XK0-006 Practice Test 28 — 15 Questions

Question 1

A Linux administrator is troubleshooting a server that has become unresponsive. They suspect a process is consuming excessive CPU. Which command should they use to display a real-time, interactive view of processes sorted by CPU usage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

top. The top command is designed for real-time process monitoring, showing a continuously updated list of processes sorted by CPU usage. It allows an administrator to quickly spot which process is consuming the most CPU and take action, such as renice or kill. Other tools like ps provide only a snapshot, while vmstat and iostat give system-wide statistics without per-process breakdown.

Answer

iostat -c

Answer

vmstat 1

Answer

ps aux

Question 2

Which THREE are valid SELinux modes?

Accepted Answer

Permissive. SELinux has exactly three operational modes, and the three correct options here are B. Permissive, C. Enforcing, and D. Disabled. Permissive mode is valid because SELinux loads the policy and logs AVC denials to the audit log but does not actually block any access, which is useful for troubleshooting. Enforcing mode is valid because it loads the policy and actively denies and logs any operation that violates the policy. Disabled mode is valid because it turns SELinux off entirely at the kernel level, so no policy is loaded and no AVC messages are generated. The unmarked options do not belong: Strict is not a mode but rather a type of policy (targeted vs. strict policy), and Audit is not an SELinux mode at all, though auditd is the userspace daemon that records AVC denials.

Answer

Strict

Answer

Audit

Question 3

A server is experiencing frequent kernel panics. The administrator wants to capture the crash dump for analysis. Which kernel parameter must be set to enable crash dumps?

Accepted Answer

crashkernel=auto. The `crashkernel=auto` kernel parameter is required to reserve a portion of system memory for the kdump mechanism, which captures a crash dump when a kernel panic occurs. Without this reserved memory, the crash dump cannot be written to disk because the kernel has no safe memory region to operate the dump capture kernel. This parameter is set in the bootloader configuration (e.g., GRUB) and is specific to the kdump service on Linux systems.

Answer

panic=10

Answer

kdump_enabled=1

Answer

irqpoll

Question 4

A Linux server is configured with an IPsec VPN using strongSwan. The administrator needs to verify that the VPN tunnel is active and that traffic is being encrypted. Which command should be used to display the current status of the IPsec security associations?

Accepted Answer

ipsec statusall. The 'ipsec statusall' command is the standard tool in strongSwan to display the status of all IPsec security associations, including connection states, encryption details, and traffic counters. It provides a comprehensive overview that confirms whether the VPN tunnel is active and properly encrypting traffic, which is exactly what the administrator needs.

Answer

ss -tuln

Answer

ip xfrm state

Answer

systemctl status strongswan

Question 5

A Linux administrator is hardening a server and needs to ensure that the system is protected against unauthorized access. The administrator wants to implement account lockout after multiple failed login attempts and enforce password complexity. Which TWO actions should the administrator take to achieve these goals? (Choose two.)

Accepted Answer

Configure the pam_faillock module in /etc/pam.d/system-auth and /etc/pam.d/password-auth to lock accounts after a specified number of failed attempts.. To implement account lockout, the pam_faillock module must be configured in the PAM system-auth and password-auth files, which enforces lockout across authentication services. To enforce password complexity, the /etc/security/pwquality.conf file must be edited to set parameters like minlen and character class requirements. Together, these actions meet both requirements.

Answer

Add the line 'auth required pam_tally2.so deny=5' to /etc/pam.d/sshd to lock accounts after five failed SSH login attempts.

Answer

Set the PASS_MAX_DAYS parameter to 90 in /etc/login.defs to enforce password expiration.

Answer

Set the UMASK value to 077 in /etc/login.defs to restrict default file permissions.

Question 6

A user wants to run a command that will continue running even after the user logs out. Which command should be used?

Accepted Answer

nohup command &. nohup makes the command immune to hangups and runs in the background.

Answer

disown command

Answer

command &

Answer

bg command

Question 7

A technician wants to find all files owned by user 'jane' in the /home directory. Which command accomplishes this?

Accepted Answer

find /home -type f -user jane. The find command with -user option searches for files owned by a specific user.

Answer

grep -r jane /home

Answer

ls -lR /home | grep jane

Answer

locate jane /home

Question 8

A Linux server's root filesystem was extended with LVM, but after a reboot users report that only the original capacity is available again. Running 'df -h' shows the mount smaller than the logical volume, and 'lvextend' completed successfully before the reboot. Which command should the administrator run to make the filesystem use the additional space on an XFS root volume?

Accepted Answer

xfs_growfs /. XFS filesystems must be grown with xfs_growfs rather than resize2fs, and the operation can be performed online on a mounted root filesystem. Since lvextend already expanded the logical volume, the remaining step is to tell XFS to claim the new space by pointing xfs_growfs at the mount point. Without this step the filesystem keeps its original size even though the block device is larger.

Answer

resize2fs /dev/mapper/vg0-root

Answer

parted /dev/sda resizepart 2 100%

Answer

vgchange -ay vg0

Question 9

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

Accepted Answer

strace -p . strace is the standard Linux utility for tracing system calls made by a process. Using strace -p attaches to an already-running process and displays its system calls in real time, which is exactly what is needed to diagnose a misbehaving process at the kernel interface level. This makes it the correct tool for observing file opens, reads, writes, network calls, and signal handling.

Answer

tcpdump -i any

Answer

ltrace -p <PID>

Answer

lsof -p <PID>

Question 10

A Linux administrator maintains a Bash deployment script that runs unattended from cron. The script currently contains `set -e` and `set -u`, but it silently continues past a failing command inside a pipeline such as `tar -czf backup.tgz /srv | tee /var/log/backup.log`. The administrator wants the script to abort whenever any element of that pipeline returns a non-zero status. Which line should be added to the top of the script?

Accepted Answer

set -o pipefail. Pipelines report only the last command's status by default, so a failing producer such as tar can be masked by a succeeding consumer such as tee. Enabling pipefail makes the pipeline return the first non-zero status encountered, which combines with set -e to abort the unattended script immediately. This preserves the existing error-handling design while closing the pipeline gap.

Answer

set -v

Answer

set -x

Answer

set -n

Question 11

A Linux server's root filesystem is filling rapidly. The administrator suspects a process is writing to a deleted file that still holds space. They want to identify which running process has an open file descriptor to a deleted file. Which command should they use?

Accepted Answer

lsof +L1. When a process holds a deleted file open, the inode and its blocks remain allocated until the process closes or exits, so the space does not return to the filesystem. The lsof command with +L1 filters open files whose link count is below one, precisely matching deleted-but-open files. It outputs the responsible PID and command, enabling the administrator to restart the process and reclaim the space.

Answer

vmstat 1 5

Answer

ps aux --sort=-%mem

Answer

df -i /

Question 12

A Linux administrator is troubleshooting a server that has become unresponsive. They suspect a process is consuming excessive CPU. Which command should they use to display a real-time, interactive view of processes sorted by CPU usage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

cat /proc//status. Diagnosing resource exhaustion in an already-running process requires inspecting that process's effective limits and current usage. The /proc//limits file lists the soft and hard limits the process actually runs under, while /proc//status reports live usage counters such as resident memory and thread counts. Together they let the administrator compare usage against limits without relying on the current shell's settings.

Answer

nice -n 10 <command>

Answer

ulimit -a

Answer

systemctl status <service>

Question 13

A Linux administrator needs to schedule a recurring backup script to run every Monday at 02:30 using the system-wide cron facility on a systemd-based distribution. Which entry correctly achieves this when placed in /etc/cron.d/backup?

Accepted Answer

30 2 * * 1 root /usr/local/bin/backup.sh. System-wide cron files placed in /etc/cron.d require six fields: minute, hour, day of month, month, day of week, and a user, followed by the command. The correct entry uses minute 30, hour 2, wildcards for day of month and month, day of week 1 for Monday, and root as the executing user, producing a weekly Monday 02:30 run.

Answer

30 2 1 * * root /usr/local/bin/backup.sh

Answer

2 30 * * 1 root /usr/local/bin/backup.sh

Answer

30 2 * * 1 /usr/local/bin/backup.sh

Question 14

An administrator notices that a web application intermittently returns 'Connection timed out' to clients on the same subnet, while the server itself responds to pings. Packet captures show the server receiving SYN packets but never replying. The host firewall is suspected. Which command should the administrator use to inspect the active ruleset and its counters on a system using nftables?

Accepted Answer

nft list ruleset. Because the server receives SYNs but never answers, filtering on inbound traffic is the leading hypothesis. On a native nftables host, listing the ruleset reveals both the rules and their counters, so the administrator can identify the offending drop or reject rule and confirm it is actually matching traffic. Compatibility tools may not reflect natively created rules.

Answer

ss -tlnp

Answer

iptables -L -n -v

Answer

tcpdump -i any port 80

Question 15

A Linux server becomes unresponsive, and the administrator suspects a process is consuming excessive CPU. The administrator needs to identify the offending process and then terminate it cleanly by PID. Which TWO commands should be used to accomplish these tasks? (Choose two.)

Accepted Answer

top. Identifying a CPU hog requires a live process viewer that sorts by CPU, and top provides exactly that with PIDs. Once the PID is known, sending SIGTERM with kill requests an orderly shutdown so the process can release resources. Together these two steps find and cleanly stop the offending process, matching the scenario without resorting to a forceful, name-based kill.

Answer

nohup ./service &

Answer

killall -9 bash

Answer

lsof -i :80