XK0-006 Practice Test 30 — 15 Questions

Question 1

An administrator needs to schedule a system maintenance task to run at 3 AM every Sunday. Which cron expression should be used?

Accepted Answer

0 3 * * 0. In cron, Sunday can be specified as either 0 or 7. The expression '0 3 * * 0' means the task runs at minute 0, hour 3 (3 AM), every day of the month (*), every month (*), and only on Sunday (0). This matches the requirement exactly.

Answer

0 3 * * 7

Answer

0 3 * * 1

Answer

* 3 * * 0

Question 2

A junior administrator needs to check the disk usage of the /var filesystem to ensure it does not exceed 80% capacity. Which command should be used?

Accepted Answer

df -h /var. The `df -h /var` command displays disk usage for the `/var` filesystem in human-readable format (e.g., GB, MB). This is the correct tool to check filesystem capacity and usage percentage, which directly answers whether usage exceeds 80%.

Answer

fdisk -l /var

Answer

du -sh /var

Answer

lsblk /var

Question 3

Which command will display the disk usage of each directory in the current directory, in human-readable format?

Accepted Answer

du -h. The `du -h` command displays disk usage for each directory in the current directory, with the `-h` flag converting sizes into human-readable formats (e.g., K, M, G). This is the correct tool for per-directory disk usage reporting.

Answer

fdisk -l

Answer

ls -lh

Answer

df -h

Question 4

A Linux administrator is troubleshooting a Bash script that unexpectedly terminates when a command fails. The script uses `#!/bin/bash`. Which of the following commands, if placed at the beginning of the script, would cause it to exit on any command failure?

Accepted Answer

set -e. The `set -e` option makes the shell exit immediately if a command exits with a non-zero status.

Answer

set -u

Answer

trap 'exit 1' ERR

Answer

set -o pipefail

Question 5

A shared directory requires that any new files created within it are automatically writable by the group. What umask value should be set for users working in this directory?

Accepted Answer

0002. (0002) is correct because the umask subtracts permissions from the default 0666 for files. A umask of 0002 removes the 'write' permission for others (o-w), leaving the group with read/write (rw) and the owner with read/write (rw). This ensures new files are group-writable, as required for a shared directory.

Answer

0777

Answer

0027

Answer

0022

Question 6

Match each Linux networking command to its purpose.

Accepted Answer

ping: Tests network connectivity to a remote host. Ping tests connectivity, netstat shows network statistics, ifconfig configures interfaces, nslookup performs DNS queries. Traceroute traces paths, and system IP is better shown by ifconfig or hostname -I.

Answer

ping: Used to trace the route packets take to a destination

Answer

netstat: Used to display the IP address of the system

Question 7

A container produces a large amount of log output to stdout. Which TWO methods effectively manage log size in a production environment?

Accepted Answer

Configure journald limits for container logging. Journald can be configured to limit the size of log data it stores, including container logs that are sent to the journal. In a production environment, setting `SystemMaxUse=` or `MaxRetentionSec=` in `/etc/systemd/journald.conf` prevents unbounded log growth. Option E is correct because Docker's `--log-opt max-size=10m` truncates the container's log file when it reaches 10 MB, rotating it automatically, which directly manages log size at the container runtime level.

Answer

Use docker logs --tail 100 to limit output

Answer

Use a bind mount to redirect logs to /dev/null

Answer

Configure the application inside the container to log to a file

Question 8

An administrator notices repeated failed login attempts in /var/log/secure. The company policy requires account lockout after 5 failed attempts within 15 minutes. Which PAM module and configuration can enforce this?

Accepted Answer

pam_faillock.so with deny=5 unlock_time=900. Pam_faillock.so is the PAM module specifically designed to track failed login attempts and enforce account lockout policies. The `deny=5` parameter sets the threshold to 5 failures, and `unlock_time=900` sets the lockout duration to 900 seconds (15 minutes), matching the policy requirement exactly.

Answer

pam_unix.so with remember=5

Answer

pam_pwquality.so with minlen=5

Answer

pam_limits.so with maxlogins=5

Question 9

A cloud engineer needs to automate the deployment of a new virtual machine with a specific configuration using Ansible. Which file format is typically used for Ansible playbooks?

Accepted Answer

YAML. Ansible playbooks are written in YAML (YAML Ain't Markup Language) because it is human-readable, supports complex data structures like lists and dictionaries, and is designed for configuration management. YAML's indentation-based syntax aligns with Ansible's declarative approach, allowing tasks, variables, and handlers to be defined cleanly without the overhead of brackets or tags.

Answer

JSON

Answer

XML

Answer

INI

Question 10

A security policy requires that user passwords must expire after 90 days. The output in the exhibit shows the current configuration for the root user. Which command should the administrator run to enforce the policy for root?

Accepted Answer

sudo chage -M 90 root. The `chage -M 90 root` command sets the maximum number of days a password is valid for the root user to 90 days, which directly enforces the password expiration policy. The `-M` option modifies the `max_days` field in `/etc/shadow`, causing the password to expire after the specified period. This is the correct method to apply aging rules to the root account.

Answer

sudo passwd -x 90 root

Answer

sudo chage -E 90 root

Answer

sudo usermod -e 90 root

Question 11

Which TWO of the following are common causes of a system failing to boot? (Select two.)

Accepted Answer

A corrupted kernel image. A corrupted kernel image prevents the bootloader from loading the kernel into memory, causing the boot process to fail at the stage where the kernel is executed. Without a valid kernel, the system cannot initialize hardware or start the init process, resulting in a kernel panic or a hang.

Answer

A full hard drive

Answer

An incorrect system time zone

Answer

An incorrect IP address in /etc/network/interfaces

Question 12

Based on the exhibit, what best describes the security implication?

Accepted Answer

The SUID bit is set, allowing users to run passwd with root privileges to change their own password.. The SUID (Set User ID) bit is set on the /usr/bin/passwd file, as indicated by the 's' in the owner's execute position (e.g., -rwsr-xr-x). This allows any user to run the passwd command with the effective UID of the file owner (root), enabling them to change their own password by writing to /etc/shadow, which is otherwise only writable by root. This is a standard security mechanism, not a vulnerability, as the passwd binary is carefully designed to only allow password changes for the invoking user.

Answer

The file is world-writable.

Answer

The SGID bit is set, allowing users to run passwd with group root.

Answer

The sticky bit is set, preventing deletion of the file.

Question 13

Refer to the exhibit. The system administrator runs the command 'auditctl -l' and sees the above rules. What is the purpose of these audit rules?

Accepted Answer

To log any changes (write or attribute) to the password, shadow, and group files. The audit rules use the `-w` flag to watch the files `/etc/passwd`, `/etc/shadow`, and `/etc/group` for `wa` (write and attribute change) syscalls. This logs any modification to these critical authentication and authorization files, such as user additions, password changes, or permission changes, which is essential for security monitoring.

Answer

To log all successful login attempts on the system

Answer

To log any modifications to the audit configuration itself

Answer

To log all read accesses to /etc/passwd, /etc/shadow, and /etc/group

Question 14

A security team wants to implement mandatory access control (MAC) on a Linux server to confine a potentially vulnerable daemon. Which TWO of the following technologies can be used for this purpose?

Accepted Answer

AppArmor. AppArmor is a Linux Security Module (LSM) that implements mandatory access control (MAC) by confining programs to a set of listed files and capabilities defined in profiles. It operates on a path-based model, allowing the security team to restrict the daemon's access to only necessary resources, effectively containing a potential vulnerability.

Answer

sudo

Answer

TCP wrappers

Answer

iptables

Question 15

An administrator is configuring a chroot jail for an SFTP user. Which directive in /etc/ssh/sshd_config is used for this purpose?

Accepted Answer

ChrootDirectory /home/%u. The ChrootDirectory directive in /etc/ssh/sshd_config specifies the path to the directory that will be used as a chroot jail for the user. When set to /home/%u, %u is replaced by the username, confining the SFTP user to their home directory. This is the standard way to restrict an SFTP user's file system access to a specific directory tree.

Answer

Subsystem sftp internal-sftp

Answer

ForceCommand internal-sftp

Answer

Match Group sftpusers