specified users/groups) at login. The soft limit is the current working limit, while the hard limit is the maximum ceiling; setting both ensures the user can reach the desired value without needing to run ulimit with root privileges.

Answer

Set 'fs.file-max = 65536' in /etc/sysctl.conf

Answer

Add 'session required pam_limits.so' to /etc/pam.d/login

Answer

Run 'ulimit -n 65536' in a startup script

Question 8

A Linux administrator is troubleshooting a server that intermittently becomes unresponsive. The administrator suspects a memory leak. Which command should be used to monitor memory usage over time and identify the consuming process?

Accepted Answer

top. The `top` command provides a real-time, dynamic view of system processes, including memory usage (RES, VIRT, %MEM) and can be sorted by memory consumption. It updates continuously, making it ideal for monitoring memory usage over time and identifying the specific process responsible for a suspected memory leak.

Answer

free -h

Answer

ss -tuln

Answer

df -h

Question 9

A Linux engineer is troubleshooting a server that fails to boot. The server displays a message indicating 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which TWO actions should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Boot from a rescue disk and rebuild the initramfs with the necessary filesystem modules. The error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or mount the root filesystem. Option B is correct because rebuilding the initramfs from a rescue disk ensures the necessary filesystem drivers (e.g., ext4, xfs) are included, which may have been missing or corrupted. Option D is correct because the root= parameter in the bootloader configuration (e.g., GRUB) tells the kernel which device/partition to mount as root; a typo or incorrect value (e.g., wrong UUID or device name) will cause this exact panic.

Answer

Reinstall GRUB to the Master Boot Record

Answer

Run fsck on the root partition to check for filesystem corruption

Answer

Disable SELinux by adding selinux=0 to the kernel command line

Question 10

A system administrator needs to check the current runlevel on a system that uses systemd. Which command should the administrator use?

Accepted Answer

systemctl get-default. Option C is correct because `systemctl get-default` displays the default target (runlevel equivalent) on a systemd-based Linux system. Systemd uses targets instead of traditional SysV runlevels, and this command shows which target is set as the default at boot, such as `multi-user.target` or `graphical.target`.

Answer

hostnamectl

Answer

getenforce

Answer

uname -r

Question 11

A systems administrator needs to restrict SSH access to a Linux server so that only users in the 'sshusers' group can log in. Which configuration change should be made in /etc/ssh/sshd_config?

Accepted Answer

Add 'AllowGroups sshusers'. Option C is correct because the 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH login to only users who are members of the specified group. By adding 'AllowGroups sshusers', only users in the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This is the standard OpenSSH mechanism for group-based access control.

Answer

Add 'AllowUsers sshusers'

Answer

Add 'DenyGroups all'

Answer

Add 'PermitRootLogin no' and add users to sshusers

Question 12

An administrator needs to update the system time using an NTP server immediately without waiting for the next scheduled sync. Which command should be used?

Accepted Answer

ntpdate pool.ntp.org. The `ntpdate` command is used to immediately synchronize the system clock with an NTP server, bypassing the daemon-based scheduled sync. Option D runs `ntpdate pool.ntp.org`, which performs a one-time query and sets the time instantly, making it the correct choice for an immediate update.

Answer

timedatectl set-ntp true

Answer

systemctl start ntpd

Answer

ntpq -p

Question 13

A company requires that all systems be configured to log all authentication attempts, both successful and failed. Which configuration file and directive should be used to ensure all auth messages are logged to /var/log/secure?

Accepted Answer

In /etc/rsyslog.conf: authpriv.* /var/log/secure. In rsyslog, the `authpriv` facility covers authentication and authorization messages, including both successful and failed login attempts. The directive `authpriv.* /var/log/secure` directs all messages from this facility to `/var/log/secure`, which is the standard secure log file on RHEL/CentOS systems. This meets the requirement to log all authentication attempts.

Answer

In /etc/rsyslog.conf: *.info /var/log/secure

Answer

In /etc/rsyslog.conf: auth.* /var/log/secure

Answer

In /etc/rsyslog.conf: kern.* /var/log/secure

Question 14

A Linux system is experiencing kernel panics after a recent update. The administrator wants to boot into a previous kernel version to restore functionality. Which three steps are required to achieve this? (Select THREE).

Accepted Answer

After booting, edit /etc/default/grub and set GRUB_DEFAULT to the saved entry, then run update-grub. Option A is correct because after booting into a working kernel, editing /etc/default/grub to set GRUB_DEFAULT to 'saved' and running update-grub (or grub-mkconfig) ensures that the GRUB bootloader will remember and default to the last successfully booted kernel, which can be the previous version. This step is necessary to make the temporary fix persistent across reboots.

Answer

Run 'yum reinstall kernel' to revert to the previous version

Answer

Edit /etc/fstab to change root filesystem parameters

Question 15

Based on the exhibit, what is the most likely cause of the sshd service failure?

Accepted Answer

Another process is already listening on port 22. The sshd service failed because another process is already listening on port 22, which prevents sshd from binding to that port. This is indicated by the error message in the exhibit (e.g., 'bind: Address already in use'), which is a common symptom when a conflicting service or a previously running instance of sshd occupies the port. The system cannot start a new instance of sshd until the port is freed.

Answer

The firewall is blocking port 22

Answer

The sshd configuration file has incorrect permissions

Answer

The sshd service is not installed

Question 16

A system administrator notices that a server's disk space is critically low. Which command should be used to identify the largest files or directories consuming space?

Accepted Answer

du -sh /*. Option D is correct because `du -sh /*` recursively calculates disk usage for each top-level directory and file under root, summarizing sizes in human-readable format. This directly identifies the largest space consumers, which is the stated goal. The `-s` flag provides a total per argument, and `/*` targets all immediate children of `/`.

Answer

ls -la /

Answer

fdisk -l

Answer

df -h

Question 17

A technician needs to find out which port the SSH daemon is listening on. Which command will show this information?

Accepted Answer

ss -tlnp. The `ss -tlnp` command displays listening TCP sockets with numeric addresses and the associated process information. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` prevents DNS resolution, and `-p` reveals the PID and program name. Since SSH daemon (sshd) listens on TCP port 22 by default, this command will show the listening port and the sshd process.

Answer

lsof -i :22

Answer

nmap -p 22 localhost

Answer

netstat -i

Question 18

An administrator needs to ensure that a custom script /usr/local/bin/backup.sh runs every day at 2:00 AM and logs output to /var/log/backup.log. How should this be configured using systemd?

Accepted Answer

Create a systemd timer unit that activates a service unit, with OnCalendar=daily and the desired time.. Option C is correct because systemd timer units are the modern, recommended method for scheduling recurring tasks on Linux systems that use systemd. By creating a timer unit with `OnCalendar=daily` and specifying the desired time (e.g., `02:00:00`), the associated service unit will execute `/usr/local/bin/backup.sh` at 2:00 AM daily. The service unit can also redirect output to `/var/log/backup.log` using standard output/error directives, ensuring logging is handled natively within the systemd framework.

Answer

Use anacron with a delay of 0 and a period of 1 day.

Answer

Add a cron job with '0 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1'.

Answer

Place the script in /etc/cron.daily/ and set the time with the 'START_HOURS_RANGE' variable.

Question 19

Based on the exhibit, the myapp service fails to start. Which troubleshooting step should be taken first?

Accepted Answer

Check that the application's configuration file exists and is readable. The exhibit shows a systemd unit file for the myapp service with `ExecStart=/usr/local/bin/myapp` and `Restart=on-failure`. The service fails to start, and the most common cause for such a failure is a missing or misconfigured application configuration file that the binary expects at launch. Option D is correct because verifying the configuration file's existence and readability is a fundamental prerequisite before investigating deeper issues like permissions or logs.

Answer

Increase the RestartSec value to allow more time for startup

Answer

Verify that /usr/local/bin/myapp has execute permission

Answer

Inspect the system journal for more detailed error messages

Question 20

A developer needs to run a one-time script after the network is up on a systemd-based server. Which unit type should be used?

Accepted Answer

oneshot. The `oneshot` unit type is correct because it is designed for services that run a single task to completion and then exit, making it ideal for a one-time script that must execute after the network is up. In systemd, `oneshot` units can be configured with `RemainAfterExit=no` (the default) to indicate they do not need to stay running, and they support ordering dependencies like `After=network-online.target` to ensure the network is available before the script runs.

Answer

forking

Answer

exec

Answer

simple