XK0-006 Practice Exam 4 — 20 Questions

Question 1

Which TWO statements are true regarding the use of Ansible for automation? (Choose TWO.)

Accepted Answer

Ansible playbooks are written in YAML.. Option B is correct because Ansible playbooks are defined in YAML, a human-readable data serialization format that describes tasks, plays, and roles executed by the Ansible engine. Option C is correct because Ansible is agentless: it does not require any software installed on managed nodes and communicates over standard SSH (or WinRM for Windows hosts) to push modules and execute tasks. Option A is incorrect because Ansible can run from any control machine, including a laptop or a CI runner, and does not mandate a dedicated master server. Option D is incorrect because Ansible uses a push-based model, where the control node pushes playbooks/modules to targets, not a pull model like Puppet or Chef agents. Option E is incorrect because Ansible modules are written in Python (or any language returning JSON), not Ruby.

Answer

Ansible requires a dedicated master server to manage nodes.

Answer

Ansible uses a pull-based model where nodes fetch configurations from a central server.

Answer

Ansible modules are written in Ruby.

Question 2

A security audit reveals that an SELinux boolean 'httpd_can_network_connect' is currently off, but a web application requires Apache to connect to a database server. Which command should the administrator use to enable this boolean persistently?

Accepted Answer

setsebool -P httpd_can_network_connect on. The command 'setsebool -P httpd_can_network_connect on' is correct because setsebool modifies SELinux booleans at runtime, and the -P flag makes the change persistent across reboots by writing it to the policy store. This enables Apache to initiate network connections to the database server as required.

Answer

setenforce 1

Answer

setsebool httpd_can_network_connect 1

Answer

getsebool httpd_can_network_connect

Question 3

A server running RHEL 8 fails to boot with a 'Dependency failed for /data' error. The /data filesystem is an ext4 partition on /dev/sdb1. Which sequence of steps should be taken to repair the filesystem?

Accepted Answer

Boot into rescue mode, run 'umount /dev/sdb1', then 'fsck.ext4 -f /dev/sdb1'. To repair an ext4 filesystem that failed to mount at boot, you must boot into rescue mode (or single-user), ensure the filesystem is unmounted, then run 'fsck.ext4 -f /dev/sdb1' to force a check and repair. fsck must never run on a mounted read-write filesystem, and rescue mode gives you a clean environment where /data is not mounted. This is the standard RHEL recovery procedure.

Answer

Use 'xfs_repair /dev/sdb1' since it's ext4

Answer

Run 'fsck.ext4 -f /dev/sdb1' from the running system

Answer

Remount the filesystem as read-only and run fsck

Question 4

A technician wants to check the disk I/O statistics, focusing on the average I/O wait time and utilization percentage. Which command provides this information?

Accepted Answer

iostat -x. The iostat -x command displays extended disk I/O statistics, including per-device metrics such as average wait time (await), utilization percentage (%util), and queue sizes. The -x flag is specifically what surfaces these extended columns, making it the correct tool for analyzing I/O wait and utilization. sar -b reports overall block device activity but not per-device extended metrics like await and %util.

Answer

sar -b

Answer

vmstat -d

Answer

free -h

Question 5

An administrator runs 'systemctl list-units' and sees that httpd.service is in a failed state. To quickly see the error message that caused the failure, which command should be used?

Accepted Answer

systemctl status httpd.service. The `systemctl status httpd.service` command displays the current state of the service, including the most recent log entries from the journal that show the error messages causing the failure. This is the quickest way to see the failure reason without filtering or additional options, as it directly outputs the relevant error lines from the service's unit.

Answer

systemctl show httpd.service -p ExecMainStatus

Answer

journalctl -p err -u httpd.service

Answer

systemd-analyze blame

Question 6

A systems administrator writes a Bash script named 'backup.sh' and wants it to run with the Bash shell. Which line should appear first in the script?

Accepted Answer

#!/bin/bash. The shebang line `#!/bin/bash` is required as the first line to instruct the operating system to execute the script using the Bash shell interpreter located at `/bin/bash`. Without this line, the script may be run by a different shell (e.g., `/bin/sh`), leading to syntax or behavior differences. The shebang must start with `#!` followed by the absolute path to the interpreter.

Answer

# This is a bash script

Answer

#/bin/bash

Answer

#!/bin/sh

Question 7

A technician has just performed system maintenance and wants to verify that the server has been running continuously for the past 30 days. Which command should the technician use?

Accepted Answer

uptime. The `uptime` command displays how long the system has been running since the last boot, including the current time, number of logged-in users, and load averages. By checking the output, the technician can verify if the server has been running continuously for the past 30 days (e.g., 'up 30 days'). This directly answers the question without querying logs or processes.

Answer

systemctl status rsyslog

Answer

ps aux

Answer

date

Question 8

A Linux administrator is tasked with adding a new 1TB hard drive to a server. The drive has been partitioned and formatted with ext4, resulting in the device /dev/sdb1. The administrator needs the drive to be mounted persistently at /data. After adding an entry to /etc/fstab, the administrator runs 'mount -a' and sees the error: 'mount: /data: mount point does not exist.' Which of the following should the administrator do first to resolve the issue?

Accepted Answer

Create the /data directory with mkdir. The error 'mount point does not exist' indicates that the directory /data has not been created on the filesystem. The mount command requires an existing directory to attach the device to. Creating the /data directory with mkdir resolves this, allowing mount -a to succeed.

Answer

Run mkfs.ext4 on /dev/sdb1

Answer

Reboot the server

Answer

Run fsck on /dev/sdb1

Question 9

After a system update, a custom application no longer runs due to a shared library error. The library exists on the system but is in a non-standard path. Which environment variable should be checked or set to resolve this?

Accepted Answer

LD_LIBRARY_PATH. The LD_LIBRARY_PATH environment variable tells the dynamic linker (ld.so) where to search for shared libraries before the standard system paths. When a custom application fails with a shared library error after an update, and the library exists in a non-standard path, setting LD_LIBRARY_PATH to include that path resolves the issue by allowing the linker to find the library at runtime.

Answer

LD_PRELOAD

Answer

PATH

Answer

LD_RUN_PATH

Question 10

A Linux administrator notices that the system’s disk I/O performance has degraded significantly. Running 'iostat -x 1' shows high %util values on /dev/sda, but low await. Which of the following is the most likely issue?

Accepted Answer

There are many concurrent I/O requests (high queue depth).. High %util with low await indicates that the device is busy processing many concurrent I/O requests, but each request completes quickly. This is characteristic of a high queue depth where the disk is saturated with parallel requests, not that individual requests are slow. The low await confirms that the disk itself is responding fast, so the bottleneck is the volume of simultaneous I/O, not latency per request.

Answer

The filesystem is nearly full.

Answer

The disk cable is loose or faulty.

Answer

The disk is failing and needs replacement.

Question 11

A Linux administrator wants to ensure a Bash script exits immediately if any command fails. Which directive should be included at the beginning of the script?

Accepted Answer

set -e. The `set -e` directive (equivalent to `set -o errexit`) causes the shell to exit immediately when any command returns a non-zero exit status, unless that command is part of a condition (if/while/until) or followed by `||`. This is the standard way to make a Bash script fail fast on the first error. Placing it near the top of the script ensures subsequent commands are not executed after a failure.

Answer

set -o pipefail

Answer

set -u

Answer

set -x

Question 12

A technician suspects a process is leaking file descriptors. Which command can be used to list open files associated with a specific PID?

Accepted Answer

lsof -p PID. The lsof (list open files) command with the -p flag filters output to show all open files associated with a specific process ID. Since Linux treats file descriptors as open files (including sockets, pipes, and regular files), lsof -p PID is the canonical tool for diagnosing file descriptor leaks by revealing exactly what a process has open.

Answer

top -p PID

Answer

strace -p PID

Answer

ltrace -p PID

Question 13

A user cannot start the Apache web service. The command 'systemctl start httpd' returns 'Failed to start httpd.service: Unit not found.' What is the most likely cause?

Accepted Answer

The httpd package is not installed. The error 'Failed to start httpd.service: Unit not found' indicates that systemd cannot locate a service unit file for httpd. This most commonly occurs when the httpd package (Apache HTTP Server) is not installed on the system. Without the package, no service unit file exists under /usr/lib/systemd/system/, so systemctl cannot start the service.

Answer

Network configuration is incorrect

Answer

Incorrect file permissions on /etc/httpd/

Answer

Disk space is full

Question 14

A Linux administrator is troubleshooting a service that fails to start. The audit.log shows an AVC denial related to the httpd_t domain. The administrator wants to see the full denial message and generate a policy to allow the access. Which two commands should be used in conjunction?

Accepted Answer

ausearch and audit2allow. `ausearch` retrieves the full AVC denial message from the audit log, and `audit2allow` generates a policy module to allow the denied access. Together, they enable the administrator to first identify the exact denial and then create a custom SELinux policy to permit the httpd_t domain's blocked action.

Answer

auditctl and ausearch

Answer

ausearch and restorecon

Answer

aureport and audit2why

Question 15

A server is unable to resolve hostnames via DNS. The /etc/resolv.conf file appears correct. Which command can be used to test DNS resolution and display the full query path?

Accepted Answer

dig +trace example.com. The `dig +trace example.com` command performs a full iterative DNS resolution from the root nameservers down to the authoritative nameservers for the queried domain, displaying each step of the query path. This is the correct choice because the question specifically asks to 'display the full query path,' which `+trace` provides by following referrals step by step, unlike simpler queries that only show the final answer.

Answer

nslookup example.com

Answer

host example.com

Answer

resolvectl query example.com

Question 16

An administrator needs to check the current routing table on a Linux system. Which command should be used?

Accepted Answer

ip route. The `ip route` command displays the kernel routing table, showing the paths that packets take to reach network destinations. This is the standard tool on modern Linux systems for viewing and manipulating routing entries, replacing the older `route -n` command.

Answer

dig -t A

Answer

ss -r

Answer

ip neigh

Question 17

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and AllowGroups sshusers. The directive `PermitRootLogin no` explicitly disallows root login via SSH, and `AllowGroups sshusers` restricts SSH access to only members of the 'sshusers' group. This combination meets both requirements: disabling root login and limiting access to a specific group. The `AllowGroups` directive is group-based, unlike `AllowUsers`, which is user-based.

Answer

DenyRootLogin yes and AllowGroups sshusers

Answer

PermitRootLogin prohibit-password and AllowGroups sshusers

Answer

PermitRootLogin no and AllowUsers sshusers

Question 18

A Linux server in a DMZ is experiencing intermittent SSH lockouts. The /var/log/secure shows repeated failed login attempts from multiple IP addresses, but then suddenly the administrator cannot SSH in even with correct credentials. The administrator suspects a brute-force protection mechanism. The server uses PAM with pam_tally2 for login counting. The administrator checks /etc/pam.d/sshd and sees: auth required pam_tally2.so deny=3 unlock_time=300 onerr=succeed file=/var/log/tallylog. What is the most likely reason the administrator is locked out even after 5 minutes?

Accepted Answer

The root account is not subject to pam_tally2 without the 'even_deny_root' option, so the lockout is from another mechanism. Pam_tally2 does not apply to the root account unless the 'even_deny_root' option is explicitly added to the pam_tally2 configuration line. Since the administrator is likely logging in as root (or the root account is being targeted), the lockout observed is not from pam_tally2 but from another mechanism such as sshd's own MaxAuthTries or a separate service like fail2ban. The configuration shown only denies regular users after 3 failures and unlocks after 300 seconds, but root remains unaffected by this rule.

Answer

The SSH server is not configured with UsePAM yes, so pam_tally2 is not applied

Answer

The tallylog file has incorrect permissions, preventing pam_tally2 from reading the count

Answer

The DenyHosts service is running and blocks IPs after too many failures

Question 19

Which shebang ensures maximum portability across systems for a Python script?

Accepted Answer

#!/usr/bin/env python3. `#!/usr/bin/env python3` uses the `env` utility to locate the `python3` interpreter in the user's `PATH`, making the script portable across different Unix-like systems where Python 3 may be installed in various directories (e.g., `/usr/bin/python3`, `/usr/local/bin/python3`). This shebang avoids hardcoding an absolute path, which is the key to maximum portability.

Answer

#!/bin/python

Answer

#!/usr/bin/python

Answer

#!/usr/local/bin/python3

Question 20

Which of the following directories is defined by the Filesystem Hierarchy Standard (FHS) as containing essential user command binaries that need to be available in single-user mode?

Accepted Answer

/bin. /bin contains essential command binaries required for booting and single-user mode.

Answer

/sbin

Answer

/opt/bin

Answer

/usr/bin