XK0-006 Practice Test 35 — 15 Questions

Question 1

A web server is experiencing high load. The administrator wants to identify the processes consuming the most CPU. Which TWO commands can be used to display real-time process CPU usage?

Accepted Answer

top. (top) is correct because it provides a real-time, dynamic view of system processes, including CPU usage, and updates continuously by default. Option E (ps aux --sort=-%cpu) is also correct because it lists all processes sorted by CPU usage in descending order, though it is a snapshot rather than continuous; however, the question asks for commands that can be used to display real-time process CPU usage, and ps with the --sort flag can be run repeatedly to approximate real-time monitoring.

Answer

lsof

Answer

iostat

Answer

vmstat

Question 2

A junior administrator is tasked with setting up a file server using NFS on a Linux server. The /etc/exports file currently contains: /srv/nfs *(rw,sync,no_subtree_check). The administrator wants to restrict access to only the 192.168.10.0/24 network and require clients to use a privileged port (less than 1024) for added security. Additionally, the administrator wants to prevent root users on the client from having root access to the NFS share. Which exports configuration meets these requirements?

Accepted Answer

/srv/nfs 192.168.10.0/24(rw,sync,no_subtree_check,secure,root_squash). It restricts access to the 192.168.10.0/24 network, uses the 'secure' option to require client connections from a privileged port (less than 1024), and applies 'root_squash' to map root users on the client to the anonymous 'nobody' user, preventing root-level access to the NFS share.

Answer

/srv/nfs 192.168.10.0/24(rw,sync,no_subtree_check,no_all_squash)

Answer

/srv/nfs 192.168.10.0/24(rw,sync,no_subtree_check,insecure,root_squash)

Answer

/srv/nfs 192.168.10.0/24(rw,sync,no_subtree_check,secure,no_root_squash)

Question 3

A system administrator is configuring centralized logging for a cluster of web servers. Each web server runs rsyslog and needs to forward its Apache access logs to a central log server at 192.168.1.100 over UDP port 514. The administrator adds the following line to /etc/rsyslog.conf on each web server: '*.* @192.168.1.100:514'. After restarting rsyslog, no logs appear on the central server. The administrator checks the network connectivity and finds that the central server is reachable and listening on UDP 514. Which additional configuration is most likely required on the web servers to forward the Apache logs?

Accepted Answer

Configure Apache to send access logs to syslog using the 'syslog' facility in the LogFormat directive.. The wildcard '*.*' in rsyslog forwards all logs that are already being sent to syslog. However, Apache by default writes access logs directly to a file (e.g., /var/log/httpd/access_log) and does not send them to syslog. Therefore, to forward Apache access logs to the central server, Apache must be configured to send its logs to rsyslog using the 'syslog' facility. This is done by modifying the Apache LogFormat directive to include 'syslog' as the log destination, or by using the CustomLog directive with a syslog: prefix. Option C correctly addresses this. Option A is irrelevant because imuxsock is for receiving local syslog messages, not for Apache logs. Option B creates a filter in rsyslog but does not make Apache send logs to syslog. Option D changes the protocol but the issue is not about protocol mismatch; the central server is listening on UDP and reachable.

Answer

Enable the 'imuxsock' module in rsyslog to listen on a Unix socket for Apache logs.

Answer

Create a configuration file in /etc/rsyslog.d/ with a more specific filter for Apache logs.

Answer

Change the forwarding protocol from UDP to TCP in both the sender and receiver.

Question 4

A user is able to ping the Linux server but cannot connect via SSH. The SSH service is running and listening. Which configuration file should the administrator review FIRST?

Accepted Answer

/etc/ssh/sshd_config. The SSH service is running and listening, but the user cannot connect. This points to a configuration issue within the SSH daemon itself. The `/etc/ssh/sshd_config` file controls SSH server settings such as allowed authentication methods, port numbers, and user access restrictions (e.g., `AllowUsers`, `DenyUsers`, `PermitRootLogin`). Reviewing this file first is the logical step to identify why connections are being rejected despite the service being active.

Answer

/etc/pam.d/login

Answer

/etc/nsswitch.conf

Answer

/etc/hosts.allow

Question 5

Refer to the exhibit. A security analyst notices repeated failed SSH login attempts from multiple IP addresses. Which two actions would best mitigate this brute-force attack? (Choose two.)

Accepted Answer

Set PermitRootLogin to no in /etc/ssh/sshd_config to prevent root login.. The logs show repeated failed SSH login attempts from multiple IPs, characteristic of a brute-force attack. Setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents attackers from targeting the root account directly, a common target. Installing and configuring fail2ban automatically blocks IPs after a configurable number of failed attempts, reducing the attack surface. Option B (changing the port) is security through obscurity and not a robust mitigation—automated scanners will find the new port. Option C (disabling password authentication) may be a valid long-term security measure but is not the most immediate mitigation, and it could break legitimate users if keys are not yet deployed. Option D (increasing MaxAuthTries) would allow more attempts, making the attack easier, not harder.

Answer

Change the SSH port to a non-standard port to evade automated attacks.

Answer

Disable password authentication and force key-based authentication only.

Answer

Increase MaxAuthTries to allow more retries before disconnection.

Question 6

Which of the following commands can be used to display the contents of a file one page at a time? (Choose two.)

Accepted Answer

less. The `less` command is a pager that displays file contents one screen at a time, allowing both forward and backward navigation. It is designed for viewing large files interactively, loading only the visible portion into memory for efficiency.

Answer

head

Answer

cat

Answer

tail

Question 7

Which command displays the current SELinux mode?

Accepted Answer

getenforce. The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It reads the enforcing status directly from the kernel, making it the correct choice for checking the runtime mode.

Answer

sestatus

Answer

setenforce

Answer

selinuxenabled

Question 8

A server is experiencing intermittent high load. The administrator suspects a memory leak in a service. Which sysfs file should the administrator monitor to track memory usage per cgroup?

Accepted Answer

/sys/fs/cgroup/memory/memory.usage_in_bytes. Memory.usage_in_bytes in the cgroup v1 memory hierarchy shows the current memory consumption of processes within a specific cgroup, making it the direct metric to monitor for a suspected memory leak in a service. Unlike system-wide files, this per-cgroup file reflects only the memory used by the service's control group, allowing precise tracking of growth over time.

Answer

/sys/fs/cgroup/memory/memory.limit_in_bytes

Answer

/proc/meminfo

Answer

/sys/fs/cgroup/memory/memory.stat

Question 9

A systems administrator notices that users can successfully authenticate via SSH using their password, but cannot log in via the console. The /etc/securetty file exists and contains only the default entries. Which configuration change is most likely to resolve the issue?

Accepted Answer

Add 'console' to the /etc/securetty file. The /etc/securetty file lists TTY devices from which root is allowed to log in via console or terminal. By default, it often includes entries like 'tty1' through 'tty6' but not 'console'. Adding 'console' to this file permits root login from the system console, resolving the issue where console authentication fails while SSH (which bypasses /etc/securetty) succeeds.

Answer

Add the denyhosts service to block non-console logins

Answer

Set PermitRootLogin yes in /etc/ssh/sshd_config

Answer

Set SELinux to permissive mode

Question 10

A system administrator is troubleshooting a server running Ubuntu 20.04 that cannot establish outbound SSH connections. The server can ping external IP addresses and resolve hostnames. The administrator tries `ssh user@remotehost` and gets 'Connection timed out'. The firewall (ufw) is active. Which step should be taken?

Accepted Answer

Allow output traffic on port 22 with ufw allow out 22/tcp.. The server can ping external IPs and resolve hostnames, so networking and DNS are working. The issue is that outbound SSH traffic on port 22 is being blocked by the active UFW firewall. The correct step is to allow outbound TCP traffic on port 22 using `ufw allow out 22/tcp`, which permits the client to initiate SSH connections to remote hosts.

Answer

Check the SSH client configuration in /etc/ssh/ssh_config.

Answer

Restart the networking service.

Answer

Disable the firewall with ufw disable.

Question 11

A system administrator suspects a disk failure. Which TWO commands can be used to check disk health and identify bad sectors?

Accepted Answer

badblocks -v /dev/sda. The `badblocks` command (option C) directly scans a disk for defective sectors by performing read/write tests, making it a primary tool for identifying bad blocks. The `smartctl -a` command (option D) queries the disk's S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology) data, which includes attributes like reallocated sector count and pending sector errors, providing a proactive health assessment. Together, they cover both active scanning and passive monitoring of disk health.

Answer

iostat -x

Answer

fsck /dev/sda

Answer

dd if=/dev/sda of=/dev/null

Question 12

A Linux administrator is writing a script that must wait for a background process to finish before continuing. The process ID is stored in a variable. Which command should be used to wait for this process?

Accepted Answer

wait $PID. The `wait` command in Bash, when given a specific process ID (PID), suspends execution of the calling shell script until that background process terminates. This directly fulfills the requirement to wait for a specific background process whose PID is stored in a variable.

Answer

sleep 10

Answer

wait

Answer

kill -0 $PID

Question 13

A web server is running on the system but clients cannot connect to port 8080. Based on the exhibit, which command should the administrator run to allow traffic on port 8080?

Accepted Answer

firewall-cmd --add-port=8080/tcp --permanent. The correct command is `firewall-cmd --add-port=8080/tcp --permanent` because it opens TCP port 8080 in firewalld, which is the default firewall management tool on RHEL/CentOS 8/9. Since the web server is running but clients cannot connect, the firewall is likely blocking inbound traffic on that port. The `--add-port` option with the `tcp` protocol explicitly allows TCP connections, and `--permanent` makes the rule persist across reboots.

Answer

firewall-cmd --add-rich-rule='rule port port=8080 protocol=tcp accept' --permanent

Answer

firewall-cmd --add-port=8080/udp --permanent

Answer

firewall-cmd --add-service=http --permanent

Question 14

A technician has just performed system maintenance and wants to verify that the server has been running continuously for the past 30 days. Which command should the technician use?

Accepted Answer

uptime. The `uptime` command displays how long the system has been running since the last boot, including the current time, number of logged-in users, and load averages. By checking the output, the technician can verify if the server has been running continuously for the past 30 days (e.g., 'up 30 days'). This directly answers the question without querying logs or processes.

Answer

systemctl status rsyslog

Answer

ps aux

Answer

date

Question 15

A database server is running slow. The administrator uses iostat and notices high await times on the disk. Which of the following best explains the implication of high await?

Accepted Answer

Disk I/O requests are taking a long time to complete.. In iostat, 'await' measures the average time (in milliseconds) for I/O requests to be served by the disk, including time spent in the queue and the actual service time. A high await value indicates that disk I/O requests are taking a long time to complete, which directly explains the database server's slowness due to disk latency.

Answer

The CPU is waiting too long for memory access.

Answer

The disk is almost full, causing fragmentation.

Answer

The network filesystem is experiencing latency.