XK0-005 Practice Test 5 — 25 Questions

Question 1

A developer is writing a Bash script that must be portable across different Linux distributions. The script needs to check if a package is installed. Which command should be used to achieve this portability?

Accepted Answer

command -v package. The `command -v package` command is the most portable way to check if a package is installed across different Linux distributions because it uses the POSIX-standard `command` shell built-in, which works in any Bourne-compatible shell (bash, sh, dash, etc.) regardless of the underlying package manager. It returns the path to the executable if the package's binary is in the PATH, or nothing if it is not installed, making it distribution-agnostic.

Answer

which package

Answer

dpkg -l package

Answer

rpm -q package

Question 2

Which TWO options are valid ways to pass environment variables to a Docker container?

Accepted Answer

--env-file file. Option B is correct because the `--env-file` flag allows you to pass a file containing environment variables to a Docker container, where each line in the file is in `KEY=value` format. Option C is correct because the `-e` (or `--env`) flag directly sets an environment variable inside the container, e.g., `-e VAR=value`. Both are standard Docker CLI methods for injecting environment variables at container runtime.

Answer

--var VAR=value

Answer

--variable VAR=value

Answer

-v VAR=value

Question 3

A senior administrator is troubleshooting a shell script that fails to execute properly. The script starts with #!/bin/bash and has execute permissions. Which of the following could cause the script to fail to run when invoked as ./script.sh?

Accepted Answer

The script contains carriage return characters (\r).. Option B is correct because carriage return characters (\r) are a common issue when scripts are edited on Windows and then transferred to Linux. The shebang line #!/bin/bash expects a Unix-style line ending (LF), but \r characters cause the shell to interpret the command interpreter as '/bin/bash\r', which is not a valid executable path. This results in a 'No such file or directory' error when the script is invoked as ./script.sh, even though permissions are correct.

Answer

The shebang line is not on the first line.

Answer

The script uses #!/bin/sh instead of bash.

Answer

The script starts with a byte order mark (BOM).

Question 4

Which command will show the current running processes in real time?

Accepted Answer

top. The `top` command is the standard Linux utility for displaying a dynamic, real-time view of running processes, including CPU and memory usage. It updates the display at a configurable interval (default 3 seconds) and provides an interactive interface for sorting and managing processes. This makes it the correct choice for showing current running processes in real time.

Answer

pstree

Answer

ps aux

Answer

htop

Question 5

A security policy requires that containers run with minimal privileges. Which THREE measures should be implemented? (Select THREE.)

Accepted Answer

Use --security-opt seccomp=default. Option A is correct because the `--security-opt seccomp=default` flag applies the default seccomp (secure computing mode) profile, which restricts the system calls available to the container. This enforces the principle of least privilege by blocking dangerous syscalls (e.g., `mount`, `reboot`) while allowing necessary ones, reducing the attack surface without manual profile creation.

Answer

Mount host filesystem read-write

Answer

Expose all ports to host

Question 6

A junior administrator needs to check the disk usage of the /var filesystem to ensure it does not exceed 80% capacity. Which command should be used?

Accepted Answer

df -h /var. The `df -h /var` command displays disk usage for the `/var` filesystem in human-readable format (e.g., GB, MB). This is the correct tool to check filesystem capacity and usage percentage, which directly answers whether usage exceeds 80%.

Answer

fdisk -l /var

Answer

du -sh /var

Answer

lsblk /var

Question 7

A Linux system is experiencing high CPU load. The administrator runs 'top' and sees that the 'kworker' processes are consuming significant CPU time. What is the most likely cause?

Accepted Answer

A hardware interrupt storm caused by a failing disk controller. The 'kworker' processes in the 'top' output indicate kernel workqueue threads that handle deferred work. High CPU usage by kworker is typically caused by a hardware interrupt storm, often from a failing disk controller or other faulty hardware generating excessive interrupts that the kernel must service. This forces the workqueue to constantly process interrupt-related tasks, consuming significant CPU time.

Answer

A kernel module memory leak

Answer

A user process stuck in an infinite loop

Answer

Insufficient memory causing swapping

Question 8

A Linux server runs a web application that frequently runs out of file descriptors. Which configuration change would permanently increase the maximum number of open files for all users?

Accepted Answer

Edit /etc/security/limits.conf and add 'soft nofile 65536' and 'hard nofile 65536'. Option D is correct because editing /etc/security/limits.conf with both 'soft nofile' and 'hard nofile' entries permanently raises the per-user limit on open file descriptors for all users (or specified users/groups) at login. The soft limit is the current working limit, while the hard limit is the maximum ceiling; setting both ensures the user can reach the desired value without needing to run ulimit with root privileges.

Answer

Set 'fs.file-max = 65536' in /etc/sysctl.conf

Answer

Add 'session required pam_limits.so' to /etc/pam.d/login

Answer

Run 'ulimit -n 65536' in a startup script

Question 9

A Linux administrator is troubleshooting a server that intermittently becomes unresponsive. The administrator suspects a memory leak. Which command should be used to monitor memory usage over time and identify the consuming process?

Accepted Answer

top. The `top` command provides a real-time, dynamic view of system processes, including memory usage (RES, VIRT, %MEM) and can be sorted by memory consumption. It updates continuously, making it ideal for monitoring memory usage over time and identifying the specific process responsible for a suspected memory leak.

Answer

free -h

Answer

ss -tuln

Answer

df -h

Question 10

A Linux engineer is troubleshooting a server that fails to boot. The server displays a message indicating 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which TWO actions should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Boot from a rescue disk and rebuild the initramfs with the necessary filesystem modules. The error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or mount the root filesystem. Option B is correct because rebuilding the initramfs from a rescue disk ensures the necessary filesystem drivers (e.g., ext4, xfs) are included, which may have been missing or corrupted. Option D is correct because the root= parameter in the bootloader configuration (e.g., GRUB) tells the kernel which device/partition to mount as root; a typo or incorrect value (e.g., wrong UUID or device name) will cause this exact panic.

Answer

Reinstall GRUB to the Master Boot Record

Answer

Run fsck on the root partition to check for filesystem corruption

Answer

Disable SELinux by adding selinux=0 to the kernel command line

Question 11

A system administrator needs to check the current runlevel on a system that uses systemd. Which command should the administrator use?

Accepted Answer

systemctl get-default. Option C is correct because `systemctl get-default` displays the default target (runlevel equivalent) on a systemd-based Linux system. Systemd uses targets instead of traditional SysV runlevels, and this command shows which target is set as the default at boot, such as `multi-user.target` or `graphical.target`.

Answer

hostnamectl

Answer

getenforce

Answer

uname -r

Question 12

A systems administrator needs to restrict SSH access to a Linux server so that only users in the 'sshusers' group can log in. Which configuration change should be made in /etc/ssh/sshd_config?

Accepted Answer

Add 'AllowGroups sshusers'. Option C is correct because the 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH login to only users who are members of the specified group. By adding 'AllowGroups sshusers', only users in the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This is the standard OpenSSH mechanism for group-based access control.

Answer

Add 'AllowUsers sshusers'

Answer

Add 'DenyGroups all'

Answer

Add 'PermitRootLogin no' and add users to sshusers

Question 13

An administrator needs to update the system time using an NTP server immediately without waiting for the next scheduled sync. Which command should be used?

Accepted Answer

ntpdate pool.ntp.org. The `ntpdate` command is used to immediately synchronize the system clock with an NTP server, bypassing the daemon-based scheduled sync. Option D runs `ntpdate pool.ntp.org`, which performs a one-time query and sets the time instantly, making it the correct choice for an immediate update.

Answer

timedatectl set-ntp true

Answer

systemctl start ntpd

Answer

ntpq -p

Question 14

A company requires that all systems be configured to log all authentication attempts, both successful and failed. Which configuration file and directive should be used to ensure all auth messages are logged to /var/log/secure?

Accepted Answer

In /etc/rsyslog.conf: authpriv.* /var/log/secure. In rsyslog, the `authpriv` facility covers authentication and authorization messages, including both successful and failed login attempts. The directive `authpriv.* /var/log/secure` directs all messages from this facility to `/var/log/secure`, which is the standard secure log file on RHEL/CentOS systems. This meets the requirement to log all authentication attempts.

Answer

In /etc/rsyslog.conf: *.info /var/log/secure

Answer

In /etc/rsyslog.conf: auth.* /var/log/secure

Answer

In /etc/rsyslog.conf: kern.* /var/log/secure

Question 15

A Linux system is experiencing kernel panics after a recent update. The administrator wants to boot into a previous kernel version to restore functionality. Which three steps are required to achieve this? (Select THREE).

Accepted Answer

After booting, edit /etc/default/grub and set GRUB_DEFAULT to the saved entry, then run update-grub. Option A is correct because after booting into a working kernel, editing /etc/default/grub to set GRUB_DEFAULT to 'saved' and running update-grub (or grub-mkconfig) ensures that the GRUB bootloader will remember and default to the last successfully booted kernel, which can be the previous version. This step is necessary to make the temporary fix persistent across reboots.

Answer

Run 'yum reinstall kernel' to revert to the previous version

Answer

Edit /etc/fstab to change root filesystem parameters

Question 16

Based on the exhibit, what is the most likely cause of the sshd service failure?

Accepted Answer

Another process is already listening on port 22. The sshd service failed because another process is already listening on port 22, which prevents sshd from binding to that port. This is indicated by the error message in the exhibit (e.g., 'bind: Address already in use'), which is a common symptom when a conflicting service or a previously running instance of sshd occupies the port. The system cannot start a new instance of sshd until the port is freed.

Answer

The firewall is blocking port 22

Answer

The sshd configuration file has incorrect permissions

Answer

The sshd service is not installed

Question 17

A system administrator notices that a server's disk space is critically low. Which command should be used to identify the largest files or directories consuming space?

Accepted Answer

du -sh /*. Option D is correct because `du -sh /*` recursively calculates disk usage for each top-level directory and file under root, summarizing sizes in human-readable format. This directly identifies the largest space consumers, which is the stated goal. The `-s` flag provides a total per argument, and `/*` targets all immediate children of `/`.

Answer

ls -la /

Answer

fdisk -l

Answer

df -h

Question 18

A technician needs to find out which port the SSH daemon is listening on. Which command will show this information?

Accepted Answer

ss -tlnp. The `ss -tlnp` command displays listening TCP sockets with numeric addresses and the associated process information. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` prevents DNS resolution, and `-p` reveals the PID and program name. Since SSH daemon (sshd) listens on TCP port 22 by default, this command will show the listening port and the sshd process.

Answer

lsof -i :22

Answer

nmap -p 22 localhost

Answer

netstat -i

Question 19

An administrator needs to ensure that a custom script /usr/local/bin/backup.sh runs every day at 2:00 AM and logs output to /var/log/backup.log. How should this be configured using systemd?

Accepted Answer

Create a systemd timer unit that activates a service unit, with OnCalendar=daily and the desired time.. Option C is correct because systemd timer units are the modern, recommended method for scheduling recurring tasks on Linux systems that use systemd. By creating a timer unit with `OnCalendar=daily` and specifying the desired time (e.g., `02:00:00`), the associated service unit will execute `/usr/local/bin/backup.sh` at 2:00 AM daily. The service unit can also redirect output to `/var/log/backup.log` using standard output/error directives, ensuring logging is handled natively within the systemd framework.

Answer

Use anacron with a delay of 0 and a period of 1 day.

Answer

Add a cron job with '0 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1'.

Answer

Place the script in /etc/cron.daily/ and set the time with the 'START_HOURS_RANGE' variable.

Question 20

What does the output in the exhibit indicate about the /etc/shadow file?

Accepted Answer

The file has an SELinux context.. The output in the exhibit shows the SELinux context for the /etc/shadow file, which is indicated by the string 'system_u:object_r:shadow_t:s0' appended to the file's permissions. This is the SELinux security context, consisting of user, role, type, and sensitivity level. The `ls -Z` command displays this context, confirming that the file has an SELinux label applied.

Answer

The file is encrypted.

Answer

The file has an ACL applied.

Answer

The file is compressed.