XK0-006 Practice Test 26 — 15 Questions

Question 1

A system administrator is investigating a slow website. The web server is responding but pages load slowly. Which THREE commands can help identify network latency or packet loss?

Accepted Answer

mtr example.com. Option B, mtr example.com, is correct because mtr combines ping and traceroute into a continuous, per-hop report showing packet loss percentages and latency (average/best/worst) at each router along the path, which directly exposes where latency or loss is introduced. Option C, ping -c 10 example.com, is correct because it sends 10 ICMP Echo Requests and reports round-trip time statistics plus packet loss percentage to the destination, giving a quick measure of latency and loss to the target host. Option E, traceroute example.com, is correct because it maps the hop-by-hop path to the destination using incrementing TTL values and reports per-hop RTTs, revealing which intermediate hop adds delay or drops packets. Option A, dig example.com, is not correct here because it only queries DNS records and measures name-resolution behavior, not end-to-end network latency or packet loss. Option D, ss -tlnp, is not correct because it merely lists local listening TCP sockets and their owning processes, providing no path latency or loss measurements.

Answer

dig example.com

Answer

ss -tlnp

Question 2

A Linux administrator is troubleshooting a service that fails to start. Which TWO commands can be used to view the last 20 lines of the systemd journal for the sshd unit?

Accepted Answer

journalctl -u sshd -n 20. Option A, `journalctl -u sshd -n 20`, is correct because `-u sshd` filters the journal to the sshd unit and `-n 20` limits the output to the last 20 lines, exactly matching the requirement. Option B, `journalctl -u sshd | tail -20`, is also correct because `journalctl -u sshd` produces the sshd unit's journal entries and piping them to `tail -20` displays only the final 20 lines. Option C, `journalctl -k -n 20`, is wrong because `-k` restricts output to kernel messages rather than the sshd unit. Option D, `journalctl -u sshd -p err`, is wrong because `-p err` filters by priority level (error and above) instead of returning the last 20 lines. Option E, `journalctl -b -u sshd`, is wrong because `-b` limits output to the current boot but does not restrict the result to the last 20 lines.

Answer

journalctl -k -n 20

Answer

journalctl -u sshd -p err

Answer

journalctl -b -u sshd

Question 3

A security analyst needs to see a list of failed login attempts on a Linux system. Which command displays this information from the /var/log/btmp log?

Accepted Answer

lastb. The `lastb` command reads the `/var/log/btmp` file, which specifically records failed login attempts. It displays a list of bad logins, including the username, terminal, source IP, and timestamp. This is the correct tool for auditing failed authentication events on Linux.

Answer

lastlog

Answer

last

Answer

faillog

Question 4

An administrator needs to set up a new LVM volume. Which two commands are necessary in the initial setup before creating a logical volume?

Accepted Answer

vgcreate. Before creating a logical volume (LV), you must first prepare the physical storage devices and then group them into a volume group. The `pvcreate` command initializes a block device (e.g., /dev/sdb) as a physical volume (PV) by writing LVM metadata to it. The `vgcreate` command then creates a volume group (VG) from one or more PVs, which serves as the pool of storage from which logical volumes are carved. Without these two steps, the LVM subsystem has no recognized storage to allocate.

Answer

mount

Answer

lvcreate

Answer

mkfs

Question 5

Which TWO of the following are characteristics of containers compared to virtual machines? (Choose two.)

Accepted Answer

Containers require less overhead than VMs.. Option D is correct because containers share the host OS kernel and therefore avoid the resource cost of running a full guest operating system and hardware emulation, giving them a smaller footprint and lower CPU, memory, and storage overhead than VMs. Option E is correct because a container is essentially a packaged process that starts almost instantly (often in seconds or less) since it does not need to boot an entire operating system and initialize virtual hardware as a VM does. Options A and B are incorrect because containers share the host kernel and do not run their own kernel or full operating system; that is a characteristic of virtual machines. Option C is incorrect because containers achieve isolation through OS-level mechanisms such as namespaces and cgroups, not through a hypervisor, which is used by VMs.

Answer

Containers run their own kernel.

Answer

Each container has its own operating system.

Answer

Containers use hypervisor for isolation.

Question 6

A Linux administrator needs to scan all currently connected USB devices and display detailed information such as vendor ID, product ID, and device class. Which command should the administrator run?

Accepted Answer

lsusb. The lsusb command queries the USB subsystem and prints a line for each connected USB device, including vendor and product IDs, device class, and bus topology. It is the standard utility for quickly enumerating USB devices on a Linux system without needing elevated privileges.

Answer

lshw -class usb

Answer

lspci

Answer

lsblk

Question 7

A server shows /dev/sda1 mounted at / is 100% full in df -h, but du -sh / shows only 50% usage. What is the most likely explanation?

Accepted Answer

A process is still holding a deleted file open. When a file is deleted but still held open by a running process, the file's inode remains allocated and its disk blocks are not freed until the process closes the file descriptor. The `df` command reports filesystem usage by querying the superblock for total and free blocks, so it still counts the space occupied by the deleted-but-open file. In contrast, `du` traverses the directory tree and sums the sizes of files reachable from the specified path; since the deleted file is no longer linked in the directory, `du` does not include it, leading to the discrepancy.

Answer

The filesystem is corrupted

Answer

Hidden files are not counted by du

Answer

The disk has many hard links

Question 8

A Linux administrator is troubleshooting a server that has lost network connectivity. They need to verify the current IP configuration and check the default gateway. Which TWO commands can be used to display the IP address and routing table? (Choose two.)

Accepted Answer

ip addr show. The ip addr show command reveals interface IP addresses, and ip route show displays the routing table including the default gateway. Together they provide the necessary information to diagnose network connectivity loss. These are the modern, recommended tools for network configuration inspection on Linux.

Answer

route -n

Answer

ifconfig -a

Answer

netstat -rn

Question 9

Refer to the exhibit. A developer is pushing an image to a private registry at `192.168.1.100:5000` but receives an error about using an insecure registry. Which part of the Docker daemon configuration allows this registry without TLS?

Accepted Answer

The 'insecure-registries' setting. The error indicates the Docker client is attempting to push an image to a registry over HTTP (port 5000) without TLS. By default, Docker Engine requires TLS for all registry communications. The `insecure-registries` setting in `/etc/docker/daemon.json` allows the daemon to bypass TLS verification for specified IP addresses or CIDR ranges, enabling communication with registries that lack a valid TLS certificate.

Answer

The 'exec-opts' setting

Answer

The 'storage-driver' setting

Answer

The 'log-driver' setting

Question 10

A Linux administrator needs to locate all files in the /var/log directory that have been modified within the last 2 days and contain the word 'error' (case-insensitive). Which command accomplishes this?

Accepted Answer

find /var/log -mtime -2 -exec grep -li 'error' {} \;. The correct command uses -mtime -2 to find files modified less than 2 days ago, and -exec grep -li 'error' to perform a case-insensitive search for 'error' in file contents, listing filenames. Option A uses -mtime +2 (files older than 2 days). Option B uses -name to match filenames, not content. Option C uses grep -l without -i, so it would miss case variations.

Answer

find /var/log -mtime +2 -exec grep -li 'error' {} \;

Answer

find /var/log -name '*error*' -mtime -2

Answer

find /var/log -mtime -2 -exec grep -l 'error' {} \;

Question 11

A system is running out of disk space in the /var/log directory. The administrator needs to temporarily free up space while preserving the latest log entries. Which approach is best?

Accepted Answer

Run logrotate with compression enabled. Logrotate with compression is the best approach because it rotates, compresses, and optionally removes old log files while preserving the latest entries. It can be configured to keep a specific number of rotated logs, thus freeing disk space without deleting current logs. This matches the requirement to temporarily free up space while retaining the most recent log data.

Answer

find /var/log -mtime +7 -delete

Answer

cat /dev/null > /var/log/messages

Answer

rm -rf /var/log/*

Question 12

A system administrator notices that a critical application's process is consuming too much CPU, affecting other services. The administrator needs to reduce the CPU priority of that process without affecting its memory or other resources. The process PID is 4521. Which command should the administrator use?

Accepted Answer

renice -n 10 -p 4521. The `renice` command is used to change the priority of an already running process. By specifying `-n 10` and `-p 4521`, the administrator sets the nice value to 10, which lowers the CPU priority (higher nice value = lower priority) without affecting the process's memory or other resources. This directly addresses the need to reduce CPU consumption for the critical application.

Answer

nice -n 10 -p 4521

Answer

renice -p 4521 10

Answer

chrt -p 10 4521

Question 13

A system administrator needs to create a new user account with a home directory and the bash shell. Which command should be used?

Accepted Answer

useradd -m -s /bin/bash user. The `-m` flag tells `useradd` to create the user's home directory if it does not already exist, and `-s /bin/bash` sets the login shell to bash. This meets the requirement of creating a new user with a home directory and the bash shell.

Answer

useradd -r -s /bin/bash user

Answer

useradd -c -s /bin/bash user

Answer

useradd -d /home/user -s /bin/bash user

Question 14

A Linux engineer needs to harden SSH access. Which TWO of the following settings should be configured in /etc/ssh/sshd_config to enhance security? (Select TWO.)

Accepted Answer

PasswordAuthentication no. Option B (PasswordAuthentication no) is correct because disabling password-based authentication forces users to authenticate with SSH key pairs, eliminating brute-force and credential-stuffing attacks against account passwords. Option E (AllowUsers alice bob) is correct because it implements an explicit allowlist, so only the named accounts alice and bob may establish SSH sessions, denying all other valid system users. The remaining options weaken security: MaxAuthTries 6 (A) is too permissive since the default of 3 limits failed attempts more tightly, Protocol 1 (C) enables the obsolete and cryptographically broken SSH-1 protocol, and PermitRootLogin yes (D) allows direct root logins, which should be set to no or prohibit-password.

Answer

MaxAuthTries 6

Answer

Protocol 1

Answer

PermitRootLogin yes

Question 15

A Linux administrator needs to view real-time information about running processes, including CPU and memory usage. Which TWO commands can be used for this purpose? (Choose two.)

Accepted Answer

top. Option B (top) is correct because top provides a continuously refreshing, real-time view of running processes along with per-process CPU and memory usage, load averages, and system summary statistics. Option D (htop) is correct because htop is an interactive process viewer that also displays real-time CPU and memory usage per process, with additional features like colorized output, scrolling, and process management. Option A (ps aux) is not correct here because ps produces a static snapshot of processes at the moment it is executed rather than a live, updating view. Option C (systemctl list-units) is incorrect because it lists systemd units and their states, not per-process CPU or memory usage. Option E (kill -l) is incorrect because it only lists available signal names/numbers and provides no process resource information.

Answer

ps aux

Answer

systemctl list-units

Answer

kill -l