XK0-006 Practice Test 29 — 15 Questions

Question 1

A Kubernetes administrator is creating a YAML manifest for a Deployment. Which three fields are required in a valid Deployment specification? (Choose three.)

Accepted Answer

apiVersion. A valid Kubernetes Deployment manifest actually requires four top-level fields: apiVersion, kind, metadata, and spec. The current explanation incorrectly states that only three fields are required and that metadata is not one of them. The correct required fields are all of A, B, C, and E.

Answer

status

Question 2

A systems administrator writes a Bash script named 'backup.sh' and wants it to run with the Bash shell. Which line should appear first in the script?

Accepted Answer

#!/bin/bash. The shebang line `#!/bin/bash` is required as the first line to instruct the operating system to execute the script using the Bash shell interpreter located at `/bin/bash`. Without this line, the script may be run by a different shell (e.g., `/bin/sh`), leading to syntax or behavior differences. The shebang must start with `#!` followed by the absolute path to the interpreter.

Answer

# This is a bash script

Answer

#/bin/bash

Answer

#!/bin/sh

Question 3

An administrator is configuring a Linux firewall to allow incoming SSH (port 22) and HTTPS (port 443) traffic while denying all other incoming traffic. Using iptables, which set of commands achieves this?

Accepted Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT. It first sets the default policy on the INPUT chain to DROP, which denies all incoming traffic by default. It then adds rules to explicitly ACCEPT incoming TCP traffic on ports 22 (SSH) and 443 (HTTPS), achieving the requirement of allowing only those two services while dropping everything else.

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Answer

iptables -P FORWARD DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 443 -j DROP

Question 4

A user on a shared system cannot create files larger than 1MB, even though the filesystem has ample free space. Which command should the administrator use to investigate?

Accepted Answer

quota -u username. The `quota -u username` command displays the current disk quota limits and usage for a specific user. Since the user cannot create files larger than 1MB despite ample free space on the filesystem, the most likely cause is a per-user quota limit (soft or hard limit) restricting file size or total disk usage. This command directly checks whether quotas are enforced and what the limits are.

Answer

df -h

Answer

fdisk -l

Answer

lsblk

Question 5

A user needs to view the first 15 lines of a large log file. Which command is most appropriate?

Accepted Answer

head -n 15 filename. head -n 15 filename displays the first 15 lines of a file.

Answer

cat filename | head -n 15

Answer

less -N 15 filename

Answer

tail -n 15 filename

Question 6

A system administrator wants to view the last 10 lines of a log file and also save those lines to another file for analysis. Which command should the administrator use?

Accepted Answer

tail -n 10 file | tee output.txt. tail -n 10 file | tee output.txt displays the last 10 lines of 'file' and writes them to 'output.txt'. Option A uses head, which shows the first lines, not the last. Option B uses cat, which outputs the entire file, not just the last 10 lines. Option D uses tee without a pipe, which is syntactically incorrect; tee reads from stdin, so it requires a pipe from tail.

Answer

head -n 10 file | tee output.txt

Answer

cat file | tee output.txt

Answer

tee output.txt < tail -n 10 file

Question 7

An administrator is hardening a Linux server. Which three of the following actions reduce the attack surface? (Select THREE).

Accepted Answer

Disabling unnecessary services. Disabling unnecessary services reduces the attack surface by eliminating potential entry points for attackers. Each running service exposes network ports, system resources, and code paths that could contain vulnerabilities. By stopping and masking services not required for the server's role (e.g., using systemctl disable and mask), the administrator minimizes the number of exploitable components.

Answer

Setting default umask to 022

Answer

Enabling USB mass storage kernel module

Question 8

An administrator needs to verify DNS resolution for a web server. Which TWO commands can be used to query DNS A records for a given hostname? (Choose two.)

Accepted Answer

nslookup. dig and nslookup are standard DNS query tools. host is another option but not listed. curl uses HTTP, not direct DNS. ping uses DNS but does not show the record.

Answer

traceroute

Answer

ping

Answer

curl -I

Question 9

A systems administrator wants to monitor system performance in real time. Which TWO commands can be used to display live updating information about processes, CPU, and memory usage? (Select TWO.)

Accepted Answer

top. The `top` command provides a real-time, dynamically updating view of system processes, CPU usage, and memory usage. It refreshes by default every few seconds, making it a standard tool for live performance monitoring. Similarly, `htop` is an enhanced interactive process viewer that offers a more user-friendly interface with color-coded, real-time updates on CPU, memory, and process information.

Answer

ps aux

Answer

sar -u 1 5

Answer

vmstat 1

Question 10

A server running a critical application needs to be rebooted. To ensure the application stops gracefully and data is not corrupted, which sequence of commands should the administrator use?

Accepted Answer

systemctl stop application; sync; reboot. It first uses systemctl to send a SIGTERM to the application, allowing it to perform a graceful shutdown and flush its data. The sync command then forces any pending disk writes to complete, ensuring filesystem consistency before the reboot. This sequence minimizes the risk of data corruption by giving the application and kernel time to finalize all I/O operations.

Answer

killall -9 application; reboot

Answer

reboot

Answer

umount -a; reboot

Question 11

Refer to the exhibit. After adding a firewall rule, the web server becomes unreachable from the internal network 192.168.1.0/24. Which line is the cause?

Accepted Answer

Line: -A INPUT -p tcp --dport 80 -j DROP. The firewall rule `-A INPUT -p tcp --dport 80 -j DROP` explicitly drops all incoming TCP traffic destined for port 80, regardless of source. Since the web server listens on port 80, this rule blocks all HTTP requests, including those from the internal network 192.168.1.0/24. The rule is placed before any ACCEPT rule for the same port, so the DROP action takes precedence, making the server unreachable.

Answer

Default policy (INPUT ACCEPT)

Answer

Missing rule for RELATED traffic

Answer

Line: -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT

Question 12

A Linux administrator notices that the system clock is consistently 5 minutes behind the actual time. The administrator runs 'timedatectl' and sees 'NTP service: active'. Which of the following commands should be used to force an immediate time synchronization?

Accepted Answer

timedatectl set-ntp false && chronyd -q && timedatectl set-ntp true. It first disables NTP to stop the automatic synchronization, then runs chronyd in one-shot query mode (-q) to force an immediate sync with the configured NTP servers, and finally re-enables NTP to resume normal service. This approach works with chronyd, which is the default NTP implementation on modern RHEL/CentOS 8+ and many other distributions, and directly addresses the need for an immediate synchronization without waiting for the periodic polling interval.

Answer

systemctl restart ntp

Answer

ntpdate -s time.google.com

Answer

systemctl restart chronyd

Question 13

A security audit reveals a misconfiguration. Which file has insecure permissions that could allow unauthorized users to read password hashes?

Accepted Answer

/etc/shadow. The /etc/shadow file stores password hashes and should be readable only by the root user (typically permissions 640 or 600). If its permissions are too permissive (e.g., world-readable), any local user could read the hashes and attempt offline cracking. This is the misconfiguration the audit would flag.

Answer

Both files are misconfigured

Answer

Neither file has a misconfiguration

Answer

/etc/passwd

Question 14

Drag and drop the steps to configure a firewall rule using iptables to allow SSH in the correct order.

Accepted Answer

Add SSH allow rule, then set INPUT default DROP, then save rules. Firewall configuration typically involves adding allow rules before setting default drop and saving.

Answer

Set INPUT default DROP, then add SSH allow rule, then save rules

Answer

Add SSH allow rule, then save rules, then set INPUT default DROP

Answer

Save rules, then add SSH allow rule, then set INPUT default DROP

Question 15

A Linux administrator needs to automate daily database backups and ensure the job runs even if the system is rebooted. Which approach should be used?

Accepted Answer

Create a systemd timer unit that triggers a service.. A systemd timer unit is the correct approach because it can be configured to trigger a service unit (e.g., a backup script) on a daily schedule, and systemd ensures that timers persist across reboots and will catch up on missed runs if the system was down. This provides reliable, dependency-aware scheduling integrated with the init system, unlike cron which may miss jobs during downtime.

Answer

Schedule the backup using the at command.

Answer

Add a cron job in /etc/crontab.

Answer

Use anacron to run the job daily.