XK0-006 Practice Test 4 — 25 Questions

Question 1

An administrator needs to create a hard link to an existing file. Which two statements are true about hard links? (Choose two.)

Accepted Answer

Hard links are indistinguishable from the original file. Hard links share the same inode and cannot span filesystems. They cannot link to directories.

Answer

Hard links can be created for directories

Answer

Hard links can be created across different filesystems

Answer

Deleting the original file removes the hard link

Question 2

A Linux administrator discovers that a user's home directory contains a file with setuid bit set, owned by root. The file is not part of any authorized software. What is the most appropriate immediate action?

Accepted Answer

Remove the setuid bit with 'chmod u-s <file>'. The immediate priority is to neutralize the unauthorized setuid root binary, which poses a privilege escalation risk. Removing the setuid bit with 'chmod u-s' disables the ability for any user to execute the file with root privileges, containing the threat without destroying evidence that may be needed for forensic analysis. This aligns with security best practices of preserving artifacts while mitigating active risks.

Answer

Move the file to /tmp for further analysis

Answer

Delete the file immediately to remove the threat

Answer

Change the file owner to the user with 'chown user:user <file>'

Question 3

In a Bash script, what is the difference between single quotes and double quotes?

Accepted Answer

Single quotes prevent variable expansion; double quotes allow it.. Single quotes preserve the literal value of each character, while double quotes allow variable expansion and command substitution.

Answer

Both behave the same.

Answer

Single quotes allow variable expansion; double quotes do not.

Answer

Double quotes prevent all substitutions; single quotes allow command substitution.

Question 4

Which command displays the current SELinux mode?

Accepted Answer

getenforce. The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It directly queries the SELinux status from the kernel and returns the current enforcement state without requiring elevated privileges. This makes it the correct command for simply viewing the current mode.

Answer

selinuxenabled

Answer

sestatus

Answer

setenforce

Question 5

A Linux system fails to boot after a disk replacement. The administrator examines /etc/fstab and sees the above. What is the most likely result of this configuration?

Accepted Answer

The system will boot into an emergency shell. The /etc/fstab entry contains an incorrect UUID for the root filesystem. During boot, systemd reads fstab and attempts to mount the root partition using the specified UUID. When the UUID does not match any available block device, the mount fails, and because the root filesystem is critical, the system drops into an emergency shell to allow manual intervention.

Answer

The system will boot normally using the device name

Answer

The system will ignore the incorrect UUID and try next entry

Answer

The system will prompt for manual fsck

Question 6

A developer reports that a Docker container on a CentOS 7 host cannot connect to the internet. The host itself can access the internet. The container is started with default bridge network. The administrator checks iptables and sees the FORWARD policy is DROP. What is the most likely cause and solution?

Accepted Answer

Add iptables rules to allow forwarding and enable masquerading.. The default Docker bridge network relies on iptables NAT (masquerading) and FORWARD rules to allow containers to reach external networks. When the FORWARD policy is set to DROP, the host drops all forwarded packets from the container, blocking outbound internet access. Adding iptables rules to allow forwarding (e.g., `-A FORWARD -i docker0 -j ACCEPT`) and enabling masquerading (e.g., `-t nat -A POSTROUTING -s 172.17.0.0/16 -o eth0 -j MASQUERADE`) restores connectivity.

Answer

The container needs to be run with --network host.

Answer

The container's DNS configuration is incorrect.

Answer

AppArmor is blocking outbound connections.

Question 7

A security policy requires that SSH root login be disabled, but key-based authentication for users should remain enabled. Which configuration line should be added to /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin prohibit-password. The directive `PermitRootLogin prohibit-password` in `/etc/ssh/sshd_config` disables password-based authentication for the root user while still allowing key-based authentication (e.g., SSH public key or GSSAPI). This satisfies the security policy requirement to disable root login via passwords but retain the ability for users (including root) to authenticate using SSH keys.

Answer

PermitEmptyPasswords no

Answer

PermitRootLogin no

Answer

PasswordAuthentication yes

Question 8

An administrator wants to change the runlevel/target to a state where only a minimal set of processes is running, and network services are disabled. Which two systemd targets achieve this? (Choose two.)

Accepted Answer

rescue.target. (rescue.target) is correct because it boots the system into a single-user mode with a minimal set of processes and no network services, allowing administrative tasks like filesystem repairs. Option E (emergency.target) is correct because it starts an even more minimal environment with only a root shell on the console, also disabling network services. Both targets satisfy the requirement of minimal processes and disabled networking.

Answer

graphical.target

Answer

poweroff.target

Answer

multi-user.target

Question 9

A system administrator is hardening SSH and needs to disable root login and password authentication. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and PasswordAuthentication no. Disabling root login and password authentication are two separate directives in sshd_config. PermitRootLogin no prevents direct SSH access for the root user, and PasswordAuthentication no disables password-based logins, forcing the use of key-based authentication. Both directives are required to meet the hardening goal.

Answer

PermitRootLogin no and ChallengeResponseAuthentication no

Answer

DenyUsers root and PasswordAuthentication no

Answer

PermitRootLogin prohibit-password and PasswordAuthentication yes

Question 10

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Accepted Answer

Set PermitRootLogin no in /etc/ssh/sshd_config. Setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct root login via SSH, forcing administrators to log in as a regular user and then use `su` or `sudo` for privilege escalation. This reduces the attack surface by eliminating the ability to brute-force the root password directly over SSH.

Answer

Set PermitRootLogin yes

Answer

Set PasswordAuthentication yes

Answer

Disable the SSH service

Question 11

A Docker container needs to persistently store data that should survive container removal and be accessible by other containers. Which storage method should be used?

Accepted Answer

Volume. Volumes are managed by Docker and persist independently of containers. Bind mounts depend on host filesystem structure. tmpfs is temporary and stored in memory. The question asks for persistent storage that can be shared, so volumes are best.

Answer

Bind mount

Answer

Container layer

Answer

tmpfs mount

Question 12

A Linux administrator needs to implement a cron job that runs a script every day at 2:30 PM. Which TWO cron schedule expressions are equivalent?

Accepted Answer

30 14 * * *. In cron syntax, the first field is minute (0-59), the second is hour (0-23) in 24-hour format. 2:30 PM corresponds to hour 14 in 24-hour time. Therefore, '30 14 * * *' correctly specifies the job runs at minute 30 of hour 14 every day. Option A and E are identical and both use the correct 24-hour representation.

Answer

30 2 * * * PM

Answer

30 2 * * *

Answer

30 2 * * *

Question 13

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

Accepted Answer

strace -p <PID>. strace can attach to a running process with -p PID and display all system calls made by the process.

Answer

tcpdump -i any

Answer

ltrace -p <PID>

Answer

lsof -p <PID>

Question 14

A technician needs to troubleshoot a network connectivity issue on a Linux server. The server can ping its own IP address but cannot ping the default gateway. Which of the following is the most likely cause?

Accepted Answer

The Ethernet cable is disconnected or the switch port is down.. The server can ping its own IP address (loopback or local interface), confirming that the network stack is functioning and the interface is up. However, the inability to ping the default gateway indicates a Layer 1 or Layer 2 issue, such as a disconnected Ethernet cable or a switch port that is administratively down, which prevents any traffic from leaving the local subnet.

Answer

The default gateway is misconfigured in the routing table.

Answer

The DNS resolver is not configured correctly.

Answer

The iptables firewall is blocking outgoing ICMP traffic.

Question 15

An administrator needs to find all files in /var/log that have been modified within the last 2 days. Which find command should be used?

Accepted Answer

find /var/log -mtime -2. -mtime -2 means modified less than 2 days ago (i.e., within the last 48 hours).

Answer

find /var/log -mtime +2

Answer

find /var/log -atime -2

Answer

find /var/log -ctime 2

Question 16

Refer to the exhibit. A system administrator checks the status of the SSH service and sees the output shown. What is the most likely cause of the failure?

Accepted Answer

Another process is already listening on port 22.

Answer

The SSH service is disabled and needs to be enabled.

Answer

The SSH service is masked and cannot start.

Answer

The SSH configuration file has a syntax error.

Question 17

A sysadmin wants to run a containerized web application using Podman. The container needs to persist data across restarts. Which approach ensures data persistence?

Accepted Answer

Mount a host directory as a volume using -v.. Mounting a host directory as a volume using the `-v` flag (e.g., `podman run -v /host/path:/container/path ...`) ensures that data written inside the container is stored on the host filesystem. This data persists independently of the container's lifecycle, surviving container restarts, stops, or even removal. Podman, like Docker, treats volumes as external storage that outlives the container.

Answer

Run the container with --restart always.

Answer

Include the data using COPY in the Dockerfile.

Answer

Use docker commit to save changes.

Question 18

A user reports that a specific process is consuming too much CPU. The administrator needs to change the priority of the process to a lower value (nicer). Which command sequence is appropriate?

Accepted Answer

renice +10 -p <PID>. renice changes the priority of an already running process by PID.

Answer

nice -n -10 <PID>

Answer

kill -15 <PID>

Answer

chrt --idle <PID>

Question 19

Refer to the exhibit. Users report they cannot SSH to the server. Based on the logs, what is the most likely cause?

Accepted Answer

Host keys are missing or corrupted.

Answer

Firewall is blocking port 22.

Answer

The SSH service is not running.

Answer

SSH configuration has incorrect permissions.

Question 20

An administrator wants to view the contents of a compressed log file /var/log/syslog.2.gz without decompressing it to disk. Which two commands can be used to display the file contents? (Select TWO).

Accepted Answer

zcat /var/log/syslog.2.gz. zcat and gzcat (if available) decompress to stdout; some systems use zcat or gzip -dc.

Answer

gzcat /var/log/syslog.2.gz

Answer

less /var/log/syslog.2.gz

Answer

cat /var/log/syslog.2.gz