XK0-006 Practice Exam 2 — 20 Questions

Question 1

A Linux server is configured to allow SSH access for remote administration. The security team wants to limit SSH access to only users in the 'ssh-users' group. Which configuration should be added to /etc/ssh/sshd_config?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AllowGroups ssh-users. The AllowGroups directive in /etc/ssh/sshd_config restricts SSH logins to only those users who are members of the specified group. By setting 'AllowGroups ssh-users', only users belonging to the 'ssh-users' group will be permitted to authenticate via SSH, directly fulfilling the security team's requirement.

Answer

AllowUsers ssh-users

Answer

DenyUsers root

Answer

PermitRootLogin yes

Question 2

Drag and drop the steps to configure SELinux to allow a custom web application to listen on port 8080 in the correct order.

Accepted Answer

List current SELinux port mappings, then add port 8080 to http_port_t, then verify the new mapping, then restart the web service. SELinux requires adding the port to the appropriate context before the service can listen.

Answer

Add port 8080 to http_port_t, then list current mappings, then verify, then restart

Answer

List current mappings, then verify, then add port, then restart

Answer

Add port 8080 to http_port_t, then verify, then list, then restart

Question 3

During boot, the system stops at a shell with limited functionality. The administrator suspects the root filesystem is corrupted. Which target should the system be booted into to perform recovery?

Accepted Answer

emergency.target. emergency.target provides a minimal environment with a single-user shell, suitable for filesystem repairs without starting other services.

Answer

rescue.target

Answer

multi-user.target

Answer

graphical.target

Question 4

An administrator wants to enforce an account lockout policy after five failed login attempts on a Linux system. Which PAM module should be added to the authentication stack?

Accepted Answer

pam_faillock.so. pam_faillock is used for account lockout after failed attempts. pam_unix handles authentication, pam_pwquality checks password strength, pam_tally2 is an older module.

Answer

pam_unix.so

Answer

pam_pwquality.so

Answer

pam_tally2.so

Question 5

A user reports that they cannot access a web server at 192.168.1.100. The administrator wants to check if the server is reachable and measure round-trip time. Which command is most appropriate?

Accepted Answer

ping 192.168.1.100. The `ping` command sends ICMP Echo Request packets to the target host and waits for ICMP Echo Reply packets, which directly tests reachability and measures round-trip time (RTT). This is the most appropriate tool for the administrator's stated goal of checking if the server is reachable and measuring RTT.

Answer

nmap -sn 192.168.1.100

Answer

traceroute 192.168.1.100

Answer

ss -tlnp | grep 192.168.1.100

Question 6

A system administrator wants to review kernel-related log messages from the current boot session. Which journalctl command should be used to filter the kernel messages?

Accepted Answer

journalctl -k. journalctl -k shows kernel messages from the current boot.

Answer

journalctl -p err

Answer

journalctl -b -u systemd-journald

Answer

journalctl --since today

Question 7

A system administrator wants to collect network performance statistics over time, including packet loss and latency, to diagnose intermittent connectivity issues. Which tool combines the functionality of ping and traceroute into a single continuous monitoring command?

Accepted Answer

mtr. mtr (My TraceRoute) continuously sends packets and displays real-time statistics including loss and latency for each hop, combining ping and traceroute.

Answer

tcpdump

Answer

ss

Answer

netstat

Question 8

Which TWO commands can be used to lock a user account? (Choose two.)

Accepted Answer

usermod -L username. passwd -l locks the password, usermod -L locks the account. Both prevent login.

Answer

passwd -u username

Answer

userdel username

Answer

chage -E 0 username

Question 9

A security audit reveals that the /etc/shadow file has permissions 0644 and is owned by root:shadow. The auditor states that this is a security risk because any local user can read password hashes. The administrator wants to fix the permissions to ensure that only root and the shadow group can read the file, and no one else can read it. Additionally, the administrator wants to set the immutable attribute on the file to prevent accidental modification. Which set of commands achieves the desired state?

Accepted Answer

chmod 640 /etc/shadow; chattr +i /etc/shadow. Chmod 640 sets the file permissions to read/write for root (owner) and read-only for the shadow group, while removing all access for others. chattr +i sets the immutable attribute, which prevents any modifications (including deletion, renaming, or content changes) even by root until the attribute is removed. This satisfies the requirement that only root and the shadow group can read the file, and no one else can read it, while also protecting against accidental modification.

Answer

chmod 640 /etc/shadow; chattr +a /etc/shadow

Answer

chmod 640 /etc/shadow; chmod +i /etc/shadow

Answer

chmod 600 /etc/shadow; chattr +i /etc/shadow

Question 10

A Linux security administrator needs to generate a self-signed certificate for a web server. They want to create a private key and a certificate signing request (CSR) in one step. Which OpenSSL command should be used?

Accepted Answer

openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem. The 'req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem' command generates a new private key and CSR. The other options either generate a self-signed certificate directly or are incomplete.

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -key key.pem -out req.pem

Answer

openssl req -new -key key.pem -out req.pem

Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

Question 11

An administrator is troubleshooting a service that fails to start. They want to trace the system calls made by the service binary. Which command should they use?

Accepted Answer

strace. strace traces system calls and signals. It is used to debug what a program is doing at the kernel level.

Answer

ltrace

Answer

dmesg

Answer

lsof

Question 12

In a Bash script, the administrator wants to capture the output of a command into a variable. Which syntax should be used?

Accepted Answer

$(command). Command substitution can be done with $(command) or backticks `command`. The latter is deprecated. $(( )) is for arithmetic expansion. $VAR is for variable expansion.

Answer

$VAR

Answer

$((command))

Answer

`command`

Question 13

A Linux administrator wants to check the history of CPU usage for the past two days using the system activity reporter. Which sar option retrieves data from the daily history file for a specific date?

Accepted Answer

sar -f /var/log/sa/sa$(date +%d --date='2 days ago'). sar -f /var/log/sa/saDD reads from the history file for a specific day (DD is the day of month).

Answer

sar -r -b

Answer

sar -n DEV

Answer

sar -u -s 00:00:00 -e 23:59:59

Question 14

A technician wants to capture network traffic to analyze a web server issue. Using tcpdump, which THREE options are useful for writing the capture to a file and avoiding name resolution? (Choose three.)

Accepted Answer

-n. -w writes to file, -n avoids name resolution, and -i specifies interface.

Answer

-c 100

Answer

-v

Question 15

A systems administrator needs to ensure that a custom service runs with a specific priority on a Linux server. Which command should the administrator use to achieve this?

Accepted Answer

nice -n -10 /usr/local/bin/myservice. The `nice` command adjusts the CPU scheduling priority of a process at launch time. Using `nice -n -10` sets a higher priority (lower nice value) for the new service, ensuring it runs with the specified priority from the start. This directly meets the requirement to run a custom service with a specific priority.

Answer

renice -10 -p 1234

Answer

ionice -c 2 -n 0 -p 1234

Answer

chrt -r 99 /usr/local/bin/myservice

Question 16

An administrator needs to run a script '/usr/local/bin/cleanup.sh' every day at 2:30 AM. Which crontab entry is correct?

Accepted Answer

30 2 * * * /usr/local/bin/cleanup.sh. The correct crontab syntax is `minute hour day month weekday command`. Option D specifies minute 30, hour 2, and asterisks for all other fields, which means the script runs at 2:30 AM every day. This matches the requirement exactly.

Answer

2 30 * * * /usr/local/bin/cleanup.sh

Answer

*/30 2 * * * /usr/local/bin/cleanup.sh

Answer

30 * * * * /usr/local/bin/cleanup.sh

Question 17

After modifying the network configuration on a RHEL 8 system using NetworkManager, what command should be used to apply the changes without restarting the network service?

Accepted Answer

nmcli con up 'System eth0'. nmcli con up <connection> activates the connection with new settings. nmcli connection reload reloads from disk but does not apply to active connections.

Answer

nmcli connection reload

Answer

ifup eth0

Answer

systemctl restart NetworkManager

Question 18

During boot, the system drops into an emergency target. Which command can be used to repair the root filesystem from this environment?

Accepted Answer

fsck /dev/sda1. In emergency mode, the root filesystem is often mounted read-only. fsck can check and repair filesystems, but requires the filesystem to be unmounted.

Answer

mount -o remount,rw / && fsck /

Answer

xfs_repair /dev/sda1

Answer

journalctl -xb

Question 19

A system administrator configures PAM to enforce account lockout after 3 failed login attempts. Which PAM module should be used?

Accepted Answer

pam_faillock. pam_faillock is the correct PAM module for enforcing account lockout after a specified number of failed login attempts. It tracks failed authentication attempts per user and can lock the account when the threshold (e.g., 3 attempts) is reached, typically by writing to a tally file like /var/log/faillock.

Answer

pam_pwquality

Answer

pam_securetty

Answer

pam_unix

Question 20

Given the journalctl output for the httpd service, which of the following is the most likely cause?

Accepted Answer

The /var/www directory is missing the execute (x) permission for the Apache user. The journalctl output for the httpd service likely shows 'Permission denied' errors when Apache tries to serve files from /var/www. The most common cause is that the /var/www directory lacks the execute (x) permission for the Apache user (typically 'apache' or 'www-data'). Without execute permission on the directory, Apache cannot traverse into it to access files, even if the files themselves have correct permissions. This is a standard Linux permission issue distinct from SELinux or file-level read permissions.

Answer

The file /var/www/html/index.html has incorrect SELinux context

Answer

The Apache service is running under the wrong user

Answer

The file /var/www/html/index.html is missing read permission for the Apache user