XK0-006 Practice Test 25 — 15 Questions

Question 1

An administrator wants to verify which RPM packages are installed on a Red Hat Enterprise Linux system. Which command displays that information?

Accepted Answer

rpm -qa. The `rpm -qa` command queries the RPM database and lists all installed packages on a Red Hat Enterprise Linux system. The `-q` flag enables query mode, and `-a` specifies all packages, making it the correct tool for this task.

Answer

dpkg -l

Answer

apt list --installed

Answer

yum list installed

Question 2

A Linux administrator is configuring secure remote access to a server. Which three of the following are recommended best practices for securing SSH? (Choose three.)

Accepted Answer

Enable public key authentication.. Public key authentication (Option A) is a recommended best practice because it uses asymmetric cryptography (RSA, ECDSA, or Ed25519) to authenticate users without transmitting passwords over the network. This eliminates the risk of password interception via man-in-the-middle attacks or brute-force attempts, as the private key never leaves the client and the server verifies only the corresponding public key.

Answer

Use password authentication only.

Answer

Change the default SSH port to a non-standard port.

Question 3

An administrator needs to capture network traffic on interface eth0, filter for packets to/from host 10.0.0.1, and save the output to a file for later analysis. Which command should be used?

Accepted Answer

tcpdump -i eth0 host 10.0.0.1 -w capture.pcap. The `tcpdump` command with the `host` filter captures all traffic (both source and destination) to or from the specified IP address, which matches the requirement to filter for packets to/from host 10.0.0.1. The `-i eth0` specifies the interface, and `-w capture.pcap` writes the output to a file for later analysis.

Answer

tcpdump -i eth0 src 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 dst 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 -n host 10.0.0.1 -w capture.pcap

Question 4

A Linux administrator receives reports that a server's root filesystem is completely full. They run `df -h` and see that the root partition is at 100% usage. Which command should they use NEXT to identify which directories are consuming the most space?

Accepted Answer

du -sh /* | sort -h. When a filesystem is full, the administrator must first identify which directories are consuming the most space. The `du` command with the `-s` and `-h` options provides a summary of disk usage per directory, and piping to `sort -h` orders the results by size. This quickly highlights the largest directories, enabling efficient troubleshooting.

Answer

fdisk -l

Answer

find / -type f -size +1G

Answer

ls -la /

Question 5

A user reports that a web server is unreachable. The administrator runs 'curl -I https://example.com' and gets no response. Which command should be used next to check if the server is reachable at the network level?

Accepted Answer

ping -c 4 example.com. The `curl -I` command failed to get a response, which could be due to a network-level issue rather than an application-layer problem. The `ping` command uses ICMP echo requests to test basic IP-level connectivity to the host, bypassing higher-layer protocols like HTTP/TLS. If the server is unreachable at the network layer, `ping` will show packet loss or timeouts, confirming a routing or firewall issue.

Answer

dig -x example.com

Answer

lsof -i :443

Answer

ss -tlnp | grep 443

Question 6

An organization uses Kubernetes to deploy containerized applications. A pod fails to start with an ImagePullBackOff error. What is the most likely cause?

Accepted Answer

The image name is misspelled or does not exist in the registry. The ImagePullBackOff error in Kubernetes indicates that the kubelet is unable to pull the container image from the specified registry. The most common cause is a misspelled image name or a non-existent image in the registry, which prevents the container runtime from fetching the image. This triggers a back-off mechanism where the kubelet retries the pull with increasing delays.

Answer

The pod exceeded its memory limit

Answer

The container port is already in use

Answer

The node is out of disk space

Question 7

An administrator needs to set a password expiration policy so that all users must change their password every 90 days. Which command and option accomplishes this for an existing user?

Accepted Answer

chage -M 90 . The `chage -M 90 ` command sets the maximum number of days a password is valid for an existing user. The `-M` option specifies the maximum password age in days, so after 90 days the user will be forced to change their password. This directly implements the required 90-day password expiration policy.

Answer

usermod -e 90 <username>

Answer

passwd -x 90 <username>

Answer

chage -W 90 <username>

Question 8

Which TWO conditions must be met for a user to successfully delete a file owned by a different user in a directory? (Choose two.)

Accepted Answer

The user has write permission on the directory. To delete a file in Linux, the user does not need any permissions on the file itself; instead, the user needs write permission on the directory because deleting a file modifies the directory's contents (removing the directory entry). Additionally, execute permission on the directory is required to access the directory and its inode entries, allowing the user to traverse the directory to locate the file. These two permissions together enable the deletion of a file owned by another user.

Answer

The user has write permission on the file

Answer

The user is the owner of the file

Answer

The user is a member of the group that owns the directory

Question 9

A technician needs to ensure a service can listen on TCP port 8443 using firewalld. Which command permanently adds the port to the default zone?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent. The correct syntax is firewall-cmd --add-port=8443/tcp --permanent. The other options either omit the protocol, use incorrect syntax, or forget --permanent.

Answer

firewall-cmd --add-port=8443 --permanent

Answer

firewall-cmd --add-port=8443/tcp

Answer

firewall-cmd --add-service=8443/tcp --permanent

Question 10

A Linux administrator is troubleshooting a service that fails to start. The service unit file is located at /etc/systemd/system/myservice.service. The administrator runs 'systemctl status myservice' and sees 'Active: failed (Result: exit-code)'. Which of the following commands will provide the most detailed information about why the service failed?

Accepted Answer

journalctl -u myservice. The journalctl -u myservice command retrieves all journal entries for the specified unit, including error messages and exit codes. This is the most detailed source of information for diagnosing why a service failed. Other commands show configuration or summary status but lack the runtime error details needed for troubleshooting.

Answer

systemctl cat myservice

Answer

systemctl show myservice

Answer

systemctl list-units --failed

Question 11

A Linux server has SELinux enabled. An administrator wants to temporarily set the SELinux mode to permissive without rebooting, then confirm the change. Which command should be used?

Accepted Answer

setenforce 0. The setenforce command changes the SELinux mode at runtime. Passing 0 selects permissive mode, where denials are logged but not enforced. This satisfies the requirement to switch temporarily without rebooting. Persistent changes require editing /etc/selinux/config, but the scenario explicitly asks for a runtime change.

Answer

setsebool -P httpd_can_network_connect on

Answer

semanage permissive -a httpd_t

Answer

restorecon -R /

Question 12

An administrator wants to replace all occurrences of 'oldstring' with 'newstring' in a configuration file named config.cfg, and save the changes. Which sed command should be used?

Accepted Answer

sed -i 's/oldstring/newstring/g' config.cfg. It uses -i for in-place editing and g to replace all occurrences on each line. Option A has -i but lacks g, so it replaces only the first occurrence per line. Option C adds an unnecessary i flag for case-insensitive matching, which deviates from the requirement to replace 'oldstring' exactly as given. Option D lacks -i, so changes are only printed to stdout and not saved.

Answer

sed -i 's/oldstring/newstring/' config.cfg

Answer

sed -i 's/oldstring/newstring/gi' config.cfg

Answer

sed 's/oldstring/newstring/' config.cfg

Question 13

A security auditor notices that users can set weak passwords on a Linux system. The administrator wants to enforce password complexity requiring a minimum of 12 characters, at least one uppercase letter, and at least one digit. Which PAM module should be configured in /etc/pam.d/common-password?

Accepted Answer

pam_pwquality.so. The pam_pwquality.so module is specifically designed to enforce password complexity policies, such as minimum length, required character classes (uppercase, lowercase, digits, special characters), and dictionary checks. Configuring it in /etc/pam.d/common-password allows the administrator to set parameters like minlen=12, ucredit=-1, and dcredit=-1 to meet the stated requirements. This module is the standard replacement for the older pam_cracklib.so.

Answer

pam_unix.so

Answer

pam_tally2.so

Answer

pam_faillock.so

Question 14

A company runs a critical web application on a single Linux server. The application consists of a Node.js backend and a PostgreSQL database. The server is running out of disk space frequently due to application logs. The administrator wants to implement a log rotation solution that is automated, minimizes data loss, and compresses old logs. The administrator has root access and wants to use built-in tools. Currently, logs are written to /var/log/app/access.log and /var/log/app/error.log. The application never closes its log files. Which of the following is the best course of action?

Accepted Answer

Configure logrotate with daily rotation, compression, and the copytruncate option.. Logrotate with the copytruncate option allows the log file to be rotated without requiring the application to close or reopen its file handles. This is essential since the application never closes its log files. Daily rotation with compression addresses the frequent disk space issue while minimizing data loss, and logrotate is a built-in Linux tool that runs automatically via cron.

Answer

Configure the systemd journal to capture the application logs and set MaxRetentionSec.

Answer

Create a cron job that runs every hour to move the logs to a backup directory and restart the application.

Answer

Configure logrotate with a weekly rotation and no copytruncate, since the application will eventually close the log files.

Question 15

A developer needs to grant a colleague read and write access to a directory /project, but the colleague should not have permission to delete any files created by the developer. The developer wants to set the directory so that all new files created in it automatically belong to the group 'project' and are writable by group. Which combination of configuration should be used?

Accepted Answer

chmod g+s /project && setfacl -m default:g:project:rw /project. It combines the setgid bit (`chmod g+s`) on the directory, which ensures new files inherit the group 'project', with a default ACL (`setfacl -m default:g:project:rw`) that grants read and write permissions to the group on newly created files. This setup gives the colleague (who is a member of the 'project' group) read/write access without delete permission on files owned by the developer, as the colleague cannot delete files they do not own unless the directory's sticky bit is set (which is not configured here).

Answer

chmod 1770 /project && usermod -aG project colleague

Answer

chmod g+s /project && setfacl -m g:project:rwx /project

Answer

chown .project /project && chmod 2775 /project