XK0-006 Practice Test 5 — 25 Questions

Question 1

A system administrator wants to limit the number of simultaneous logins for a user to 2. Which file and parameter should be configured?

Accepted Answer

/etc/security/limits.conf: username hard maxlogins 2. The `/etc/security/limits.conf` file allows setting resource limits per user or group, and the `maxlogins` parameter specifically controls the maximum number of simultaneous logins for a user. The syntax `username hard maxlogins 2` enforces a hard limit of 2 concurrent sessions for that user, which is the exact requirement. This limit is enforced by the PAM module `pam_limits.so`, which must be configured in the appropriate PAM stack file (e.g., `/etc/pam.d/login` or `/etc/pam.d/sshd`).

Answer

/etc/pam.d/login: session required pam_limits.so

Answer

/etc/security/limits.conf: @users hard maxlogins 2

Answer

/etc/security/limits.conf: username soft nproc 2

Question 2

A developer creates a hard link to a file and then deletes the original file. What happens to the hard link?

Accepted Answer

The hard link still contains the data and is accessible.. Hard links share the same inode; deleting the original file removes one link, but the data remains accessible via the hard link until all links are removed.

Answer

The hard link is broken and cannot be accessed.

Answer

The hard link is automatically converted to a copy of the file.

Answer

The hard link becomes a symbolic link.

Question 3

A system administrator wants to encrypt a large directory of files using GPG with a symmetric cipher. Which two steps are necessary? (Select TWO).

Accepted Answer

Use a passphrase to encrypt. Symmetric encryption in GPG requires a passphrase to derive the encryption key. When using `gpg --symmetric`, the cipher key is generated from a passphrase provided by the user, making the passphrase the essential secret for both encryption and decryption. Without a passphrase, symmetric encryption cannot proceed.

Answer

gpg --decrypt file.gpg

Answer

gpg --encrypt --recipient user file

Answer

Import a public key

Question 4

Based on the exhibit, what is the most likely cause of the 'PV Status: not available'?

Accepted Answer

The physical volume is missing or disconnected.. The 'PV Status: not available' message in LVM indicates that the system cannot access the physical volume. This typically occurs when the underlying disk or partition is missing, disconnected, or has failed. Since LVM relies on the physical volume being present for volume group and logical volume operations, a missing or disconnected physical volume is the most direct cause.

Answer

The volume group is corrupted.

Answer

The logical volume is not mounted.

Answer

LVM metadata is damaged.

Question 5

A system administrator wants to create a bind mount in Docker to share a host directory `/data` with a container at `/mnt/data`. Which of the following docker run options should be used?

Accepted Answer

-v /data:/mnt/data. The -v /data:/mnt/data option creates a bind mount by mapping the host directory /data to the container path /mnt/data, which is exactly the requirement. Docker interprets a host path on the left of the colon as a bind mount, distinguishing it from a named volume. This is the classic syntax for sharing a host directory with a container.

Answer

--mount type=volume,source=/data,target=/mnt/data

Answer

-v /data:ro

Answer

-v /mnt/data:/data

Question 6

A Linux administrator wants to ensure a bash script stops execution immediately if any command fails. Which line should be added to the script?

Accepted Answer

set -e. `set -e` instructs bash to exit immediately if any command returns a non-zero exit status, which is exactly the fail-fast behavior the administrator wants. This prevents subsequent commands from running after a failure, avoiding cascading errors in scripts. It is the standard idiom for making bash scripts robust in automation and CI environments.

Answer

set -x

Answer

set -u

Answer

set -o pipefail

Question 7

A user reports that the /home partition is running out of space. Which command identifies the largest directories under /home?

Accepted Answer

du -sh /home/*. `du -sh /home/*` calculates the disk usage of each top-level item under /home, with `-s` summarizing each directory and `-h` providing human-readable sizes. This directly identifies the largest directories consuming space, which is exactly what the user needs to troubleshoot the /home partition running out of space.

Answer

df -h /home

Answer

ls -lhS /home

Answer

find /home -type d -size +100M

Question 8

A security audit reveals that a Linux system allows password-based SSH logins and has weak password policies. Which THREE actions should the administrator take to improve security? (Choose three.)

Accepted Answer

Configure pam_faillock.so to lock accounts after failed attempts. Option B is correct because configuring pam_faillock.so in the PAM stack enforces account lockout after a defined number of failed authentication attempts (e.g., deny=5, unlock_time=900), directly mitigating brute-force and password-guessing attacks against the weak password policy. Option C is correct because pam_pwquality.so enforces password complexity requirements such as minimum length (minlen), character classes (ucredit, lcredit, dcredit, ocredit), and dictionary checks, which addresses the audit finding of weak password policies at their source. Option D is correct because setting PasswordAuthentication no in sshd_config disables password-based SSH authentication entirely, forcing key-based authentication and eliminating the password-guessing attack surface the audit flagged; this requires reloading sshd (systemctl reload sshd) to take effect. Option A does not belong because merely changing the SSH port to 2222 is security through obscurity and does not fix the underlying weak authentication or password policy issues. Option E does not belong because setting PermitRootLogin yes permits direct root logins over SSH, which increases risk rather than improving security; it should be set to no or prohibit-password.

Answer

Change SSH port to 2222

Answer

Set PermitRootLogin yes

Question 9

During boot, a Linux system displays a kernel panic with the message 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Corrupted initramfs missing necessary storage drivers. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or access the root filesystem. This is most commonly caused by a corrupted or missing initramfs that lacks the necessary storage drivers (e.g., for SATA, NVMe, or LVM) to communicate with the root device. Without these drivers, the kernel cannot read the root filesystem, resulting in a panic.

Answer

Incorrect GRUB timeout setting

Answer

A faulty RAM module causing memory errors

Answer

Filesystem corruption on the boot partition

Question 10

An administrator needs to schedule a backup script located at '/usr/local/bin/backup.sh' to run every Sunday at 2:30 AM. The server uses cron for task scheduling. The administrator currently has the following crontab entry: '30 2 * * 0 /usr/local/bin/backup.sh'. However, the administrator wants to verify that the cron job is configured correctly and will run as expected. Which of the following commands should the administrator use to list the current user's cron jobs and verify the entry?

Accepted Answer

crontab -l. The 'crontab -l' command lists the current user's crontab entries. Option D is correct. 'cron -l' is not a valid command. 'cat /var/spool/cron/crontabs/root' might work for root but not for a regular user, and the path varies. 'systemctl status cron' shows the cron service status, not the job list.

Answer

cat /var/spool/cron/crontabs/root

Answer

systemctl status cron

Answer

cron -l

Question 11

Which TWO commands can be used to display the current kernel version on a Linux system?

Accepted Answer

uname -r. Option B, uname -r, is correct because the uname command prints system information and the -r flag specifically outputs the kernel release (version) string, such as 5.15.0-91-generic. Option C, cat /proc/version, is correct because /proc/version is a virtual file exposed by the kernel that contains the kernel version, gcc version used to build it, and build timestamp. Option A, modinfo, is incorrect because it displays metadata about a specific kernel module (e.g., filename, license, parameters), not the running kernel version. Option D, lsmod, is incorrect because it lists currently loaded kernel modules by reading /proc/modules, not the kernel version. Option E, dmesg, is incorrect because it prints the kernel ring buffer messages, which may mention the version incidentally but is not a command designed to display the current kernel version.

Answer

modinfo

Answer

lsmod

Answer

dmesg

Question 12

A systems administrator creates a bash script that processes log files. The script uses a for loop to iterate over files in /var/log and runs a command on each. Which of the following would prevent the script from failing if no files match the pattern?

Accepted Answer

shopt -s nullglob. `shopt -s nullglob` causes the shell to expand a glob pattern that matches no files into an empty string rather than leaving the pattern literal. Without this setting, if no files match the pattern in `/var/log`, the for loop receives the literal pattern string (e.g., `*.log`) and attempts to process it as a filename, which would cause the command to fail or produce unexpected results. Enabling nullglob ensures the loop body simply does not execute when no matches exist, preventing script failure.

Answer

set -u

Answer

set -e

Answer

shopt -s failglob

Question 13

A system administrator needs to monitor system performance over time. Which THREE tools can be used to collect and display CPU, memory, and I/O statistics? (Choose three.)

Accepted Answer

iostat. iostat (A) is correct because it is part of the sysstat package and reports CPU utilization along with per-device and per-partition I/O statistics such as tps, kB_read/s, and kB_wrtn/s, making it ideal for collecting and displaying I/O and CPU data over time. sar (C) is correct because the System Activity Reporter, also from sysstat, records and replays historical CPU, memory, and I/O metrics via cron-collected binary files (e.g., /var/log/sa/saXX) using options like -u, -r, and -b, which directly supports monitoring performance over time. vmstat (D) is correct because it reports virtual memory, CPU, and I/O statistics including processes (r, b), swap (si, so), memory (free, buff, cache), and block I/O (bi, bo) at specified intervals, allowing ongoing collection and display of the required metrics. top (B) is not among the marked answers because although it displays CPU and memory in real time, it is an interactive process viewer rather than a tool designed to collect and persist statistics over time, and it lacks dedicated I/O reporting. htop (E) is likewise excluded because it is an interactive process monitor similar to top and does not provide the historical data collection or detailed I/O statistics that the scenario requires.

Answer

top

Answer

htop

Question 14

An administrator is troubleshooting a boot issue. The system boots to a console with limited functionality. Which systemd target should be used to bring up the system with network and multi-user support?

Accepted Answer

multi-user.target. multi-user.target provides a non-graphical multi-user system with network.

Answer

emergency.target

Answer

graphical.target

Answer

rescue.target

Question 15

Which directory in the Filesystem Hierarchy Standard (FHS) contains essential user commands available to all users, such as 'ls' and 'cp'?

Accepted Answer

/bin. The /bin directory in the FHS contains essential user commands that must be available in single-user mode and for all users, such as ls, cp, mv, and cat. These binaries are required for basic system operation and are on the root filesystem so they are available even when other filesystems are not mounted. This matches the question's description precisely.

Answer

/sbin

Answer

/opt

Answer

/usr/bin

Question 16

A system fails to boot with a kernel panic. The administrator wants to recover by accessing a root shell. Which THREE methods can be used to achieve this?

Accepted Answer

Append 'single' to the kernel command line in GRUB. Option B is correct because appending 'single' (or '1') to the kernel command line in GRUB boots the system into single-user/rescue mode, which starts a root shell without requiring the normal login and is a standard recovery method. Option D is correct because appending 'rd.break' to the kernel command line interrupts the boot process in the initramfs (dracut) before the root filesystem is mounted, dropping the administrator into a root shell where the real root can be mounted and repaired. Option E is correct because booting from a live CD/USB and then chrooting into the installed system's root filesystem gives a root shell with access to the broken system's files and tools, allowing repairs such as reinstalling GRUB or fixing /etc/fstab. Option A is incorrect because 'fsck /dev/sda1' is not a valid GRUB command-line operation for obtaining a root shell; GRUB's command line is for bootloader commands, not for running filesystem checks as a recovery shell. Option C is incorrect because pressing 'e' in GRUB only opens the menu entry for editing and removing 'quiet' merely changes console verbosity; it does not by itself provide a root shell.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Press 'e' in GRUB and remove 'quiet'

Question 17

A security audit identifies that the system's /etc/passwd file is world-readable. Which three security issues does this pose? (Select THREE.)

Accepted Answer

Attackers can obtain usernames easily.. Option B is correct because /etc/passwd contains one line per account with the username in the first colon-separated field, so a world-readable file lets attackers enumerate valid local usernames for brute-force or phishing attacks. Option C is correct because the sixth field of each /etc/passwd entry holds the user's home directory path, exposing directory layout that aids targeted attacks on user files or SSH keys. Option D is correct because the third field contains the numeric UID and the fourth field the primary GID, so attackers learn the UID-to-username mapping needed to craft privilege-escalation or file-ownership exploits. Option A is not correct because modern /etc/passwd stores an 'x' placeholder in the password field, not the encrypted password itself. Option E is likewise not correct because password hashes are kept in the shadowed /etc/shadow file, which is not world-readable.

Answer

Attackers can read the encrypted passwords.

Answer

Attackers can read password hashes.

Question 18

Based on the exhibit, what best describes the security implication?

Accepted Answer

The SUID bit is set, allowing users to run passwd with root privileges to change their own password.. The SUID (Set User ID) bit is set on the /usr/bin/passwd file, as indicated by the 's' in the owner's execute position (e.g., -rwsr-xr-x). This allows any user to run the passwd command with the effective UID of the file owner (root), enabling them to change their own password by writing to /etc/shadow, which is otherwise only writable by root. This is a standard security mechanism, not a vulnerability, as the passwd binary is carefully designed to only allow password changes for the invoking user.

Answer

The file is world-writable.

Answer

The SGID bit is set, allowing users to run passwd with group root.

Answer

The sticky bit is set, preventing deletion of the file.

Question 19

A technician needs to check the current memory usage on a Linux system, including buffers and cache. Which command provides the most user-friendly output?

Accepted Answer

free -h. The `free -h` command displays memory usage in a human-readable format (e.g., KiB, MiB, GiB) and explicitly breaks down total, used, free, shared, buffers/cache, and available memory. This makes it the most user-friendly option for quickly assessing current memory usage including buffers and cache.

Answer

cat /proc/meminfo

Answer

iostat -m

Answer

vmstat -s

Question 20

An administrator is troubleshooting a service that fails to start. They want to trace the system calls made by the service binary. Which command should they use?

Accepted Answer

strace. strace traces system calls and signals. It is used to debug what a program is doing at the kernel level.

Answer

ltrace

Answer

dmesg

Answer

lsof