XK0-006 Practice Test 24 — 15 Questions

Question 1

A security audit identified that the /tmp directory is world-writable. Which THREE steps should be taken to secure /tmp on a Linux system? (Select THREE.)

Accepted Answer

Set the sticky bit on /tmp. Option A is correct because setting the sticky bit (chmod +t /tmp, shown as the t in drwxrwxrwt) ensures that only the owner of a file, the directory owner, or root can delete or rename files within /tmp, preventing users from tampering with each other's files in this shared world-writable directory. Option C is correct because mounting /tmp with nosuid prevents setuid/setgid bits on binaries placed in /tmp from being honored, blocking a common privilege-escalation vector in a world-writable location. Option D is correct because mounting /tmp with noexec prevents execution of binaries from /tmp, further reducing the attack surface for malware or exploit payloads dropped there. Option B is not appropriate because /tmp must remain world-writable for applications and users to create temporary files; removing world-writable permission would break normal system operation. Option E is incorrect because explicitly allowing exec on /tmp is the opposite of the hardening measure needed and would permit execution of untrusted binaries.

Answer

Remove world-writable permission from /tmp

Answer

Mount /tmp with the exec option

Question 2

Which THREE tools are commonly used for configuration management?

Accepted Answer

Chef. Chef (A) is a widely used configuration management tool that uses cookbooks and recipes to define and enforce the desired state of servers, making it a correct choice. Ansible (B) is a common agentless configuration management tool that applies playbooks over SSH to configure systems, so it is also correct. Puppet (C) is another established configuration management tool that uses a declarative manifest language and a master-agent architecture to manage configuration drift, confirming it as correct. Kubernetes (D) is a container orchestration platform rather than a configuration management tool, and Docker (E) is a containerization platform, so neither belongs in this category.

Answer

Kubernetes

Answer

Docker

Question 3

A system administrator wants to enforce a password policy requiring a minimum length of 12 characters, at least one uppercase letter, and one digit. Which PAM module should be configured?

Accepted Answer

pam_pwquality. pam_pwquality is the correct PAM module because it is specifically designed to enforce password complexity requirements, such as minimum length, uppercase letters, and digits, through configurable parameters like minlen, ucredit, and dcredit. It replaces the older pam_cracklib and is the standard module for password quality checks on modern Linux systems.

Answer

pam_unix

Answer

pam_faillock

Answer

pam_tally2

Question 4

An administrator is troubleshooting a server that is experiencing intermittent high load. The administrator wants to identify processes that are using excessive CPU. Which two of the following commands can provide real-time CPU usage per process? (Choose two.)

Accepted Answer

htop. A is correct because `htop` is an interactive process viewer that displays real-time CPU usage per process, with a color-coded interface and the ability to sort by CPU consumption. B is correct because `top` is the standard real-time system monitor that shows a dynamic list of processes and their current CPU utilization, updating every few seconds by default.

Answer

iostat

Answer

ps -aux

Answer

vmstat

Question 5

A storage administrator is troubleshooting high disk I/O latency. Which THREE tools can provide detailed block I/O statistics at the device level? (Choose three.)

Accepted Answer

iostat. B (iostat) is correct because it reports CPU utilization and device I/O statistics, including metrics like await, svctm, and %util, which are essential for diagnosing high disk I/O latency at the device level. It reads data from /proc/diskstats and provides per-device block I/O statistics.

Answer

dd

Answer

fstrim

Question 6

Which command would display the disk usage of each file and directory in /home in a human-readable format, but only showing one level deep?

Accepted Answer

du -h --max-depth=1 /home. du -h --max-depth=1 /home shows human-readable sizes for each item one level deep.

Answer

du -hs /home

Answer

du -h /home

Answer

df -h /home

Question 7

An administrator is troubleshooting a Pod in a Kubernetes cluster that is not starting. Which TWO kubectl commands are most useful for diagnosing the issue? (Choose TWO.)

Accepted Answer

kubectl logs <pod-name>. kubectl describe pod provides detailed event and status information, and kubectl logs retrieves container logs.

Answer

kubectl get nodes

Answer

kubectl apply -f pod.yaml

Answer

kubectl delete pod <pod-name>

Question 8

An administrator is troubleshooting a DNS issue and needs to query the authoritative name servers for example.com. Which dig command should be used?

Accepted Answer

dig example.com NS. The NS (Name Server) record type identifies the authoritative name servers for a domain. Running 'dig example.com NS' queries those NS records directly, showing which servers are authoritative for example.com. This is the correct query to enumerate authoritative name servers.

Answer

dig example.com MX

Answer

dig example.com A

Answer

dig example.com ANY

Question 9

Which command displays the number of lines, words, and characters in a file?

Accepted Answer

wc file.txt. The `wc` command without any options displays the number of lines, words, and characters in a file, in that order. By default, `wc` counts newline characters (lines), whitespace-delimited tokens (words), and bytes (characters) in the specified file. This makes option A the correct choice for displaying all three counts.

Answer

wc -w file.txt

Answer

cat file.txt | wc -l

Answer

stat file.txt

Question 10

A Linux administrator needs to schedule a script to run every Monday at 3:00 AM. The script is located at /usr/local/bin/backup.sh. The administrator wants to use a systemd timer instead of cron. Which pair of files is required to implement this?

Accepted Answer

A .service unit and a .timer unit. To schedule a task with systemd, you need a .timer unit that specifies the schedule using OnCalendar, and a .service unit that contains the ExecStart command. The timer activates the service at the defined times. Other unit types like .socket, .path, or .target serve different purposes and cannot replace the .service unit for executing the script.

Answer

A .service unit and a .socket unit

Answer

A .timer unit and a .path unit

Answer

A .timer unit and a .target unit

Question 11

A Linux server that hosts a critical database application has been experiencing occasional kernel panics. The administrator wants to ensure the system automatically reboots after a panic and logs the crash dump. Which sysctl parameter should be set?

Accepted Answer

kernel.panic = 10. Setting `kernel.panic = 10` instructs the Linux kernel to wait 10 seconds after a kernel panic before automatically rebooting. This ensures the system recovers without manual intervention, and combined with a configured crash dump mechanism (e.g., kdump), the crash dump is captured before the reboot.

Answer

kernel.panic_on_warn = 10

Answer

kernel.panic_on_oops = 10

Answer

kernel.panic_print = 10

Question 12

Which TWO commands display disk usage information for filesystems? (Select 2.)

Accepted Answer

du. The `df` command (disk free) reports the amount of available and used disk space on all mounted filesystems, while `du` (disk usage) estimates file and directory space usage. Both commands are standard tools for displaying disk usage information for filesystems in Linux.

Answer

ls

Answer

parted

Answer

fdisk

Question 13

A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)

Accepted Answer

last. The `last` command (A) reads /var/log/wtmp and displays a chronological list of all successful user logins, logouts, and system reboots, making it a primary tool for reviewing login history. The `lastlog` command (B) reads /var/log/lastlog and reports the most recent login for every user account, which is useful for spotting accounts that have never logged in or that logged in unexpectedly. The `lastb` command (C) reads /var/log/btmp and lists failed login attempts, which is essential when investigating a potential breach involving brute-force or unauthorized access attempts. Options D and E are incorrect because /var/log/syslog and /var/log/messages are general-purpose system logs that capture a broad mix of kernel, service, and application messages; while they may incidentally contain authentication-related entries, they are not dedicated login-history sources like wtmp, lastlog, and btmp.

Answer

/var/log/syslog

Answer

/var/log/messages

Question 14

A system administrator is configuring a firewall using iptables. The requirement is to allow incoming SSH connections from the 192.168.1.0/24 network only. Which iptables rule should be added to the INPUT chain?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. It uses the `-s` (source) flag to specify the 192.168.1.0/24 network, ensuring only incoming SSH traffic (TCP port 22) from that subnet is accepted. The `-A INPUT` appends this rule to the INPUT chain, which processes incoming packets destined for the local system. This matches the requirement exactly.

Answer

iptables -A INPUT -p tcp --dport 22 -d 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j REJECT

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j LOG

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Question 15

Which of the following commands will display the last 10 lines of a log file and also output new lines as they are appended?

Accepted Answer

tail -f logfile. The `tail -f logfile` command displays the last 10 lines of the file by default and then continues to monitor the file for new lines, outputting them as they are appended. The `-f` (follow) option keeps the file open and polls for changes, making it the standard tool for real-time log monitoring.

Answer

head -f logfile

Answer

less +F logfile

Answer

cat logfile