XK0-006 Practice Test 2 — 30 Questions

Question 1

A user reports that a custom application service fails to start with a 'Permission denied' error in the logs. The service runs under the 'appuser' account. Which is the most likely cause and the first step to diagnose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SELinux is blocking the service; check journalctl for AVC denials and use restorecon or setsebool.. SELinux enforces mandatory access controls that can block a service from starting even when standard Linux file permissions are correct. The 'Permission denied' error, combined with the service running under a non-root user, strongly suggests SELinux is denying access. Checking journalctl for AVC denials is the standard first diagnostic step to confirm SELinux involvement, followed by using restorecon to fix file context labels or setsebool to adjust SELinux booleans.

Answer

The root password is incorrect; change root password with passwd.

Answer

The service binary does not have execute permission for appuser; use chmod +x.

Answer

The systemd target is not set to multi-user; run systemctl set-default multi-user.target.

Question 2

What does the `set -x` command do when placed at the top of a bash script?

Accepted Answer

Displays each command before executing it. `set -x` enables a shell debugging mode that prints each command (after expansion) to stderr before executing it. This is commonly used in bash scripts to trace execution flow and debug complex logic.

Answer

Enables position parameters

Answer

Exits the script on error

Answer

Treats unset variables as errors

Question 3

A technician needs to check the kernel ring buffer for hardware errors detected during system boot. Which command should be used?

Accepted Answer

dmesg. The kernel ring buffer contains messages emitted by the kernel, including hardware detection and error messages during boot. The 'dmesg' command reads and prints this buffer directly. It is the canonical tool for inspecting kernel-level hardware errors, driver initialization failures, and boot-time device detection.

Answer

journalctl -k

Answer

lspci

Answer

cat /var/log/boot.log

Question 4

A system administrator wants to deploy a containerized application on a Linux server with minimal overhead and without a daemon. Which container runtime should be used?

Accepted Answer

Podman. Podman is the correct choice because it is a daemonless container engine that runs containers directly under the user's process space, using a fork-exec model rather than a background daemon. This aligns with the requirement for minimal overhead and no daemon, as Podman does not require a persistent service to manage containers.

Answer

containerd

Answer

LXC

Answer

Docker

Question 5

Match each Linux filesystem to its typical use case.

Accepted Answer

ext4: General-purpose filesystem for Linux desktops and servers. Correct matches: ext4 for general use, XFS for large files, Btrfs for advanced features. Common confusions: swap vs tmpfs where swap is disk-based virtual memory and tmpfs is RAM-based temporary storage.

Answer

swap: Temporary filesystem stored in RAM

Answer

tmpfs: Space on disk used as virtual memory

Question 6

A Linux administrator needs to verify which network interfaces are up and their IP addresses on a server. Which command provides this information?

Accepted Answer

ip addr. The `ip addr` command displays all network interfaces along with their IP addresses, MAC addresses, and status (UP/DOWN).

Answer

ss -tlnp

Answer

nmcli dev show

Answer

ifconfig -a

Question 7

A security audit reveals that the /etc/shadow file has permissions 0644 and is owned by root:shadow. The auditor states that this is a security risk because any local user can read password hashes. The administrator wants to fix the permissions to ensure that only root and the shadow group can read the file, and no one else can read it. Additionally, the administrator wants to set the immutable attribute on the file to prevent accidental modification. Which set of commands achieves the desired state?

Accepted Answer

chmod 640 /etc/shadow; chattr +i /etc/shadow. Chmod 640 sets the file permissions to read/write for root (owner) and read-only for the shadow group, while removing all access for others. chattr +i sets the immutable attribute, which prevents any modifications (including deletion, renaming, or content changes) even by root until the attribute is removed. This satisfies the requirement that only root and the shadow group can read the file, and no one else can read it, while also protecting against accidental modification.

Answer

chmod 640 /etc/shadow; chattr +a /etc/shadow

Answer

chmod 640 /etc/shadow; chmod +i /etc/shadow

Answer

chmod 600 /etc/shadow; chattr +i /etc/shadow

Question 8

Which command is used to query the status of a service managed by systemd?

Accepted Answer

systemctl status servicename. systemctl status shows whether a service is active, enabled, and recent log entries.

Answer

journalctl -u servicename

Answer

service servicename status

Answer

systemctl list-units --type=service

Question 9

Which TWO commands can be used to change the group ownership of a file? (Choose exactly two.)

Accepted Answer

chgrp. Option B (chgrp) is correct because chgrp is the dedicated command for changing a file's group ownership, e.g. 'chgrp developers file.txt' sets the group of file.txt to developers. Option D (chown) is correct because chown can also change group ownership using the ':group' or '.group' syntax, e.g. 'chown :developers file.txt' or 'chown user:developers file.txt'. Option A (chmod) is incorrect because it modifies read/write/execute permission bits (and special bits like setgid), not the owning group itself. Option C (groupmod) is incorrect because it modifies attributes of an existing group in /etc/group, such as its name or GID, not a file's group ownership. Option E (usermod) is incorrect because it modifies user account attributes such as group membership, home directory, or shell, not file ownership.

Answer

chmod

Answer

groupmod

Answer

usermod

Question 10

A Linux system has a directory with permissions drwxr-xr-x. A user in the group 'dev' tries to create a new file inside this directory. Which permission is missing that prevents the user from creating the file?

Accepted Answer

Write permission for the group. The directory has write permission for the owner, but only read and execute for the group. To create a file, the user needs write permission on the directory, which is not granted to the group.

Answer

Write permission for the owner

Answer

Sticky bit is set

Answer

Execute permission for the group

Question 11

Refer to the exhibit. A web application running under Apache cannot write to /var/log/app.log. The file has permissions 664 and is owned by apache. What is the correct action to allow writes while maintaining SELinux policies?

Accepted Answer

Change the SELinux context of the file to httpd_log_t.. The file /var/log/app.log has permissions 664 and is owned by apache, so the web server should be able to write to it. However, SELinux is blocking the write because the file's SELinux context does not match the type expected for files that Apache (httpd) is allowed to write to. Changing the SELinux context to httpd_log_t tells SELinux that this file is a log file that httpd can write to, which resolves the denial while keeping SELinux enforcing.

Answer

Change the ownership to root.

Answer

Set the httpd_can_network_connect boolean.

Answer

Disable SELinux for the httpd daemon.

Question 12

In a Bash script, what is the difference between single quotes and double quotes?

Accepted Answer

Single quotes prevent variable expansion; double quotes allow it.. Single quotes preserve the literal value of each character, while double quotes allow variable expansion and command substitution.

Answer

Both behave the same.

Answer

Single quotes allow variable expansion; double quotes do not.

Answer

Double quotes prevent all substitutions; single quotes allow command substitution.

Question 13

A system administrator is writing a Bash script that must check if a file exists and is readable. Which two test expressions can be used to achieve this? (Choose two.)

Accepted Answer

-e /path/to/file. Option A, `-e /path/to/file`, is correct because the `-e` test in Bash returns true if the file exists, regardless of its type (regular file, directory, device, etc.), which satisfies the existence check. Option C, `-r /path/to/file`, is correct because the `-r` test returns true if the file exists and the current user has read permission on it, satisfying the readability check. Together, `-e` and `-r` cover the two required conditions of existence and readability. Option B, `-s`, only checks that the file exists and has a size greater than zero, so it does not verify readability. Option D, `-x`, checks for execute permission rather than read permission, so it does not meet the requirement. Option E, `-f`, only checks that the path exists and is a regular file, not that it is readable.

Answer

-s /path/to/file

Answer

-x /path/to/file

Answer

-f /path/to/file

Question 14

A Docker container using port 8080 fails to start with the error 'port is already allocated'. Which command should the administrator use to identify the process using that port?

Accepted Answer

ss -tlnp. The `ss -tlnp` command lists TCP listening sockets (`-l`) with numeric addresses (`-n`) and shows the process identifier (PID) and process name (`-p`) that owns each socket. This directly identifies which process has bound port 8080, allowing the administrator to resolve the 'port is already allocated' error.

Answer

ss -tan

Answer

ss -tln

Answer

ss -r

Question 15

A Kubernetes pod has a container that fails with CrashLoopBackOff. The administrator runs 'kubectl logs pod-name' but sees no output. What is the most likely cause?

Accepted Answer

The container exited before writing to stdout, and logs need to be retrieved with 'kubectl logs --previous'.. When a container enters CrashLoopBackOff, it restarts repeatedly. If 'kubectl logs pod-name' shows no output, it means the current (restarted) container has not written anything to stdout yet. The previous instance of the container may have written logs before crashing, and those logs are accessible using 'kubectl logs --previous' to retrieve the output from the terminated container.

Answer

The container has no logging driver configured.

Answer

The log file is rotated and deleted.

Answer

The pod is not scheduled on any node.

Question 16

A storage administrator needs to automate the expansion of an LVM volume group when free space drops below 10%. The script must add a new physical volume from a spare disk. Which of the following commands should be used in the script to add the new disk to the volume group?

Accepted Answer

pvcreate /dev/sdb1 && vgextend vg01 /dev/sdb1. It first uses `pvcreate` to initialize the spare disk partition `/dev/sdb1` as a physical volume, which is a prerequisite for adding it to an LVM volume group. Then `vgextend vg01 /dev/sdb1` adds that initialized physical volume to the existing volume group `vg01`, expanding its total capacity. This two-step process ensures the disk is properly prepared for LVM management before being incorporated into the volume group.

Answer

vgcreate vg01 /dev/sdb

Answer

vgextend vg01 /dev/sdb1

Answer

lvresize -L +100G vg01

Question 17

A server crashed with a kernel panic. After reboot, the administrator wants to analyze the crash dump. Which THREE actions should be taken to ensure a valid core dump is captured and accessible? (Choose THREE.)

Accepted Answer

Configure a dump target in /etc/kdump.conf.. Option A is correct because /etc/kdump.conf is the kdump configuration file where you must specify the dump target (e.g., a raw device, path, NFS, or SSH location) so the vmcore is written to a persistent, accessible location after the crash. Option B is correct because the kdump service (kdump.service) must be enabled and started so the kdump initramfs is loaded and the capture mechanism is armed for the next kernel panic. Option C is correct because the crashkernel=auto (or an explicit size like crashkernel=256M) kernel parameter in the boot loader reserves memory for the secondary kernel that performs the dump; without it, no dump can be captured. Option D is not required to capture a dump; kernel-debuginfo is only needed later for analyzing the vmcore with tools like crash. Option E is incorrect because /var/crash/vmcore is the result of a successful capture, not an action taken to ensure one, and its presence cannot be guaranteed before a crash occurs.

Answer

Install kernel-debuginfo packages.

Answer

Ensure /var/crash has a vmcore file.

Question 18

A system administrator is working with compressed files. Which THREE commands can be used to view their contents? (Select THREE).

Accepted Answer

zgrep. Option A, zgrep, is correct because it searches inside gzip-compressed files directly, decompressing the stream on the fly and printing matching lines without requiring manual extraction. Option C, zcat, is correct because it decompresses gzip files to standard output, allowing their contents to be viewed (often piped to a pager). Option E, zless, is correct because it is a pager wrapper that decompresses gzip files and displays them page by page, making it ideal for viewing compressed content interactively. Options B (cat) and D (less) are not marked correct because they operate on plain uncompressed files and would output raw binary garbage when applied directly to a gzip-compressed file.

Answer

cat

Answer

less

Question 19

An administrator is managing a Kubernetes cluster. A pod is running but not responding as expected. The administrator wants to view the standard output logs from the pod's main container. Which kubectl command should be used?

Accepted Answer

kubectl logs . The kubectl logs command retrieves the standard output (stdout) and standard error (stderr) logs from a pod's container, which is exactly what the administrator needs. By default it targets the main container; if multiple containers exist, -c specifies one. This is the standard way to view application logs without exec'ing into the container.

Answer

kubectl exec <pod-name> -- cat /var/log/app.log

Answer

kubectl get pod <pod-name> -o yaml

Answer

kubectl describe pod <pod-name>

Question 20

A Linux administrator needs to add a new user named 'jdoe' with a home directory and bash shell. Which command accomplishes this?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command creates a new user, and the -m flag creates the home directory, -s sets the shell. useradd -m -s /bin/bash jdoe is correct.

Answer

groupadd -u jdoe -s /bin/bash

Answer

adduser -h /home/jdoe -s bash jdoe

Answer

usermod -m -s /bin/bash jdoe