XK0-006 Practice Exam 3 — 20 Questions

Question 1

A system administrator runs 'umask 027' in a Bash shell. What will be the default permissions for a new directory created in that shell? (Assume no other umask changes.)

Accepted Answer

rwxr-x--- (750). The umask value 027 subtracts permissions from the base 777 for directories. 777 minus 027 equals 750, which translates to rwxr-x---. The owner gets full permissions (rwx), the group gets read and execute (r-x), and others get no permissions (---).

Answer

rwxrwxr-x (775)

Answer

rwxrwxrwx (777)

Answer

rw-rw-r-- (664)

Question 2

A security engineer needs to verify the authenticity of a downloaded file using its detached GPG signature (file.sig). Which command should be used?

Accepted Answer

gpg --verify file.sig. The `gpg --verify file.sig` command is used to verify the authenticity of a file using its detached GPG signature. The detached signature file (file.sig) contains the cryptographic signature, and GPG checks it against the original file (which must be present in the same directory with the same base name) using the signer's public key from the local keyring. This confirms that the file was signed by the holder of the corresponding private key and has not been tampered with.

Answer

gpg --sign file

Answer

gpg --list-keys

Answer

gpg --decrypt file.gpg

Question 3

An administrator needs to configure SELinux to allow the Apache HTTP server to connect to a database server. Which SELinux boolean should be enabled?

Accepted Answer

httpd_can_network_connect_db. The SELinux boolean `httpd_can_network_connect_db` specifically allows the Apache HTTP server to make outbound TCP connections to database servers (e.g., MySQL, PostgreSQL). This is required when a web application needs to query a remote database. The other booleans control different aspects of httpd's behavior and do not grant network connectivity to databases.

Answer

httpd_can_network_connect

Answer

httpd_enable_cgi

Answer

httpd_use_nfs

Question 4

Which command displays the number of lines, words, and characters in a file?

Accepted Answer

wc file.txt. The `wc` command without any options displays the number of lines, words, and characters in a file, in that order. By default, `wc` counts newline characters (lines), whitespace-delimited tokens (words), and bytes (characters) in the specified file. This makes option A the correct choice for displaying all three counts.

Answer

wc -w file.txt

Answer

cat file.txt | wc -l

Answer

stat file.txt

Question 5

A user reports that a custom application service fails to start with a 'Permission denied' error in the logs. The service runs under the 'appuser' account. Which is the most likely cause and the first step to diagnose?

Accepted Answer

SELinux is blocking the service; check journalctl for AVC denials and use restorecon or setsebool.. SELinux enforces mandatory access controls that can block a service from starting even when standard Linux file permissions are correct. The 'Permission denied' error, combined with the service running under a non-root user, strongly suggests SELinux is denying access. Checking journalctl for AVC denials is the standard first diagnostic step to confirm SELinux involvement, followed by using restorecon to fix file context labels or setsebool to adjust SELinux booleans.

Answer

The root password is incorrect; change root password with passwd.

Answer

The service binary does not have execute permission for appuser; use chmod +x.

Answer

The systemd target is not set to multi-user; run systemctl set-default multi-user.target.

Question 6

A user reports that a recently installed application fails to start. The application was installed via a shell script that added a repository and installed the package. The user runs 'ldd /usr/bin/app' and sees several 'not found' libraries. Which of the following is the MOST likely cause?

Accepted Answer

The installation script did not install all required dependencies.. The `ldd` command lists shared library dependencies for a binary. When it reports 'not found' libraries, it means the dynamic linker cannot locate the required `.so` files. Since the application was installed via a shell script that added a repository and installed the package, the most likely cause is that the script failed to install all required dependencies, leaving the binary unable to resolve its shared library links.

Answer

The kernel version is outdated.

Answer

SELinux is blocking the application.

Answer

The file system is corrupted.

Question 7

A process has become unresponsive and is in a zombie state. Which action should the administrator take to remove the zombie process?

Accepted Answer

Kill the parent process of the zombie. A zombie process is a child process that has terminated but whose exit status has not been read by its parent. The only way to remove it is to kill the parent process (using kill -9 or similar), which causes the zombie to be re-parented to init (PID 1), which then automatically reaps it by calling wait(). Option D is correct because directly killing the zombie (kill -9) has no effect—the zombie is already dead and cannot receive signals.

Answer

kill -18 <PID>

Answer

kill -9 <PID>

Answer

Wait for the init process to clean it up; no action needed

Question 8

A system administrator needs to restrict SSH access to a Linux server to only users in the 'sshusers' group. Which configuration change achieves this?

Accepted Answer

Add 'AllowGroups sshusers' to /etc/ssh/sshd_config. The 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH access to only users who are members of the specified group. When set to 'AllowGroups sshusers', only users belonging to the 'sshusers' group will be permitted to log in via SSH, effectively blocking all others. This is the standard method for group-based access control in OpenSSH.

Answer

Add 'DenyUsers *' to /etc/ssh/sshd_config

Answer

Set 'PermitRootLogin no' in /etc/ssh/sshd_config

Answer

Add 'AllowUsers sshusers' to /etc/ssh/sshd_config

Question 9

The /home partition is nearly full. The administrator wants to increase the size of the home filesystem. Which action should be taken first?

Accepted Answer

Unmount the /home filesystem. Before any logical volume or filesystem operations can be performed on a partition that is in use, the filesystem must be unmounted to prevent data corruption and ensure the metadata is in a consistent state. The /home filesystem is actively used by user processes, so unmounting it first is mandatory before resizing or extending the underlying logical volume.

Answer

Use resize2fs on /dev/mapper/vg-home

Answer

Use lvextend to extend the logical volume

Answer

Add a new disk to the volume group

Question 10

Refer to the exhibit. A web server is experiencing performance issues. Based on the process list shown, which action should the administrator take first?

Accepted Answer

Identify and restart the parent process to clean up the zombie.

Answer

Increase the PID limit in /proc/sys/kernel/pid_max.

Answer

Kill the parent process of the zombie (PID 1234).

Answer

Terminate the zombie process with SIGKILL.

Question 11

A Linux administrator needs to find large log files that may be consuming disk space. Which command should be used to locate files larger than 100MB in the /var/log directory?

Accepted Answer

find /var/log -type f -size +100M. The `find` command with `-type f` (regular files) and `-size +100M` (files larger than 100 megabytes) is the correct tool to locate large log files in /var/log. This directly meets the requirement to find files by size, unlike other commands that only show disk usage or directory listings without size filtering.

Answer

df -h

Answer

ls -lR /var/log

Answer

du -sh /var/log/*

Question 12

An administrator needs to add a script to be executed daily. The script is placed at /etc/cron.daily/myscript. After placing the script, it does not run. Based on the exhibit, what is the most likely issue?

Accepted Answer

The script is not executable. Scripts placed in /etc/cron.daily/ are executed by run-parts, which requires files to have the executable bit set. Without the execute permission (e.g., chmod +x), the script is skipped entirely, even if it is owned correctly and the cron daemon is active.

Answer

The script is owned by the wrong user

Answer

The cron daemon is not running

Answer

The script is not listed in /etc/crontab

Answer

Anacron is not installed

Question 13

A Linux administrator needs to add a new user named 'jdoe' with a home directory and default shell /bin/bash. Which command should be used?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command is used to create new users. The -m option creates the home directory, and -s sets the shell. usermod modifies existing users, passwd sets passwords, and chage manages password aging.

Answer

chage -m -s /bin/bash jdoe

Answer

passwd -m -s /bin/bash jdoe

Answer

usermod -m -s /bin/bash jdoe

Question 14

Which TWO tools are specifically designed to detect rootkits on a Linux system?

Accepted Answer

rkhunter. B is correct because rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors, and possible local exploits by comparing file hashes, checking for hidden processes, and analyzing system binaries for known rootkit signatures. It is specifically designed to detect rootkits on Linux systems.

Answer

lsof

Answer

netstat

Answer

clamav

Question 15

A system administrator notices that the /var partition is full, causing log services to malfunction. Which command should be used to quickly reclaim space by removing compressed old log files?

Accepted Answer

find /var/log -type f -name '*.gz' -delete. It uses `find` to locate all files ending in `.gz` under `/var/log` and deletes them with `-delete`. Compressed old log files are typically archived with gzip, so removing them directly reclaims disk space without affecting active logs or requiring additional tools.

Answer

journalctl --vacuum-size=100M

Answer

rm -rf /var/log/*.gz

Answer

logrotate -f

Question 16

An administrator wants to force a password change for user 'alice' on next login. Which command is appropriate?

Accepted Answer

passwd --expire alice. The correct command to force a password change on next login is `passwd --expire alice`. This immediately expires alice's password, requiring a change at next login. The other options are incorrect: `passwd -l` locks the account, `chage -l alice` lists account aging information without changing anything, and `usermod -f` sets the inactivity period.

Answer

passwd -l alice

Answer

chage -l alice

Answer

usermod -f alice

Question 17

Refer to the exhibit. What is the total amount of RAM installed on the system?

Accepted Answer

7.7G. The output of `free -h` shows the total memory in the 'total' column of the 'Mem:' row, which is 7.7G. This value represents the total physical RAM installed and available to the system, as reported by the kernel from the hardware.

Answer

7.5G

Answer

8.0G

Answer

0.1G

Question 18

Refer to the exhibit. A web application running under Apache cannot write to /var/log/app.log. The file has permissions 664 and is owned by apache. What is the correct action to allow writes while maintaining SELinux policies?

Accepted Answer

Change the SELinux context of the file to httpd_log_t.. The file /var/log/app.log has permissions 664 and is owned by apache, so the web server should be able to write to it. However, SELinux is blocking the write because the file's SELinux context does not match the type expected for files that Apache (httpd) is allowed to write to. Changing the SELinux context to httpd_log_t tells SELinux that this file is a log file that httpd can write to, which resolves the denial while keeping SELinux enforcing.

Answer

Change the ownership to root.

Answer

Set the httpd_can_network_connect boolean.

Answer

Disable SELinux for the httpd daemon.

Question 19

Which TWO commands can be used to immediately synchronize the system time with an NTP server, even if the time difference is large? (Choose two.)

Accepted Answer

ntpd -g. `ntpd -g` allows the NTP daemon to perform a one-time large time jump (even if the offset exceeds the default panic threshold of 1000 seconds) and then continue normal synchronization. Option E is correct because `ntpdate pool.ntp.org` immediately sets the system clock to the time returned by the NTP server, regardless of the current time difference, making it suitable for large corrections.

Answer

chronyd -q

Answer

systemctl restart ntp

Answer

timedatectl set-ntp true

Question 20

A junior administrator needs to view the logs of a running container named 'webapp'. Which command should be used?

Accepted Answer

docker logs webapp. The `docker logs webapp` command retrieves the stdout and stderr output streams from the container's main process, which is the standard way to view logs for a running or stopped container. This is the correct approach because Docker captures these streams and stores them in a JSON file on the host, accessible via the `docker logs` command.

Answer

docker attach webapp

Answer

docker inspect webapp

Answer

docker stats webapp