XK0-006 Practice Test 36 — 15 Questions

Question 1

A Linux administrator needs to ensure that only the root user can run commands in the /usr/local/bin/scripts directory. Which command should be used to set the appropriate permissions?

Accepted Answer

chmod 700 /usr/local/bin/scripts. The requirement is that only the root user can run commands in the directory. Permission 700 (owner: rwx, group: ---, others: ---) grants full access exclusively to the owner (root), while denying all access to the group and others. This matches the requirement precisely.

Answer

chmod 750 /usr/local/bin/scripts

Answer

chmod 755 /usr/local/bin/scripts

Answer

chmod 770 /usr/local/bin/scripts

Question 2

A system administrator is creating an Ansible playbook to deploy a web server on a group of hosts. The playbook needs to install the nginx package, start the service, and ensure it is enabled on boot. Which playbook structure is correct?

Accepted Answer

---
- hosts: webservers
  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present
    - name: Start and enable nginx
      service:
        name: nginx
        state: started
        enabled: yes. It uses the 'service' module, which abstracts away the underlying init system and works on both SysV init and systemd systems, making it the recommended cross-platform choice. Option B is incorrect because the 'systemd' module is specific to systemd-managed services; while it works on many modern Linux distributions, it may not be available on older systems, and the 'service' module is preferred for portability. Options C and D are incorrect: C uses raw 'command' and 'command' to run shell commands, bypassing Ansible's idempotency and module benefits; D uses 'yum' instead of 'apt', which is inconsistent with the Debian/Ubuntu context implied by the 'apt' module in the correct option.

Answer

---
- hosts: webservers
  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present
    - name: Start and enable nginx
      systemd:
        name: nginx
        state: started
        enabled: yes

Answer

---
- hosts: webservers
  tasks:
    - name: Install nginx
      command: apt install -y nginx
    - name: Start nginx
      command: systemctl start nginx

Answer

---
- hosts: webservers
  tasks:
    - name: Install nginx
      yum:
        name: nginx
        state: present
    - name: Start and enable nginx
      service:
        name: nginx
        state: started
        enabled: yes

Question 3

After building and running the container as shown in the exhibit, the administrator tries to access http://localhost:8080 but receives a connection refused error. What is the most likely cause?

Accepted Answer

The container exited immediately after starting.. The most likely cause is that the container exited immediately after starting. When a container runs a command that finishes quickly (e.g., a shell script that exits), the container stops, and no process listens on port 8080. This results in a 'connection refused' error because the container is no longer running to accept connections.

Answer

The port mapping is incorrect.

Answer

The base image is not compatible.

Answer

The CMD syntax is incorrect.

Question 4

An administrator is investigating a security breach. The attacker gained root access via an application vulnerability. The administrator needs to determine which commands were executed by the attacker after gaining access. Which log file should be examined first?

Accepted Answer

/root/.bash_history. /root/.bash_history, because this file logs the command-line history for the root user. After gaining root access via an application vulnerability, the attacker would execute commands as root, and those commands are recorded in the root user's bash history file. Examining this file provides a direct timeline of the commands executed post-compromise, which is the most efficient starting point for determining the attacker's actions.

Answer

/var/log/syslog

Answer

/var/log/secure

Answer

/var/log/audit/audit.log

Answer

/var/log/auth.log

Question 5

A Linux administrator needs to remove a package installed via RPM and all its configuration files. Which command should the administrator use?

Accepted Answer

rpm -e package. The `rpm -e` command removes the specified package and its configuration files by default. Option A (`rpm -e package`) is the standard way to uninstall an RPM package including config files. Option B (`rpm -V`) verifies the package but does not remove it. Option C (`rpm -e --allmatches`) removes all versions of the package, which is unnecessary for a single installation. Option D (`rpm -e --nodeps`) ignores dependencies but still removes config files; however, it is not the best answer because dependencies are not mentioned and the straightforward `rpm -e` is correct. Therefore, the correct command is `rpm -e package`.

Answer

rpm -V package

Answer

rpm -e --allmatches package

Answer

rpm -e --nodeps package

Question 6

A system administrator needs to find all files in the /etc directory that are larger than 1 MB and are regular files. Which find command accomplishes this?

Accepted Answer

find /etc -type f -size +1M. Only option A correctly accomplishes the task. Option A uses -type f to select regular files and -size +1M to find files larger than 1 MB. Option B fails because the size suffix 'MB' is invalid; it should be 'M'. Option C omits the '+' prefix, so it matches files exactly 1 MB, not larger. Option D is incorrect; it uses -type d, which selects directories, not regular files. Option E also uses -type d, and the order of predicates does not affect the output, but the type is wrong.

Answer

find /etc -size +1MB -type f

Answer

find /etc -type f -size 1M

Answer

find /etc -type d -size +1M

Answer

find /etc -size +1M -type f

Question 7

A security audit reveals that a service is running with an incorrect SELinux context. Which two commands can be used to relabel the file or directory to the correct context? (Choose TWO.)

Accepted Answer

restorecon -R /path/to/file. restorecon restores default context based on policy, and chcon can set a specific context manually.

Answer

setenforce 0

Answer

fixfiles relabel

Answer

ls -Z

Question 8

A systems administrator needs to automate the execution of a backup script every day at 2:00 AM using a systemd service. Which unit type should the administrator create?

Accepted Answer

A .timer unit. A .timer unit is the correct choice because systemd timers are designed to schedule and trigger the execution of other units (such as services) at specific times or intervals. By creating a .timer unit that activates at 2:00 AM daily and a corresponding .service unit for the backup script, the administrator can automate the backup using systemd's built-in scheduling mechanism, which is more reliable and integrated than cron for systemd-managed systems.

Answer

A .service unit

Answer

A .path unit

Answer

A .mount unit

Question 9

Which THREE commands can be used to display the mount points and file system usage? (Choose three.)

Accepted Answer

df -h. (df -h) is correct because the 'df' command (disk free) with the '-h' (human-readable) flag displays file system disk space usage in a format that includes mount points, total size, used space, available space, and usage percentage. This directly shows both mount points and file system usage, making it a standard tool for this purpose.

Answer

du

Answer

df -i

Question 10

Which TWO of the following are characteristics of containers compared to virtual machines? (Choose two.)

Accepted Answer

Containers require less overhead than VMs.. Containers share the host OS kernel and do not require a full guest OS per instance, resulting in significantly lower resource overhead (CPU, memory, and storage) compared to virtual machines. Option E is correct because containers are lightweight processes that can start in seconds, whereas VMs require booting an entire operating system, which typically takes minutes.

Answer

Containers run their own kernel.

Answer

Each container has its own operating system.

Answer

Containers use hypervisor for isolation.

Question 11

An administrator needs to create a shell script that will be executed by a non-login shell. The script requires access to environment variables set in the user's profile. Which file should the script source to ensure these variables are available?

Accepted Answer

~/.bashrc. ~/.bashrc is the file sourced by non-login interactive shells in Bash. When a script is executed by a non-login shell, it does not read ~/.bash_profile or ~/.profile; instead, it reads ~/.bashrc. By sourcing ~/.bashrc within the script, the administrator ensures that environment variables defined there (e.g., PATH, custom aliases) are available to the script.

Answer

/etc/profile

Answer

~/.profile

Answer

~/.bash_profile

Question 12

A security policy requires that system logs be rotated weekly and kept for 4 weeks. Which configuration file should be modified to achieve this for /var/log/syslog?

Accepted Answer

/etc/logrotate.conf. Log rotation is managed by logrotate, not by rsyslog or syslog itself. The /etc/logrotate.conf file contains global rotation settings, including frequency (weekly) and retention count (rotate 4). Adding or modifying a configuration block for /var/log/syslog in logrotate.conf (or a file in /etc/logrotate.d/) directly implements the policy requirement.

Answer

/etc/security/limits.conf

Answer

/etc/rsyslog.conf

Answer

/etc/audit/auditd.conf

Question 13

Which command will show the environment variables for a specific process?

Accepted Answer

cat /proc/$PID/environ. The `/proc/[PID]/environ` file contains the environment variables that were set when the process was started. Reading this file with `cat` displays the exact environment of a specific process, which is not possible with shell built-ins or user-level commands that only show the current shell's environment.

Answer

set

Answer

printenv

Answer

env

Question 14

A Linux administrator writes a Python script to parse configuration files. Which TWO practices improve security and portability? (Select TWO.)

Accepted Answer

Validate all external input before processing. Validating all external input before processing prevents injection attacks and data corruption. In Python, this means checking file paths, user inputs, and configuration values against expected patterns (e.g., using regex or allowlists) before using them in file operations or system calls. This is a core security principle for any script that handles untrusted data.

Answer

Use absolute paths for all file operations

Answer

Use sudo within the script to run privileged commands

Answer

Use raw_input() instead of input() in Python 2

Question 15

A security policy requires that containers run with minimal privileges. Which THREE measures should be implemented? (Select THREE.)

Accepted Answer

Use --security-opt seccomp=default. The `--security-opt seccomp=default` flag applies the default seccomp (secure computing mode) profile, which restricts the system calls available to the container. This enforces the principle of least privilege by blocking dangerous syscalls (e.g., `mount`, `reboot`) while allowing necessary ones, reducing the attack surface without manual profile creation.

Answer

Mount host filesystem read-write

Answer

Expose all ports to host