XK0-006 Practice Exam 4 — 20 Questions

Question 1

Match each Linux filesystem to its typical use case.

Accepted Answer

ext4: General-purpose filesystem for Linux desktops and servers. Correct matches: ext4 for general use, XFS for large files, Btrfs for advanced features. Common confusions: swap vs tmpfs where swap is disk-based virtual memory and tmpfs is RAM-based temporary storage.

Answer

swap: Temporary filesystem stored in RAM

Answer

tmpfs: Space on disk used as virtual memory

Question 2

A system administrator notices that the root filesystem is at 95% capacity. Which command should be used to identify the directories consuming the most space?

Accepted Answer

du -sh /*. B is correct because `du -sh /*` calculates disk usage for each top-level directory under root, showing human-readable sizes. This directly identifies which directories consume the most space, allowing the administrator to pinpoint the source of the 95% capacity issue.

Answer

df -h

Answer

fdisk -l

Answer

ls -la /

Question 3

A user is unable to create new files in a directory. Which command can the administrator use to view the Access Control Lists (ACLs) associated with that directory?

Accepted Answer

getfacl. The `getfacl` command displays the Access Control Lists (ACLs) for a file or directory, showing both the standard POSIX permissions and any additional ACL entries (e.g., specific users or groups). Since the user cannot create new files, ACLs may be restricting write access beyond the basic mode bits, making `getfacl` the correct tool to inspect these extended permissions.

Answer

ls -l

Answer

setfacl

Answer

chmod

Question 4

Based on the exhibit, what is the most likely cause of the sshd service failure?

Accepted Answer

Another process is already listening on port 22. The sshd service failed because another process is already listening on port 22, which prevents sshd from binding to that port. This is indicated by the error message in the exhibit (e.g., 'bind: Address already in use'), which is a common symptom when a conflicting service or a previously running instance of sshd occupies the port. The system cannot start a new instance of sshd until the port is freed.

Answer

The firewall is blocking port 22

Answer

The sshd configuration file has incorrect permissions

Answer

The sshd service is not installed

Question 5

Refer to the exhibit. A system administrator notices that backend1.example.com is receiving significantly more traffic than the other two servers. What is the most likely reason?

Accepted Answer

Weighted load balancing distributes traffic proportionally; backend1 has the highest weight.. The upstream block uses weighted round-robin with weights 5, 3, and 2. The total weight is 10, so backend1 receives 5/10 = 50% of requests, backend2 receives 30%, and backend3 receives 20%. This distribution matches the observed pattern. Option A is incorrect because session persistence is not configured. Option C is incorrect because there is no health check mechanism shown. Option D is irrelevant as the proxy_next_upstream directive only affects retries on failure.

Answer

Session persistence (sticky sessions) is enabled, routing returning users to the same server.

Answer

backend1 is the only server that passes health checks.

Answer

The proxy_next_upstream directive causes requests to be retried on backend1 first.

Question 6

A system administrator needs to monitor file access attempts to /etc/shadow using auditd. Which auditctl command sets up the watch?

Accepted Answer

auditctl -w /etc/shadow -p wa -k shadow_watch. The correct syntax is 'auditctl -w /etc/shadow -p wa -k shadow_watch'. The -w specifies the file, -p wa watches for write and attribute changes (access is implied), but the -k is for a key. The other options have incorrect flags or order.

Answer

auditctl -a always,exit -F path=/etc/shadow -F perm=wa -k shadow_watch

Answer

auditctl -W /etc/shadow -p rwxa -k shadow_watch

Answer

auditctl -w /etc/shadow -k shadow_watch

Question 7

An administrator needs to schedule a backup script located at '/usr/local/bin/backup.sh' to run every Sunday at 2:30 AM. The server uses cron for task scheduling. The administrator currently has the following crontab entry: '30 2 * * 0 /usr/local/bin/backup.sh'. However, the administrator wants to verify that the cron job is configured correctly and will run as expected. Which of the following commands should the administrator use to list the current user's cron jobs and verify the entry?

Accepted Answer

crontab -l. The 'crontab -l' command lists the current user's crontab entries. Option D is correct. 'cron -l' is not a valid command. 'cat /var/spool/cron/crontabs/root' might work for root but not for a regular user, and the path varies. 'systemctl status cron' shows the cron service status, not the job list.

Answer

cat /var/spool/cron/crontabs/root

Answer

systemctl status cron

Answer

cron -l

Question 8

Which THREE statements about Ansible are true? (Choose three.)

Accepted Answer

Ansible playbooks are written in YAML. Three statements about Ansible are true. Playbooks are written in YAML (A). Ansible is idempotent, meaning that applying the same configuration multiple times yields the same result (D). Additionally, Ansible requires Python on the control node only (C) because the control node runs the automation; managed nodes can be contacted via SSH or WinRM and may use raw modules that don't require Python, though most modules do expect Python on the managed node. Statement B is false because Ansible is agentless and does not use a centralized master server; it uses a push model from a control node. Statement E is false because Ansible is agentless—no agent is installed on managed nodes.

Answer

Ansible uses a centralized master server

Answer

Ansible requires an agent to be installed on managed nodes

Question 9

A server is experiencing high CPU load. The administrator needs to identify which process is consuming the most CPU resources in real time. Which command should be used?

Accepted Answer

top. The `top` command provides a real-time, dynamic view of running processes, including CPU usage, and updates continuously by default. It is the standard tool for identifying which process is currently consuming the most CPU resources on a Linux system.

Answer

w

Answer

vmstat

Answer

uptime

Answer

ps aux --sort=-%cpu

Question 10

During the boot process, after the kernel is loaded and the initramfs is executed, which component is responsible for starting the user-space services and managing the system state?

Accepted Answer

systemd. Systemd is the init system that starts services and manages targets. GRUB2 is the bootloader that loads the kernel. The kernel itself initializes hardware. Initramfs is an initial root filesystem used to load drivers.

Answer

initramfs

Answer

GRUB2

Answer

Kernel

Question 11

Refer to the exhibit. A system administrator notices that the SSH service has failed. What is the most likely cause?

Accepted Answer

Another process is already using port 22.. The error message indicates that the address is already in use, meaning another process is already listening on port 22.

Answer

The SSH configuration file has a syntax error.

Answer

The firewall is blocking port 22.

Answer

The SSH service is not enabled to start on boot.

Question 12

A Linux system fails to boot, and the administrator wants to access a minimal environment to repair the system. Which systemd target should be specified in the kernel command line to achieve this?

Accepted Answer

rescue.target. The rescue.target provides a minimal environment for system recovery.

Answer

emergency.target

Answer

multi-user.target

Answer

graphical.target

Question 13

Refer to the exhibit. A Linux administrator needs to capture all messages with priority 'alert' from the kernel facility. Which directive should be added to /etc/rsyslog.conf?

Accepted Answer

kern.alert /var/log/kernel_alert. The kernel facility is 'kern'. 'alert' priority is one of the syslog priorities. The correct syntax is 'kern.alert' to capture only alert messages from kernel.

Answer

kern.=alert /var/log/kernel_alert

Answer

kern.* /var/log/kernel_alert

Answer

*.alert /var/log/kernel_alert

Question 14

Refer to the exhibit. An administrator has configured audit rules but notices that 'auditctl -l' returns 'No rules'. What is the most likely issue?

Accepted Answer

The audit rules have not been loaded into the kernel.. The audit rules file is present but not loaded. The rules need to be loaded using 'auditctl -R /etc/audit/audit.rules' or by restarting auditd. The 'auditctl -l' shows no rules because they haven't been loaded.

Answer

The audit system is disabled.

Answer

The audit rules file has incorrect syntax.

Answer

The audit daemon is not running.

Question 15

Which of the following commands will display the last 10 lines of a log file and also output new lines as they are appended?

Accepted Answer

tail -f logfile. The `tail -f logfile` command displays the last 10 lines of the file by default and then continues to monitor the file for new lines, outputting them as they are appended. The `-f` (follow) option keeps the file open and polls for changes, making it the standard tool for real-time log monitoring.

Answer

head -f logfile

Answer

less +F logfile

Answer

cat logfile

Question 16

An administrator needs to create a hard link to an existing file. Which two statements are true about hard links? (Choose two.)

Accepted Answer

Hard links are indistinguishable from the original file. Hard links share the same inode and cannot span filesystems. They cannot link to directories.

Answer

Hard links can be created for directories

Answer

Hard links can be created across different filesystems

Answer

Deleting the original file removes the hard link

Question 17

A Linux administrator discovers that a user's home directory contains a file with setuid bit set, owned by root. The file is not part of any authorized software. What is the most appropriate immediate action?

Accepted Answer

Remove the setuid bit with 'chmod u-s <file>'. The immediate priority is to neutralize the unauthorized setuid root binary, which poses a privilege escalation risk. Removing the setuid bit with 'chmod u-s' disables the ability for any user to execute the file with root privileges, containing the threat without destroying evidence that may be needed for forensic analysis. This aligns with security best practices of preserving artifacts while mitigating active risks.

Answer

Move the file to /tmp for further analysis

Answer

Delete the file immediately to remove the threat

Answer

Change the file owner to the user with 'chown user:user <file>'

Question 18

In a Bash script, what is the difference between single quotes and double quotes?

Accepted Answer

Single quotes prevent variable expansion; double quotes allow it.. Single quotes preserve the literal value of each character, while double quotes allow variable expansion and command substitution.

Answer

Both behave the same.

Answer

Single quotes allow variable expansion; double quotes do not.

Answer

Double quotes prevent all substitutions; single quotes allow command substitution.

Question 19

Which command displays the current SELinux mode?

Accepted Answer

getenforce. The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It directly queries the SELinux status from the kernel and returns the current enforcement state without requiring elevated privileges. This makes it the correct command for simply viewing the current mode.

Answer

selinuxenabled

Answer

sestatus

Answer

setenforce

Question 20

A Linux system fails to boot after a disk replacement. The administrator examines /etc/fstab and sees the above. What is the most likely result of this configuration?

Accepted Answer

The system will boot into an emergency shell. The /etc/fstab entry contains an incorrect UUID for the root filesystem. During boot, systemd reads fstab and attempts to mount the root partition using the specified UUID. When the UUID does not match any available block device, the mount fails, and because the root filesystem is critical, the system drops into an emergency shell to allow manual intervention.

Answer

The system will boot normally using the device name

Answer

The system will ignore the incorrect UUID and try next entry

Answer

The system will prompt for manual fsck