XK0-005 Practice Test 36 — 15 Questions

Question 1

Refer to the exhibit. A user cannot access a web server, but another host on the same subnet can. What is the most likely cause?

Accepted Answer

The user's workstation has a local firewall blocking outbound HTTPS.

Answer

The network router is blocking the user's traffic.

Answer

The web server is down.

Answer

DNS is resolving to the wrong IP for the user.

Question 2

Refer to the exhibit. A web server is experiencing performance issues. Based on the process list shown, which action should the administrator take first?

Accepted Answer

Identify and restart the parent process to clean up the zombie.

Answer

Increase the PID limit in /proc/sys/kernel/pid_max.

Answer

Kill the parent process of the zombie (PID 1234).

Answer

Terminate the zombie process with SIGKILL.

Question 3

Refer to the exhibit. A system administrator notices that /var/log is nearly full. Which configuration change would resolve the issue and prevent recurrence?

Accepted Answer

Decrease the size threshold from 100M to 50M.

Answer

Add the 'delaycompress' option to the logrotate config.

Answer

Remove the postrotate script to avoid restarting syslog.

Answer

Increase the rotate count from 4 to 7.

Question 4

Refer to the exhibit. The system log is not updating. What is the cause?

Accepted Answer

The root filesystem is almost full, leaving no space for log growth.

Answer

The syslog file size exceeded 1GB and was rotated.

Answer

The syslog file permissions are incorrect.

Answer

rsyslogd was restarted and lost its configuration.

Question 5

A Linux administrator is tasked with adding a new 1TB hard drive to a server. The drive has been partitioned and formatted with ext4, resulting in the device /dev/sdb1. The administrator needs the drive to be mounted persistently at /data. After adding an entry to /etc/fstab, the administrator runs 'mount -a' and sees the error: 'mount: /data: mount point does not exist.' Which of the following should the administrator do first to resolve the issue?

Accepted Answer

Create the /data directory with mkdir. The error 'mount point does not exist' indicates that the directory /data has not been created on the filesystem. The mount command requires an existing directory to attach the device to. Creating the /data directory with mkdir resolves this, allowing mount -a to succeed.

Answer

Run mkfs.ext4 on /dev/sdb1

Answer

Reboot the server

Answer

Run fsck on /dev/sdb1

Question 6

A custom application service 'myapp.service' fails to start on a RHEL 8 system with the error: "Failed at step EXEC spawning /usr/local/bin/myapp: Permission denied". The service runs as user 'myapp'. The binary /usr/local/bin/myapp has permissions 755 and is owned by root:root. The user myapp is not in the sudoers. The administrator checks SELinux and finds the binary has the context 'unconfined_u:object_r:usr_t:s0'. The service unit file does not specify any SELinux context. What is the most likely cause of the failure?

Accepted Answer

The SELinux context of the binary is incorrect; it should be bin_t.. The error occurs because SELinux is enforcing and the binary has the type 'usr_t', which is not allowed to be executed by the service's domain (probably init_t or custom domain). The correct type for executables in /usr/local/bin is 'bin_t'. The solution is to restore the SELinux context to the default for binaries using `restorecon -v /usr/local/bin/myapp` or changing it to bin_t. Option A is incorrect because permissions allow execution. Option C is unlikely because /usr/local/bin is in PATH. Option D is incorrect as user has execute permission.

Answer

The user myapp does not have read access to the binary.

Answer

The binary is located in a directory that is not in the systemd safe path.

Answer

The binary is not executable by myapp due to file permissions.

Question 7

An administrator needs to schedule a backup script located at '/usr/local/bin/backup.sh' to run every Sunday at 2:30 AM. The server uses cron for task scheduling. The administrator currently has the following crontab entry: '30 2 * * 0 /usr/local/bin/backup.sh'. However, the administrator wants to verify that the cron job is configured correctly and will run as expected. Which of the following commands should the administrator use to list the current user's cron jobs and verify the entry?

Accepted Answer

crontab -l. The 'crontab -l' command lists the current user's crontab entries. Option A is correct. 'cron -l' is not a valid command. 'cat /var/spool/cron/crontabs/root' might work for root but not for a regular user, and the path varies. 'systemctl status cron' shows the cron service status, not the job list.

Answer

cat /var/spool/cron/crontabs/root

Answer

systemctl status cron

Answer

cron -l

Question 8

A system administrator is configuring centralized logging for a cluster of web servers. Each web server runs rsyslog and needs to forward its Apache access logs to a central log server at 192.168.1.100 over UDP port 514. The administrator adds the following line to /etc/rsyslog.conf on each web server: '*.* @192.168.1.100:514'. After restarting rsyslog, no logs appear on the central server. The administrator checks the network connectivity and finds that the central server is reachable and listening on UDP 514. Which additional configuration is most likely required on the web servers to forward the Apache logs?

Accepted Answer

Configure Apache to send access logs to syslog using the 'syslog' facility in the LogFormat directive.. The wildcard '*.*' forwards all logs, including Apache logs if they are sent to syslog. However, rsyslog by default only reads from its own sources; if Apache logs are written directly to a file and not via syslog, they won't be forwarded. The Apache module 'mod_log_config' can be configured to send logs to syslog using the 'syslog' facility. Option B is correct. Option A (el8 conf includes) is a file but not for Apache. Option C adds modular configs but doesn't address Apache. Option D (UDP vs TCP) might matter but the problem states UDP is used and listening.

Answer

Enable the 'imuxsock' module in rsyslog to listen on a Unix socket for Apache logs.

Answer

Create a configuration file in /etc/rsyslog.d/ with a more specific filter for Apache logs.

Answer

Change the forwarding protocol from UDP to TCP in both the sender and receiver.

Question 9

A Linux server running RHEL 9 has SELinux in enforcing mode. A web application (Apache) is serving content from a custom directory /var/www/html/myapp. The application needs to write to a subdirectory /var/www/html/myapp/uploads. The administrator sets the context of the uploads directory to httpd_sys_content_t and also runs `restorecon -Rv /var/www/html/myapp`. However, Apache still cannot write to the uploads directory. The administrator checks the SELinux denials in /var/log/audit/audit.log and sees AVC denials related to writing. Which step should the administrator take next?

Accepted Answer

Change the type of the uploads directory to httpd_sys_rw_content_t.. The httpd_sys_content_t type is for read-only content. For read-write access, the directory must have type httpd_sys_rw_content_t (or httpd_sys_script_rw_t for scripts). Setting this type via `chcon -t httpd_sys_rw_content_t /var/www/html/myapp/uploads` will allow Apache to write. Option A (boolean httpd_enable_homedirs) is unrelated. Option D (add to group) does not address SELinux.

Answer

Disable SELinux temporarily.

Answer

Set the boolean httpd_enable_homedirs to on.

Answer

Add the apache user to the group that owns uploads.

Question 10

A company uses a Linux server running Ubuntu 22.04 LTS as a file server to share documents via Samba. The server has been in operation for over a year without issues. Following a routine system update that included kernel patches and updated Samba packages, users began reporting that they could no longer access any shared folders. The administrator verifies that the smbd and nmbd services are running and have not failed. The Samba configuration has not been changed recently. The server uses ufw as its firewall. When the administrator runs 'ufw status', the output shows that only SSH (port 22) is allowed. The administrator checks for SELinux but finds it is not installed; however, AppArmor is active and the smbd profile is in enforce mode. The administrator examines the AppArmor logs and finds no denials related to smbd. Which of the following is the most likely reason for the connectivity failure?

Accepted Answer

The firewall is blocking Samba ports 137, 138, 139, and 445.. The firewall (ufw) is only allowing SSH (port 22), which means Samba ports 137/138 (NetBIOS), 139 (SMB over NetBIOS), and 445 (SMB over TCP) are blocked. Since the smbd and nmbd services are running and AppArmor shows no denials, the most likely cause is that the firewall rules were reset or not updated after the system update, preventing Samba traffic from reaching the server.

Answer

The Samba configuration file was corrupted during the update.

Answer

The kernel update changed the default file system mount options, restricting access.

Answer

The AppArmor profile is preventing smbd from binding to network interfaces.

Question 11

A system administrator is troubleshooting a server running Ubuntu 20.04 that cannot establish outbound SSH connections. The server can ping external IP addresses and resolve hostnames. The administrator tries `ssh user@remotehost` and gets 'Connection timed out'. The firewall (ufw) is active. Which step should be taken?

Accepted Answer

Allow output traffic on port 22 with ufw allow out 22/tcp.. The server can ping external IPs and resolve hostnames, so networking and DNS are working. The issue is that outbound SSH traffic on port 22 is being blocked by the active UFW firewall. The correct step is to allow outbound TCP traffic on port 22 using `ufw allow out 22/tcp`, which permits the client to initiate SSH connections to remote hosts.

Answer

Check the SSH client configuration in /etc/ssh/ssh_config.

Answer

Restart the networking service.

Answer

Disable the firewall with ufw disable.

Question 12

A system administrator is troubleshooting a network issue on a Linux server running CentOS 7. The server is unable to connect to the internet, but internal network connections work fine. The administrator checks the network configuration: the server has a static IP 192.168.1.100/24, default gateway 192.168.1.1, and DNS server 8.8.8.8. The administrator can ping the gateway but cannot ping 8.8.8.8. From the server, a traceroute to 8.8.8.8 stops at the gateway. The administrator also notices that the route table shows a default route via 192.168.1.1. What is the most likely cause?

Accepted Answer

The router is not performing NAT correctly. The server can ping the gateway (192.168.1.1) but cannot reach 8.8.8.8, and traceroute stops at the gateway. This indicates that the server’s default route is correctly configured and the gateway is reachable, but the router is not forwarding traffic beyond the local subnet. Since internal connections work, the most likely cause is that the router is not performing Network Address Translation (NAT) correctly, which is required to translate private IP addresses (192.168.x.x) to a public IP for internet access.

Answer

The DNS server is not responding

Answer

The default gateway is not reachable

Answer

The subnet mask is incorrectly configured

Question 13

A developer reports that a Docker container on a CentOS 7 host cannot connect to the internet. The host itself can access the internet. The container is started with default bridge network. The administrator checks iptables and sees the FORWARD policy is DROP. What is the most likely cause and solution?

Accepted Answer

Add iptables rules to allow forwarding and enable masquerading.. The default Docker bridge network relies on iptables NAT (masquerading) and FORWARD rules to allow containers to reach external networks. When the FORWARD policy is set to DROP, the host drops all forwarded packets from the container, blocking outbound internet access. Adding iptables rules to allow forwarding (e.g., `-A FORWARD -i docker0 -j ACCEPT`) and enabling masquerading (e.g., `-t nat -A POSTROUTING -s 172.17.0.0/16 -o eth0 -j MASQUERADE`) restores connectivity.

Answer

The container needs to be run with --network host.

Answer

The container's DNS configuration is incorrect.

Answer

AppArmor is blocking outbound connections.

Question 14

A Linux server is experiencing high I/O wait, as shown by the 'iostat -x' command: 'avg-cpu: %iowait=45' and '/dev/sda: await=120ms, %util=95%'. The server has 16 GB of RAM, and the administrator notices that the system is using a significant amount of swap: 'free -m' shows 4 GB of swap used out of 8 GB. The server runs a database application that performs many synchronous writes. The administrator wants to reduce I/O wait without adding physical memory. Which of the following kernel parameter changes is most likely to help by reducing the frequency of write operations to disk?

Accepted Answer

Increase vm.dirty_writeback_centisecs from 500 to 1000.. Increasing vm.dirty_writeback_centisecs (time between writeback flushes) allows more dirty pages to accumulate before being written, reducing write frequency and potentially merging writes, which can lower I/O wait if the I/O subsystem is efficient at handling larger writes. However, if the writeback interval is too high, it may increase burstiness. The other options: increasing dirty_ratio or dirty_background_ratio would allow more dirty pages in memory, which could temporarily reduce writes but might cause burstier writes and not reduce overall I/O wait. Decreasing dirty_writeback_centisecs would increase write frequency, likely worsening iowait. So Option C is the most plausible correct answer. Option D (swappiness) affects swap tendency, but swap usage indicates memory pressure; reducing swappiness might reduce swap but not directly address synchronous database writes.

Answer

Increase vm.dirty_ratio from 20 to 40.

Answer

Set vm.swappiness to 0.

Answer

Decrease vm.dirty_background_ratio from 10 to 5.

Question 15

A system administrator is troubleshooting a server that is experiencing periodic slowdowns. The administrator runs the 'ps aux' command and notices a process named 'cpu_burn' that is consistently using over 90% CPU. The administrator wants to identify which user is running the process and then terminate it. The server runs Red Hat Enterprise Linux 8. Which command should the administrator use to determine the owner of the 'cpu_burn' process?

Accepted Answer

ps -eo pid,user,comm | grep [c]pu_burn. The 'ps -eo pid,user,comm' command outputs the PID, user, and command name for all processes, useful for identifying the owner of a specific process. Option A can show user but 'grep cpu_burn' will match other fields. Option B is correct as it directly greps the command name. Option C uses 'top' which is interactive and not efficient for scripting. Option D shows all processes filtered by user, but that doesn't help find the user.

Answer

ps -u cpu_burn

Answer

ps -ef | grep cpu_burn

Answer

top -bn1 | grep cpu_burn

XK0-005 Practice Test 36 — 15 Questions

Exhibit

XK0-005 Practice Test 36 — 15 Questions

Exhibit