XK0-006 Practice Test 28 — 15 Questions

Question 1

Which command can be used to display the current user's effective user ID and group memberships?

Accepted Answer

id. The `id` command displays the current user's real and effective user ID (UID), group ID (GID), and supplementary group memberships. It provides a comprehensive view of identity and group associations, which is essential for understanding access rights in Linux security contexts.

Answer

who

Answer

groups

Answer

whoami

Question 2

An administrator runs 'auditctl -w /etc/passwd -p wa -k passwd_changes' to monitor changes to /etc/passwd. Which command should be used to search the audit log for all events related to this watch?

Accepted Answer

ausearch -k passwd_changes. The `ausearch -k passwd_changes` command is correct because it searches the audit log for events that were tagged with the key `passwd_changes` when the watch was created via `auditctl -w /etc/passwd -p wa -k passwd_changes`. The `-k` option in `auditctl` assigns a key to the rule, and `ausearch` uses that same key to filter and retrieve matching audit records from `/var/log/audit/audit.log`.

Answer

auditctl -l -k passwd_changes

Answer

tail -f /var/log/audit/audit.log | grep passwd_changes

Answer

aureport -k passwd_changes

Question 3

A user cannot log in to a Linux system via SSH, but the SSH service is running and network connectivity is fine. Which TWO commands should the administrator use to troubleshoot the issue? (Choose TWO.)

Accepted Answer

journalctl -u sshd -n 20. `journalctl -u sshd -n 20` displays the last 20 log entries for the SSH daemon (sshd). This allows the administrator to see authentication failures, configuration errors, or other SSH-specific issues that prevent login, even when the service is running and network connectivity is fine.

Answer

cat /etc/ssh/sshd_config

Answer

passwd -S username

Answer

ss -tlnp | grep :22

Question 4

A script receives a JSON object where keys are user IDs. Which command extracts the 'status' of user id '123'?

Accepted Answer

echo "$json" | jq '.["123"].status'. The JSON object uses user IDs as keys, so `.["123"]` directly accesses the object property for user ID '123', and `.status` extracts the 'status' field from that nested object. The `jq` syntax `.["key"]` is the standard way to access a property by a string key in a JSON object.

Answer

echo "$json" | jq '.status'

Answer

echo "$json" | jq '. | select(.id=="123") | .status'

Answer

echo "$json" | jq '.[] | select(.id=="123") | .status'

Question 5

Which TWO commands can be used to change the group ownership of a file? (Choose exactly two.)

Accepted Answer

chgrp. The `chgrp` command is specifically designed to change the group ownership of a file or directory. The `chown` command can also change group ownership when used with the colon syntax (e.g., `chown :groupname file`). Both commands modify the file's group ID (GID) in the inode metadata.

Answer

chmod

Answer

groupmod

Answer

usermod

Question 6

A system administrator is troubleshooting a Docker container that exits immediately after starting. The container is built from a minimal image that runs a short-lived command. Which change will keep the container running?

Accepted Answer

Modify the Dockerfile to use CMD ["sh"] instead of CMD ["echo", "hello"]. The container exits immediately when its main process finishes. By changing the CMD from `["echo", "hello"]` (which prints a message and exits) to `["sh"]`, the container runs an interactive shell that waits for input, keeping the process alive and the container running. In Docker, a container lives only as long as its PID 1 process runs.

Answer

Use -d flag to run in detached mode

Answer

Restart the container with --restart=always

Answer

Allocate a pseudo-TTY with -t flag

Question 7

A Linux system is using systemd and a service fails to start. The administrator checks the service journal and sees: 'Failed to start service: Unit not found'. However, the service file exists in /etc/systemd/system/. What is the most likely cause?

Accepted Answer

systemd has not been reloaded (systemctl daemon-reload). When a service file is added or modified in /etc/systemd/system/, systemd does not automatically re-read the unit files. The administrator must run 'systemctl daemon-reload' to instruct systemd to scan for new or changed unit files. Without this reload, systemd still references its cached list of units, resulting in 'Unit not found' even though the file exists on disk.

Answer

The service is masked

Answer

The service file has incorrect permissions

Answer

The service is enabled but not started

Question 8

An administrator needs to capture network traffic on interface eth0, filtering only packets from host 192.168.1.1, and write the output to a file for later analysis. Which command accomplishes this?

Accepted Answer

tcpdump -i eth0 host 192.168.1.1 -w capture.pcap. tcpdump -i eth0 host 192.168.1.1 -w capture.pcap captures packets from the specified host on eth0 and writes to a file.

Answer

tcpdump -i eth0 src 192.168.1.1 -w capture.pcap

Answer

tcpdump -i eth0 dst 192.168.1.1 > capture.pcap

Answer

tcpdump -n -i eth0 host 192.168.1.1 > capture.pcap

Question 9

A system administrator wants to create a new user and set a password in a single command as part of a provisioning script. Which command accomplishes this?

Accepted Answer

echo 'user1:password' | chpasswd. The `chpasswd` command reads username:password pairs from standard input, allowing a single command to create or update a user's password. When combined with `echo`, it sets the password for a new or existing user in one line, which is ideal for provisioning scripts. The `-p` option in `useradd` expects an already-hashed password, not a plaintext one, and `passwd` does not accept the password as an argument for security reasons.

Answer

passwd user1 password

Answer

useradd -m -p password user1

Answer

usermod -p password user1

Question 10

A security policy requires auditing of all file access attempts. Which Linux kernel feature should be used?

Accepted Answer

auditd. The `auditd` service is the user-space component of the Linux Audit subsystem, which is the kernel feature designed to record file access events. It uses kernel audit rules (configured via `auditctl`) to capture system calls like `open`, `execve`, and `unlink`, enabling detailed auditing of all file access attempts as required by security policies.

Answer

journald

Answer

syslog

Answer

sysstat

Question 11

An administrator wants to ensure a critical monitoring script runs every day at 2 AM and sends output to a log file. Which THREE items are essential in the crontab entry? (Select THREE.)

Accepted Answer

SHELL=/bin/bash. The SHELL variable in a crontab entry defines which shell interpreter is used to execute the cron job. By default, cron uses /bin/sh, but setting SHELL=/bin/bash ensures that bash-specific syntax, aliases, and features (such as [[ ]] or source) are available for the monitoring script. Without this, the script might fail if it relies on bash extensions.

Answer

RUNLEVEL=3

Answer

MAILTO=admin@example.com

Question 12

Based on the exhibit, how often does the healthcheck.sh script run?

Accepted Answer

Every 5 minutes. The cron expression `*/5 * * * *` in the crontab file means the script runs every 5 minutes. The `*/5` in the minute field triggers execution every 5 minutes, while the asterisks in the hour, day, month, and weekday fields mean every hour, every day, every month, and every day of the week, respectively.

Answer

Every 5 days

Answer

Every 5 hours

Answer

Every 5 seconds

Question 13

A system administrator is troubleshooting a network issue where a server cannot reach external websites. The server can ping the default gateway and internal hosts. Which TWO commands should the administrator use to further diagnose the problem? (Choose TWO.)

Accepted Answer

nslookup google.com. The server can reach internal hosts and the default gateway, which rules out Layer 2/3 connectivity issues within the local network. However, it cannot reach external websites, suggesting a DNS resolution failure or a routing problem beyond the gateway. 'nslookup google.com' (A) tests DNS resolution by querying the configured DNS server for the IP address of google.com; if it fails, the issue is with DNS. 'traceroute 8.8.8.8' (E) traces the path to a known external IP (Google's public DNS), bypassing DNS, to determine if packets are being dropped or misrouted after the gateway.

Answer

route -n

Answer

ping 127.0.0.1

Answer

ifconfig eth0

Question 14

A user reports that their home directory is missing after a system reboot. The /home partition is listed in /etc/fstab with an incorrect UUID. What is the most likely outcome?

Accepted Answer

The system will boot but fail to mount /home. When /etc/fstab contains an incorrect UUID for /home, the mount command fails to mount /home during boot. However, unless the filesystem is explicitly marked as required (e.g., with the 'nofail' option omitted for critical partitions), the boot process continues. The default behavior for non-root filesystems is to allow booting even if the mount fails, resulting in a missing /home directory. Option C is correct because the system boots normally but /home is not mounted, leading to the user's reported issue. Option D is incorrect because a failed mount of a non-critical partition like /home does not halt the boot process.

Answer

The system will boot normally and mount /home using the device name

Answer

The system will prompt the user to enter the correct UUID

Answer

The system will fail to boot entirely

Question 15

Which command will show the current running processes in real time?

Accepted Answer

top. The `top` command is the standard Linux utility for displaying a dynamic, real-time view of running processes, including CPU and memory usage. It updates the display at a configurable interval (default 3 seconds) and provides an interactive interface for sorting and managing processes. This makes it the correct choice for showing current running processes in real time.

Answer

pstree

Answer

ps aux

Answer

htop