XK0-006 Practice Test 22 — 15 Questions

Question 1

Match each SELinux context component to its description.

Accepted Answer

user: An SELinux user identity that is authorized for a role.. SELinux contexts are structured as user:role:type:level. The user identifies the SELinux user, role defines accessible types, type controls access, and level specifies sensitivity. Common confusions involve swapping user and type definitions.

Answer

user: The security context for processes (domain) and objects.

Answer

type: An SELinux user identity that is authorized for a role.

Question 2

A Linux administrator is writing a systemd service unit file. Which three of the following directives are valid in the [Service] section? (Select THREE.)

Accepted Answer

Restart. Option A, Restart, is valid in the [Service] section and controls whether and how systemd restarts the service after it exits (e.g., Restart=on-failure). Option D, User, is valid in the [Service] section and specifies the UNIX user account under which the service process is executed. Option E, ExecStart, is valid in the [Service] section and defines the command line that systemd runs to start the service. Options B (After) and C (Requires) are not valid in [Service]; they are dependency/ordering directives that belong in the [Unit] section of the unit file.

Answer

After

Answer

Requires

Question 3

A Linux administrator needs to identify which of the following filesystems are journaling filesystems commonly used in Linux. (Choose three.)

Accepted Answer

ext4. ext4 (B) is a journaling filesystem that maintains a journal to record metadata changes before committing them, enabling fast recovery after crashes, and it is the default on many Linux distributions. btrfs (D) is a copy-on-write filesystem with built-in journaling-like consistency via its COW transaction mechanism, widely used in Linux for snapshots and checksumming. xfs (E) is a high-performance journaling filesystem developed by SGI and commonly used in Linux for large files and parallel I/O. swap (A) is not a filesystem for storing files but a raw swap space used for virtual memory paging, and FAT32 (C) is a non-journaling filesystem from the FAT family that lacks journaling and metadata consistency features.

Answer

swap

Answer

FAT32

Question 4

A system administrator is tasked with ensuring that users cannot delete files owned by other users in a shared directory. Which permission should be set on the directory?

Accepted Answer

Set the sticky bit. The sticky bit (chmod +t) on a directory restricts deletion so that only the file owner, the directory owner, or root can remove files, even if the directory has world-writable permissions. This directly prevents users from deleting files owned by others in a shared directory, which is the requirement.

Answer

Apply an ACL

Answer

Set the SGID bit

Answer

Set the SUID bit

Question 5

A user is unable to resolve hostnames on a Linux system. Which three configuration files should be checked? (Select THREE).

Accepted Answer

/etc/hosts. Option A, /etc/hosts, is correct because it provides static hostname-to-IP mappings that the resolver consults, and a missing or malformed entry there can break name resolution for local or manually defined hosts. Option B, /etc/nsswitch.conf, is correct because its 'hosts:' line determines the order and sources (e.g., files, dns, myhostname) used by the Name Service Switch, so a misconfigured entry can prevent DNS or /etc/hosts from being queried at all. Option C, /etc/resolv.conf, is correct because it defines the DNS nameservers, search domains, and resolver options used for hostname lookups; missing or unreachable nameserver entries directly cause resolution failures. Option D, /etc/hostname, only sets the local system's own hostname and does not affect how the resolver looks up other hosts. Option E, /etc/sysconfig/network, is a Red Hat-style file for global network settings such as hostname and gateway, not a resolver configuration file, so it is not one of the three files to check for hostname resolution.

Answer

/etc/hostname

Answer

/etc/sysconfig/network

Question 6

A user wants to execute a command inside a running Docker container named 'db'. Which command should be used?

Accepted Answer

docker exec -it db bash. 'docker exec -it db bash' runs a new interactive process (bash) inside the already-running container named 'db', attaching a TTY and keeping stdin open. This is the standard way to get a shell or run a one-off command in a live container without disturbing its main process. It does not restart or replace the container's entrypoint.

Answer

docker attach db

Answer

docker start -i db

Answer

docker run -it db bash

Question 7

Which command will display the disk usage of each file and directory in the current directory?

Accepted Answer

du -sh *. `du -sh *` calculates and displays the disk usage of each file and directory in the current directory. The `-s` flag summarizes each item, `-h` provides human-readable sizes (e.g., KB, MB), and the `*` wildcard expands to all non-hidden entries in the current directory, making it the precise command for this task.

Answer

df -h

Answer

ls -lh

Answer

fdisk -l

Question 8

A Linux administrator needs to add a new user named 'jdoe' with a home directory and a bash shell. Which command accomplishes this?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command with -m creates the home directory and -s /bin/bash sets the login shell, so 'useradd -m -s /bin/bash jdoe' creates user jdoe with a home directory and bash shell in one step. This is the canonical low-level command on RHEL/CentOS and other systemd-based distributions for non-interactive user creation.

Answer

usermod -m -s /bin/bash jdoe

Answer

adduser jdoe --home /home/jdoe --shell /bin/bash

Answer

passwd -m jdoe

Question 9

A system administrator is troubleshooting a DNS resolution issue. The command `dig example.com` returns a response, but `ping example.com` fails with 'ping: example.com: Name or service not known'. Which of the following is the most likely cause?

Accepted Answer

The system resolver is using different DNS servers than dig. The `dig` command bypasses the system resolver and queries the DNS server directly, so it can resolve the name even if the resolver is misconfigured. `ping` uses the system resolver (glibc's `gethostbyname` or `getaddrinfo`), which may be configured to use different DNS servers (e.g., via NetworkManager, systemd-resolved, or a local caching resolver). This mismatch causes `ping` to fail while `dig` succeeds.

Answer

An incorrect entry in /etc/hosts

Answer

The Name Service Cache Daemon (nscd) is not running

Answer

The DNS server is not configured in /etc/resolv.conf

Answer

A firewall is blocking ICMP packets

Question 10

Which tool is used for encrypting files with public-key cryptography on Linux systems?

Accepted Answer

GnuPG. GnuPG (GNU Privacy Guard) is the correct tool because it implements the OpenPGP standard (RFC 4880) for encrypting and signing files using public-key cryptography. It allows users to generate a key pair, encrypt a file with the recipient's public key, and decrypt it with the corresponding private key, making it the standard Linux utility for asymmetric file encryption.

Answer

bcrypt

Answer

LUKS

Answer

OpenSSL

Question 11

A Linux system experiences high CPU usage from a process that appears to be a fork bomb. The administrator wants to prevent such attacks in the future by limiting the number of processes a user can create. Which configuration file should be modified, and what parameter should be set?

Accepted Answer

Add 'username hard nproc 100' in /etc/security/limits.conf. /etc/security/limits.conf is the PAM-based configuration file used to set per-user resource limits via the 'nproc' parameter. Adding 'username hard nproc 100' enforces a hard limit of 100 processes for that user, preventing a fork bomb from exhausting system resources.

Answer

Set 'kernel.pid_max=100' in /etc/sysctl.conf

Answer

Set 'DefaultLimitNPROC=100' in /etc/systemd/system.conf

Answer

Add 'ulimit -u 100' to /etc/profile

Question 12

A Linux administrator is writing a bash script that accepts command-line options: -a for all, -f for file, and -o for output. Which of the following correctly uses getopts to parse these options?

Accepted Answer

while getopts "afo" opt; do case $opt in a) ...;; f) ...;; o) ...;; esac; done. getopts uses a string of option characters; a colon after an option indicates it requires an argument. The correct usage is 'a:f:o' where a and f require arguments, but the stem doesn't specify arguments. Assuming -a and -f don't require arguments, the string should be 'afo'.

Answer

while getopts "-a -f -o" opt; do ... done

Answer

while getopts "a:f:o" opt; do case $opt in a) ...;; f) ...;; o) ...;; esac; done

Answer

getopts "afo" opt; case $opt in a) ...;; f) ...;; o) ...;; esac

Question 13

An administrator is writing a Dockerfile. They need to set a default command that can be overridden when running the container. Which instruction should be used?

Accepted Answer

CMD. CMD provides defaults that can be overridden by command-line arguments, while ENTRYPOINT cannot be easily overridden without --entrypoint.

Answer

RUN

Answer

ENTRYPOINT

Answer

EXPOSE

Question 14

A Linux administrator is writing a Bash script that must parse command-line options, accept a required input file argument, and provide a help message when invoked with -h. The script will be run on several distributions. Which TWO practices should the administrator follow? (Choose two.)

Accepted Answer

Use getopts to process short options and validate that required arguments are present before proceeding.. Portable option parsing and clear error handling are the two practices that make the script usable across distributions. getopts handles short options and required arguments in a POSIX-compliant way, while a dedicated usage function standardizes the help and error output. Together they ensure -h works, missing arguments are detected, and failures are reported through exit status.

Answer

Hard-code the input file path inside the script so the required argument is always available.

Answer

Rely on the positional parameters $1 and $2 directly and check only that $# is greater than zero.

Answer

Use getopt (the external utility) with the long-option form and eval to reorder arguments before parsing.

Question 15

A user wants to create a hard link to a file. Which three conditions must be true for a hard link to be created successfully? (Choose three.)

Accepted Answer

The source and link must be on the same filesystem.. Option C is correct because a hard link is simply a directory entry that points to the same inode, and inode numbers are only unique within a single filesystem, so the source and the new link must reside on the same filesystem (e.g., both under the same mount point). Option D is correct because hard links to directories are prohibited on Linux/Unix to prevent cycles in the directory tree, so the source must be a regular file (or another non-directory file type). Option E is correct because the link() system call requires an existing source pathname to resolve to an inode; you cannot create a hard link to a file that does not exist. Option A is not required since the SUID bit is a permission attribute unrelated to link creation, and Option B is wrong because a hard link may have any name and is not required to match the source filename.

Answer

The source file must have the SUID bit set.

Answer

The link must have the same name as the source.