XK0-006 Practice Test 2 — 30 Questions

Question 1

An administrator is troubleshooting a service that fails to start. They want to trace the system calls made by the service binary. Which command should they use?

Accepted Answer

strace. strace traces system calls and signals. It is used to debug what a program is doing at the kernel level.

Answer

ltrace

Answer

dmesg

Answer

lsof

Question 2

In a Bash script, the administrator wants to capture the output of a command into a variable. Which syntax should be used?

Accepted Answer

$(command). Command substitution can be done with $(command) or backticks `command`. The latter is deprecated. $(( )) is for arithmetic expansion. $VAR is for variable expansion.

Answer

$VAR

Answer

$((command))

Answer

`command`

Question 3

A Linux administrator wants to check the history of CPU usage for the past two days using the system activity reporter. Which sar option retrieves data from the daily history file for a specific date?

Accepted Answer

sar -f /var/log/sa/sa$(date +%d --date='2 days ago'). sar -f /var/log/sa/saDD reads from the history file for a specific day (DD is the day of month).

Answer

sar -r -b

Answer

sar -n DEV

Answer

sar -u -s 00:00:00 -e 23:59:59

Question 4

A technician wants to capture network traffic to analyze a web server issue. Using tcpdump, which THREE options are useful for writing the capture to a file and avoiding name resolution? (Choose three.)

Accepted Answer

-n. -w writes to file, -n avoids name resolution, and -i specifies interface.

Answer

-c 100

Answer

-v

Question 5

A systems administrator needs to ensure that a custom service runs with a specific priority on a Linux server. Which command should the administrator use to achieve this?

Accepted Answer

nice -n -10 /usr/local/bin/myservice. The `nice` command adjusts the CPU scheduling priority of a process at launch time. Using `nice -n -10` sets a higher priority (lower nice value) for the new service, ensuring it runs with the specified priority from the start. This directly meets the requirement to run a custom service with a specific priority.

Answer

renice -10 -p 1234

Answer

ionice -c 2 -n 0 -p 1234

Answer

chrt -r 99 /usr/local/bin/myservice

Question 6

An administrator needs to run a script '/usr/local/bin/cleanup.sh' every day at 2:30 AM. Which crontab entry is correct?

Accepted Answer

30 2 * * * /usr/local/bin/cleanup.sh. The correct crontab syntax is `minute hour day month weekday command`. Option D specifies minute 30, hour 2, and asterisks for all other fields, which means the script runs at 2:30 AM every day. This matches the requirement exactly.

Answer

2 30 * * * /usr/local/bin/cleanup.sh

Answer

*/30 2 * * * /usr/local/bin/cleanup.sh

Answer

30 * * * * /usr/local/bin/cleanup.sh

Question 7

After modifying the network configuration on a RHEL 8 system using NetworkManager, what command should be used to apply the changes without restarting the network service?

Accepted Answer

nmcli con up 'System eth0'. nmcli con up <connection> activates the connection with new settings. nmcli connection reload reloads from disk but does not apply to active connections.

Answer

nmcli connection reload

Answer

ifup eth0

Answer

systemctl restart NetworkManager

Question 8

During boot, the system drops into an emergency target. Which command can be used to repair the root filesystem from this environment?

Accepted Answer

fsck /dev/sda1. In emergency mode, the root filesystem is often mounted read-only. fsck can check and repair filesystems, but requires the filesystem to be unmounted.

Answer

mount -o remount,rw / && fsck /

Answer

xfs_repair /dev/sda1

Answer

journalctl -xb

Question 9

A system administrator configures PAM to enforce account lockout after 3 failed login attempts. Which PAM module should be used?

Accepted Answer

pam_faillock. pam_faillock is the correct PAM module for enforcing account lockout after a specified number of failed login attempts. It tracks failed authentication attempts per user and can lock the account when the threshold (e.g., 3 attempts) is reached, typically by writing to a tally file like /var/log/faillock.

Answer

pam_pwquality

Answer

pam_securetty

Answer

pam_unix

Question 10

Given the journalctl output for the httpd service, which of the following is the most likely cause?

Accepted Answer

The /var/www directory is missing the execute (x) permission for the Apache user. The journalctl output for the httpd service likely shows 'Permission denied' errors when Apache tries to serve files from /var/www. The most common cause is that the /var/www directory lacks the execute (x) permission for the Apache user (typically 'apache' or 'www-data'). Without execute permission on the directory, Apache cannot traverse into it to access files, even if the files themselves have correct permissions. This is a standard Linux permission issue distinct from SELinux or file-level read permissions.

Answer

The file /var/www/html/index.html has incorrect SELinux context

Answer

The Apache service is running under the wrong user

Answer

The file /var/www/html/index.html is missing read permission for the Apache user

Question 11

A system administrator runs 'umask 027' in a Bash shell. What will be the default permissions for a new directory created in that shell? (Assume no other umask changes.)

Accepted Answer

rwxr-x--- (750). The umask value 027 subtracts permissions from the base 777 for directories. 777 minus 027 equals 750, which translates to rwxr-x---. The owner gets full permissions (rwx), the group gets read and execute (r-x), and others get no permissions (---).

Answer

rwxrwxr-x (775)

Answer

rwxrwxrwx (777)

Answer

rw-rw-r-- (664)

Question 12

A security engineer needs to verify the authenticity of a downloaded file using its detached GPG signature (file.sig). Which command should be used?

Accepted Answer

gpg --verify file.sig. The `gpg --verify file.sig` command is used to verify the authenticity of a file using its detached GPG signature. The detached signature file (file.sig) contains the cryptographic signature, and GPG checks it against the original file (which must be present in the same directory with the same base name) using the signer's public key from the local keyring. This confirms that the file was signed by the holder of the corresponding private key and has not been tampered with.

Answer

gpg --sign file

Answer

gpg --list-keys

Answer

gpg --decrypt file.gpg

Question 13

An administrator needs to configure SELinux to allow the Apache HTTP server to connect to a database server. Which SELinux boolean should be enabled?

Accepted Answer

httpd_can_network_connect_db. The SELinux boolean `httpd_can_network_connect_db` specifically allows the Apache HTTP server to make outbound TCP connections to database servers (e.g., MySQL, PostgreSQL). This is required when a web application needs to query a remote database. The other booleans control different aspects of httpd's behavior and do not grant network connectivity to databases.

Answer

httpd_can_network_connect

Answer

httpd_enable_cgi

Answer

httpd_use_nfs

Question 14

Which command displays the number of lines, words, and characters in a file?

Accepted Answer

wc file.txt. The `wc` command without any options displays the number of lines, words, and characters in a file, in that order. By default, `wc` counts newline characters (lines), whitespace-delimited tokens (words), and bytes (characters) in the specified file. This makes option A the correct choice for displaying all three counts.

Answer

wc -w file.txt

Answer

cat file.txt | wc -l

Answer

stat file.txt

Question 15

A user reports that a custom application service fails to start with a 'Permission denied' error in the logs. The service runs under the 'appuser' account. Which is the most likely cause and the first step to diagnose?

Accepted Answer

SELinux is blocking the service; check journalctl for AVC denials and use restorecon or setsebool.. SELinux enforces mandatory access controls that can block a service from starting even when standard Linux file permissions are correct. The 'Permission denied' error, combined with the service running under a non-root user, strongly suggests SELinux is denying access. Checking journalctl for AVC denials is the standard first diagnostic step to confirm SELinux involvement, followed by using restorecon to fix file context labels or setsebool to adjust SELinux booleans.

Answer

The root password is incorrect; change root password with passwd.

Answer

The service binary does not have execute permission for appuser; use chmod +x.

Answer

The systemd target is not set to multi-user; run systemctl set-default multi-user.target.

Question 16

A user reports that a recently installed application fails to start. The application was installed via a shell script that added a repository and installed the package. The user runs 'ldd /usr/bin/app' and sees several 'not found' libraries. Which of the following is the MOST likely cause?

Accepted Answer

The installation script did not install all required dependencies.. The `ldd` command lists shared library dependencies for a binary. When it reports 'not found' libraries, it means the dynamic linker cannot locate the required `.so` files. Since the application was installed via a shell script that added a repository and installed the package, the most likely cause is that the script failed to install all required dependencies, leaving the binary unable to resolve its shared library links.

Answer

The kernel version is outdated.

Answer

SELinux is blocking the application.

Answer

The file system is corrupted.

Question 17

A process has become unresponsive and is in a zombie state. Which action should the administrator take to remove the zombie process?

Accepted Answer

Kill the parent process of the zombie. A zombie process is a child process that has terminated but whose exit status has not been read by its parent. The only way to remove it is to kill the parent process (using kill -9 or similar), which causes the zombie to be re-parented to init (PID 1), which then automatically reaps it by calling wait(). Option D is correct because directly killing the zombie (kill -9) has no effect—the zombie is already dead and cannot receive signals.

Answer

kill -18 <PID>

Answer

kill -9 <PID>

Answer

Wait for the init process to clean it up; no action needed

Question 18

A system administrator needs to restrict SSH access to a Linux server to only users in the 'sshusers' group. Which configuration change achieves this?

Accepted Answer

Add 'AllowGroups sshusers' to /etc/ssh/sshd_config. The 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH access to only users who are members of the specified group. When set to 'AllowGroups sshusers', only users belonging to the 'sshusers' group will be permitted to log in via SSH, effectively blocking all others. This is the standard method for group-based access control in OpenSSH.

Answer

Add 'DenyUsers *' to /etc/ssh/sshd_config

Answer

Set 'PermitRootLogin no' in /etc/ssh/sshd_config

Answer

Add 'AllowUsers sshusers' to /etc/ssh/sshd_config

Question 19

The /home partition is nearly full. The administrator wants to increase the size of the home filesystem. Which action should be taken first?

Accepted Answer

Unmount the /home filesystem. Before any logical volume or filesystem operations can be performed on a partition that is in use, the filesystem must be unmounted to prevent data corruption and ensure the metadata is in a consistent state. The /home filesystem is actively used by user processes, so unmounting it first is mandatory before resizing or extending the underlying logical volume.

Answer

Use resize2fs on /dev/mapper/vg-home

Answer

Use lvextend to extend the logical volume

Answer

Add a new disk to the volume group

Question 20

Refer to the exhibit. A web server is experiencing performance issues. Based on the process list shown, which action should the administrator take first?

Accepted Answer

Identify and restart the parent process to clean up the zombie.

Answer

Increase the PID limit in /proc/sys/kernel/pid_max.

Answer

Kill the parent process of the zombie (PID 1234).

Answer

Terminate the zombie process with SIGKILL.