XK0-006 Practice Test 35 — 15 Questions

Question 1

A system administrator wants to display a list of all currently running processes, including those of other users, with full command lines. Which TWO commands can achieve this? (Select TWO.)

Accepted Answer

ps aux. Both ps aux (C) and ps -ef (E) are correct because the ps command with these option sets lists every process on the system, not just the current user's, and includes the full command line for each process. ps aux uses BSD-style syntax where 'a' shows processes from all users, 'u' displays user-oriented format, and 'x' includes processes without a controlling terminal, with the COMMAND column showing the full command line. ps -ef uses UNIX-style syntax where '-e' selects all processes and '-f' produces full-format output including UID, PID, PPID, and the complete command line. pstree (A) only shows processes as a hierarchical tree and does not display full command lines with arguments. top (B) and htop (D) are interactive process viewers that by default show only a truncated command column and are not the standard non-interactive way to list all processes with full command lines.

Answer

pstree

Answer

top

Answer

htop

Question 2

A system administrator wants to ensure that a container can access host devices such as USB drives. Which Docker run option should be used?

Accepted Answer

--device /dev/ttyUSB0. The `--device` flag in Docker allows a container to directly access a specific host device, such as `/dev/ttyUSB0` for a USB drive or serial adapter. This grants the container read/write permissions to the device node without requiring full privileged access, making it the precise and secure option for this requirement.

Answer

--privileged

Answer

--pid=host

Answer

--net=host

Question 3

A system administrator installs a new application that is failing to write to its configuration file in /etc. SELinux is enforcing. Which command would show the relevant SELinux denials?

Accepted Answer

ausearch -m avc -ts recent. The `ausearch -m avc -ts recent` command queries the audit log for AVC (Access Vector Cache) denial messages, which are the specific SELinux denials logged when a process is blocked from accessing a resource. This is the direct way to view recent SELinux denials in an enforcing mode environment, as it filters audit records by message type (AVC) and time range (recent).

Answer

sealert

Answer

getenforce

Answer

audit2why

Question 4

An administrator wants to monitor disk I/O performance in real-time, focusing on metrics like wait time and I/O queue size. Which tool is best suited for this?

Accepted Answer

iostat -x 1. iostat -x 1 provides extended disk statistics refreshed every second, including await (average wait time), svctm, %util, and avgqu-sz (average queue size), which directly match the requested metrics. The -x flag enables the extended report that exposes per-device wait and queue depth, making it the correct real-time tool.

Answer

vmstat

Answer

sar -b

Answer

free -h

Question 5

Refer to the exhibit. The system log is not updating. What is the cause?

Accepted Answer

The root filesystem is almost full, leaving no space for log growth.. A full root filesystem prevents rsyslogd from writing new entries to /var/log, so the log appears frozen even though the daemon is running. The exhibit (df output showing / at or near 100%) is the giveaway — syslog cannot append when there is no free space, and the kernel may also stop writing to /var/log/messages. Freeing space or moving logs to a separate volume restores logging.

Answer

The syslog file size exceeded 1GB and was rotated.

Answer

The syslog file permissions are incorrect.

Answer

rsyslogd was restarted and lost its configuration.

Question 6

A developer wants to change all occurrences of 'foo' to 'bar' in a configuration file and save the changes in-place. Which sed command should be used?

Accepted Answer

sed -i 's/foo/bar/g' file. The correct command is sed -i 's/foo/bar/g' file because it combines in-place editing (-i) with the global substitution flag (g), replacing every occurrence of 'foo' on each line. Without -i, changes are only printed to stdout; without g, only the first match per line is replaced.

Answer

sed -i 's/foo/bar/' file

Answer

sed -n 's/foo/bar/p' file

Answer

sed 's/foo/bar/g' file

Question 7

An administrator is configuring a Linux firewall to allow incoming SSH (port 22) and HTTPS (port 443) traffic while denying all other incoming traffic. Using iptables, which set of commands achieves this?

Accepted Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT. It first sets the default policy on the INPUT chain to DROP, which denies all incoming traffic by default. It then adds rules to explicitly ACCEPT incoming TCP traffic on ports 22 (SSH) and 443 (HTTPS), achieving the requirement of allowing only those two services while dropping everything else.

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Answer

iptables -P FORWARD DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 443 -j DROP

Question 8

A Linux administrator needs to view the contents of a compressed log file without decompressing it. Which command should be used?

Accepted Answer

zcat. zcat is the correct command because it decompresses and displays the contents of files compressed with gzip (or compress) to standard output without creating a decompressed file on disk. This allows viewing compressed logs directly, which is essential for troubleshooting without modifying the original file. It is functionally equivalent to 'gzip -dc' or 'gunzip -c'.

Answer

cat

Answer

bzcat

Answer

gunzip

Question 9

Which file contains the hashed passwords and password aging information for user accounts?

Accepted Answer

/etc/shadow. /etc/shadow stores password hashes and aging fields.

Answer

/etc/gshadow

Answer

/etc/group

Answer

/etc/passwd

Question 10

A system administrator wants to ensure that the /tmp directory is mounted with noexec to prevent code execution from temporary files. Which file should be modified to persist this across reboots?

Accepted Answer

/etc/fstab. The /etc/fstab file is the system configuration file that defines how disk partitions, block devices, and remote filesystems are mounted at boot time. Adding the noexec mount option to the /tmp entry in /etc/fstab ensures that the /tmp directory is mounted with the noexec flag persistently across reboots, preventing execution of binaries from temporary files.

Answer

/etc/mtab

Answer

/etc/sysconfig/network

Answer

/etc/security/limits.conf

Question 11

A security policy requires that user home directories have permissions set so that only the owner has access. A new user 'john' has a home directory with permissions 755. Which command should the administrator run to enforce the policy?

Accepted Answer

chmod 700 /home/john. The security policy requires that only the owner has access to the home directory. The current permissions 755 grant read and execute access to the group and others. The chmod 700 command sets permissions to rwx------, which gives the owner full access and removes all permissions for the group and others, enforcing the policy.

Answer

chmod 711 /home/john

Answer

chmod 770 /home/john

Answer

chmod 750 /home/john

Question 12

The backup script above always outputs 'Backup failed' even when the tar command succeeds. Which of the following is the cause?

Accepted Answer

The correct variable is $? not &?. The script uses `&?` to reference the exit status of the `tar` command, but the correct shell variable is `$?`. The `$?` variable holds the exit code of the last executed command (0 for success, non-zero for failure). Using `&?` is a syntax error that results in an empty or invalid value, causing the `if` statement to always evaluate to false (or treat the condition as non-zero), thus always printing 'Backup failed'.

Answer

The tar command should use -czvf

Answer

The if statement syntax is wrong

Answer

The variable &? is not defined

Question 13

A Linux administrator needs to add an ACL entry to grant read permission to a user named 'jdoe' on a file. Which TWO commands can be used to achieve this? (Select TWO).

Accepted Answer

setfacl -m u:jdoe:r file. Option A, `setfacl -m u:jdoe:r file`, is correct because `-m` is the short form of `--modify`, and `u:jdoe:r` adds or modifies an ACL entry granting user jdoe read permission on the file. Option B, `setfacl --modify u:jdoe:r file`, is correct because it is the long-form equivalent of the same command, performing the identical ACL modification. Option C, `chown jdoe file`, only changes the file's owner and does not create an ACL entry, so it does not grant read permission via ACL. Option D, `setfacl -x u:jdoe file`, removes an existing ACL entry for jdoe rather than adding one. Option E, `chmod u+r file`, modifies the standard Unix permission bits for the file's owner, not an ACL entry for jdoe.

Answer

chown jdoe file

Answer

setfacl -x u:jdoe file

Answer

chmod u+r file

Question 14

An administrator is investigating a network issue where a server cannot connect to an external website. They run `ping 8.8.8.8` successfully, but `ping google.com` fails. Which TWO of the following are the most likely causes? (Choose TWO.)

Accepted Answer

The DNS server is unreachable or misconfigured.. Option C is correct because the successful `ping 8.8.8.8` proves IP connectivity and routing to the internet work, while the failure of `ping google.com` indicates name resolution is failing — meaning the configured DNS server is unreachable, misconfigured, or not responding on port 53. Option E is correct because an incorrect entry for google.com in /etc/hosts would cause the resolver to return a wrong IP address for that hostname before ever querying DNS, producing exactly this symptom (numeric IP works, hostname fails). Option A is wrong because a down network interface would prevent even `ping 8.8.8.8` from succeeding. Option B is wrong because a misconfigured default gateway would break routing to external IP addresses, so the numeric ping to 8.8.8.8 would also fail. Option D is wrong because a firewall blocking ICMP would cause both pings to fail, not just the hostname-based one.

Answer

The network interface is down.

Answer

The default gateway is misconfigured.

Answer

The firewall is blocking ICMP traffic.

Question 15

A DevOps engineer is writing a unit file for a systemd service that should start after the network-online.target. Which directive should be added to the [Unit] section?

Accepted Answer

After=network-online.target. The 'After=' directive in the [Unit] section of a systemd unit file specifies the ordering relationship, ensuring that the current service starts only after the named unit (network-online.target) has reached the 'active' state. This is the correct directive for controlling startup order without creating a dependency that would force the target to start if it is not already enabled.

Answer

Requires=network-online.target

Answer

Wants=network-online.target

Answer

BindsTo=network-online.target