XK0-006 Practice Test 31 — 15 Questions

Question 1

A server is experiencing high CPU load. The administrator needs to identify which process is consuming the most CPU resources in real time. Which command should be used?

Accepted Answer

top. The `top` command provides a real-time, dynamic view of running processes, including CPU usage, and updates continuously by default. It is the standard tool for identifying which process is currently consuming the most CPU resources on a Linux system.

Answer

w

Answer

vmstat

Answer

uptime

Answer

ps aux --sort=-%cpu

Question 2

A Linux administrator writes a Python script to parse configuration files. Which TWO practices improve security and portability? (Select TWO.)

Accepted Answer

Validate all external input before processing. Option A is correct because validating all external input before processing defends against injection attacks and malformed data, and it also makes the script behave predictably across environments where input formats may differ. Option E is correct because the shebang #!/usr/bin/env python3 locates the Python 3 interpreter via the PATH, which improves portability across systems where python3 is installed in different locations, and it explicitly targets Python 3 rather than the deprecated Python 2. Option B is not required for security or portability; absolute paths can actually reduce portability when directories differ between systems. Option C is a poor practice because embedding sudo in a script escalates privileges and can expose credentials or allow unintended privileged execution. Option D is incorrect because raw_input() is Python 2-only and does not improve security or portability in modern Python 3 scripts.

Answer

Use absolute paths for all file operations

Answer

Use sudo within the script to run privileged commands

Answer

Use raw_input() instead of input() in Python 2

Question 3

In a bash script, a developer needs to parse command-line options such as -f filename and -v (verbose). Which built-in command is best suited for this task?

Accepted Answer

getopts. getopts is a bash built-in for parsing command-line options. It handles short options and requires option arguments.

Answer

getopt

Answer

case

Answer

shift

Question 4

An administrator needs to grant read and write access to the 'developers' group on a directory while preserving existing permissions for the owner and others. Which TWO commands can be used to modify ACLs? (Choose two.)

Accepted Answer

setfacl -m g:developers:rw /dir. setfacl -m g:developers:rw /dir is the correct command to grant read-write access to the developers group. Option C uses u:developers, which sets an ACL for a user named 'developers', not the developers group, so it does not satisfy the requirement. chmod changes standard permissions, getfacl only displays ACLs, and setfacl -x removes ACL entries. Therefore, only option E is correct.

Answer

chmod g+rw /dir

Answer

getfacl /dir

Answer

setfacl -m u:developers:rw /dir

Answer

setfacl -x g:developers /dir

Question 5

An administrator is creating an Ansible playbook to configure multiple web servers. Which of the following are valid ways to define variables for different groups of hosts? (Choose TWO.)

Accepted Answer

In a group_vars directory. In Ansible, group variables can be defined in a group_vars directory (A) or directly in the inventory file using the :vars suffix, such as [webservers:vars] (B). The host_vars directory (C) is used for variables specific to individual hosts, not for groups of hosts. Since the question asks for two valid ways to define variables for groups, the correct answers are A and B.

Answer

In a host_vars directory

Answer

In the playbook itself using vars_files

Answer

In the roles directory

Question 6

A DevOps engineer is creating a Podman container that needs to communicate with a host service listening on a Unix socket at /run/host-service.sock. Which of the following mount options will make the socket available inside the container?

Accepted Answer

--volume /run/host-service.sock:/run/host-service.sock. Both option C (`--volume`) and option D (`--mount type=bind,source=...,target=...`) can bind-mount a Unix socket into a Podman container. Podman's `--mount` with `type=bind` supports individual file sources, including sockets, just like Docker. The `--volume` flag is a shorthand that also works for files and directories. Options A (`--device`) and B (`--bind`) are not valid Podman flags for this purpose.

Answer

--device /run/host-service.sock:/run/host-service.sock

Answer

--bind /run/host-service.sock:/run/host-service.sock

Question 7

An administrator is debugging a Docker container that exits immediately after starting. Which THREE commands can help diagnose the issue? (Select THREE).

Accepted Answer

docker run --rm -it sh. Option A (docker run --rm -it sh) is correct because it overrides the image's default entrypoint/command with an interactive shell, letting you explore the filesystem and manually run the failing process to see errors directly. Option B (docker logs ) is correct because it retrieves stdout/stderr captured from the container's main process, which typically contains the crash message or stack trace explaining the immediate exit. Option C (docker inspect ) is correct because it reveals the container's ExitCode, State, Error, and the configured Entrypoint/Cmd, helping identify misconfigurations or non-zero exit reasons. Option D (docker exec -it sh) does not belong because exec requires a running container, and this container has already exited. Option E (docker ps) does not belong because it only lists running containers by default, so the exited container would not appear unless -a is used, and it provides no diagnostic detail.

Answer

docker exec -it <container> sh

Answer

docker ps

Question 8

A Linux server experiences a kernel panic after a recent driver update. The system is still operational but unstable. Which command should be used to gather detailed information about the kernel modules currently loaded?

Accepted Answer

lsmod. B is correct because `lsmod` lists all currently loaded kernel modules by reading the `/proc/modules` file, showing their size, usage count, and dependencies. In a kernel panic scenario after a driver update, this command quickly reveals which modules are active, helping identify the problematic driver without further destabilizing the system.

Answer

modinfo

Answer

dmesg

Answer

modprobe -l

Question 9

A company policy requires that only the root user can schedule cron jobs. Which configuration ensures this?

Accepted Answer

Create /etc/cron.allow with only 'root'. The /etc/cron.allow file explicitly lists users who are permitted to schedule cron jobs. When this file exists, only users listed in it can use crontab, and all others are denied — even if /etc/cron.deny exists. By placing only 'root' in /etc/cron.allow, the policy that only root can schedule cron jobs is enforced.

Answer

Add 'root' to /etc/crontab

Answer

Set /usr/bin/crontab permissions to 700

Answer

Add all non-root users to /etc/cron.deny

Question 10

After configuring AppArmor, an administrator wants to verify the status of all profiles and switch a profile from complain to enforce mode. Which TWO commands are appropriate? (Choose two.)

Accepted Answer

aa-status. Option B (aa-status) is correct because it is the standard AppArmor utility that reports the current state of all loaded profiles, showing how many are in enforce mode, complain mode, or unconfined, which directly satisfies the requirement to verify the status of all profiles. Option E (aa-enforce /path/to/profile) is correct because aa-enforce is the dedicated command that switches the specified profile into enforce mode, exactly matching the second task of moving a profile from complain to enforce. Option A (systemctl restart apparmor) only reloads the AppArmor service and does not report profile status or change an individual profile's mode. Option C (apparmor_parser -r /etc/apparmor.d/profile) reloads a profile definition from disk but does not by itself toggle the profile between complain and enforce mode. Option D (aa-complain /path/to/profile) is the opposite of what is needed, since it sets a profile to complain mode rather than enforce mode.

Answer

systemctl restart apparmor

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-complain /path/to/profile

Question 11

A Docker container needs to persistently store data that should survive container removal and be accessible by other containers. Which storage method should be used?

Accepted Answer

Volume. Docker volumes are managed by Docker itself and stored in a dedicated area of the host filesystem (typically /var/lib/docker/volumes on Linux), which is outside the container's writable layer. Because they are independent of the container lifecycle, data in a volume persists even after the container is removed, and the same volume can be mounted into multiple containers simultaneously, enabling data sharing. This makes volumes the recommended mechanism for persistent, shareable container data.

Answer

Bind mount

Answer

Container layer

Answer

tmpfs mount

Question 12

Which TWO options are valid ways to pass environment variables to a Docker container?

Accepted Answer

--env-file file. The `--env-file` flag allows you to pass a file containing environment variables to a Docker container, where each line in the file is in `KEY=value` format. Option C is correct because the `-e` (or `--env`) flag directly sets an environment variable inside the container, e.g., `-e VAR=value`. Both are standard Docker CLI methods for injecting environment variables at container runtime.

Answer

--var VAR=value

Answer

--variable VAR=value

Answer

-v VAR=value

Question 13

A server running a critical application needs to be rebooted. To ensure the application stops gracefully and data is not corrupted, which sequence of commands should the administrator use?

Accepted Answer

systemctl stop application; sync; reboot. It first uses systemctl to send a SIGTERM to the application, allowing it to perform a graceful shutdown and flush its data. The sync command then forces any pending disk writes to complete, ensuring filesystem consistency before the reboot. This sequence minimizes the risk of data corruption by giving the application and kernel time to finalize all I/O operations.

Answer

killall -9 application; reboot

Answer

reboot

Answer

umount -a; reboot

Question 14

Given an ACL entry 'u:john:rwx' on a file, which command would remove only the ACL entry for user john without affecting other ACL entries?

Accepted Answer

setfacl -x u:john /path/to/file. The setfacl -x u:john /path/to/file command removes only the ACL entry for user john while leaving all other ACL entries (group entries, mask, other users) intact. The -x flag specifically deletes the named entry, which is exactly what the question requires. This is the surgical removal operation in the setfacl toolkit.

Answer

setfacl -k /path/to/file

Answer

setfacl -m u:john:- /path/to/file

Answer

setfacl -b /path/to/file

Question 15

A cloud engineer is using Ansible to manage configuration across multiple servers. The engineer needs to store variable data that is specific to each host and sensitive database passwords. Which two Ansible features should be used for these purposes? (Choose two.)

Accepted Answer

Ansible Vault. Option E, host_vars, is correct because host-specific variable data is stored in host_vars files (e.g., host_vars/<hostname>.yml), which Ansible automatically loads for the matching inventory host, making it the proper place for per-host values. Option D, Ansible Vault, is correct because it encrypts sensitive data such as database passwords, allowing vault-encrypted variables or files to be decrypted at runtime with the vault password, keeping secrets protected at rest. Option A, group_vars, applies variables to whole inventory groups rather than individual hosts, so it does not satisfy the host-specific requirement. Option B, ansible_facts, holds automatically discovered system information gathered by setup, not user-defined sensitive credentials. Option C, roles, is a structural way to bundle tasks, handlers, and defaults for reuse, not a mechanism for storing host-specific or encrypted secret data.

Answer

group_vars

Answer

ansible_facts

Answer

roles