XK0-006 Practice Test 37 — 15 Questions

Question 1

A system administrator wants to ensure that a service starts automatically at boot time using systemd. Which command should be used?

Accepted Answer

systemctl enable service. systemctl enable service creates the necessary symlinks so the service's unit is pulled into the appropriate systemd target at boot, ensuring it starts automatically. This is the standard systemd command for enabling a service at boot time. It does not start the service immediately, but it guarantees it will start on the next boot.

Answer

systemctl start service

Answer

systemctl daemon-reload

Answer

systemctl reenable service

Question 2

Which of the following is a key difference between Docker and Podman?

Accepted Answer

Podman can run containers without root privileges.. Podman is a daemonless container engine that supports rootless mode, allowing unprivileged users to run containers without requiring a long-running root daemon. This is a fundamental architectural difference from Docker, which traditionally relies on a root-owned `dockerd` daemon. Rootless containers improve security by reducing the attack surface and limiting privilege escalation.

Answer

Docker does not support container images.

Answer

Podman requires a daemon to run containers.

Answer

Docker can only run on Linux.

Question 3

An administrator needs to view the last 20 lines of the systemd journal for the 'sshd' service. Which command should be used?

Accepted Answer

journalctl -u sshd -n 20. The command `journalctl -u sshd -n 20` directly queries the systemd journal for entries related to the sshd unit (`-u sshd`) and displays the last 20 lines (`-n 20`). This is the correct and efficient way to view recent journal entries for a specific service. It leverages journalctl's native filtering and tailing capabilities without piping or additional processing.

Answer

systemctl status sshd | tail -20

Answer

journalctl -u sshd --since '1 hour ago'

Answer

journalctl -u sshd -f

Question 4

An administrator modified kernel parameters in /etc/sysctl.conf. Which command applies the changes without rebooting?

Accepted Answer

sysctl -p. The `sysctl -p` command reads the settings from `/etc/sysctl.conf` and applies them immediately to the running kernel without requiring a reboot. This is the standard method for reloading persistent kernel parameter changes on Linux systems.

Answer

sysctl -w

Answer

sysctl -r

Answer

sysctl -a

Question 5

A user is able to ping the Linux server but cannot connect via SSH. The SSH service is running and listening. Which configuration file should the administrator review FIRST?

Accepted Answer

/etc/ssh/sshd_config. The SSH service is running and listening, but the user cannot connect. This points to a configuration issue within the SSH daemon itself. The `/etc/ssh/sshd_config` file controls SSH server settings such as allowed authentication methods, port numbers, and user access restrictions (e.g., `AllowUsers`, `DenyUsers`, `PermitRootLogin`). Reviewing this file first is the logical step to identify why connections are being rejected despite the service being active.

Answer

/etc/pam.d/login

Answer

/etc/nsswitch.conf

Answer

/etc/hosts.allow

Question 6

An administrator wants to grant a specific user, 'jdoe', read and write access to a file that is owned by root:root with permissions 640. The administrator does not want to change the file's owner or group. Which approach should be used?

Accepted Answer

Use setfacl -m u:jdoe:rw file. POSIX ACLs allow granting permissions to specific users or groups without altering the file's owner or group. The command 'setfacl -m u:jdoe:rw file' adds an ACL entry giving jdoe read and write access while leaving root:root ownership and the 640 mode intact. This is the standard, least-disruptive approach for per-user access on a shared file.

Answer

Change file owner to jdoe

Answer

Use chmod o+rw file

Answer

Add jdoe to the root group

Question 7

A Linux administrator needs to change the permissions of a file to allow the owner to read and write, the group to read only, and others to have no access. Which chmod command should be used?

Accepted Answer

chmod 640 file. The symbolic representation rw-r----- corresponds to octal 640. rw- = 4+2+0=6, r-- = 4+0+0=4, --- = 0+0+0=0.

Answer

chmod 600 file

Answer

chmod 755 file

Answer

chmod 644 file

Question 8

A technician notices that a user can execute a binary with elevated privileges even though the user is not in the sudoers file. The binary has the SUID bit set. Which command would remove the SUID bit from the binary?

Accepted Answer

chmod u-s /path/to/binary. `chmod u-s /path/to/binary` is the direct command to remove the SUID bit from the file. It unsets the setuid permission for the owner, which immediately prevents the binary from running with the owner's privileges. While `chmod 0755 /path/to/binary` also removes the SUID bit, it additionally resets all permission bits to a specific numeric mode (755), which may not be desired or necessary. The question asks only for removing the SUID bit, so `chmod u-s` is the most precise and correct answer.

Answer

chmod g-s /path/to/binary

Answer

chmod o-s /path/to/binary

Answer

chmod 0755 /path/to/binary

Question 9

SELinux is currently in enforcing mode. A service is being blocked by SELinux. Which command can analyze the audit log and suggest the minimum policy changes to allow the service?

Accepted Answer

audit2allow. audit2allow reads SELinux denial messages from the audit log (or standard input) and generates a human-readable policy module that allows the previously denied operations. It is specifically designed to translate raw AVC denials into the minimal set of allow rules needed, which can then be compiled and loaded with semodule. This directly matches the requirement to analyze the audit log and suggest minimum policy changes.

Answer

ausearch

Answer

setsebool

Answer

restorecon

Question 10

An administrator wants to change the priority of a running process with PID 1234 to a lower priority (nicer). The current nice value is 0. Which command will set the nice value to 10?

Accepted Answer

renice 10 -p 1234. The `renice` command is used to alter the scheduling priority of an already running process. By default, a process starts with a nice value of 0. Running `renice 10 -p 1234` sets the nice value to 10, which is a lower priority (more 'nice') because the kernel adds this value to the dynamic priority calculation, giving the process less CPU time.

Answer

nice -n 10 kill 1234

Answer

chrt -p 10 1234

Answer

kill -10 1234

Question 11

Which command displays the amount of free and used disk space on all mounted file systems in a human-readable format?

Accepted Answer

df -h. The df command reports file system disk space usage, and the -h flag renders sizes in human-readable units (K, M, G). Running df -h shows all mounted file systems with total, used, available space, and mount point. This is the standard Linux utility for checking free and used disk space.

Answer

du -h /

Answer

lsblk -h

Answer

mount -h

Question 12

An administrator wants to enforce an account lockout policy after five failed login attempts on a Linux system. Which PAM module should be added to the authentication stack?

Accepted Answer

pam_faillock.so. pam_faillock is used for account lockout after failed attempts. pam_unix handles authentication, pam_pwquality checks password strength, pam_tally2 is an older module.

Answer

pam_unix.so

Answer

pam_pwquality.so

Answer

pam_tally2.so

Question 13

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The pipeline should build a Docker image, run unit tests, and if successful, push the image to a private registry. Which tool is best suited for orchestrating this pipeline?

Accepted Answer

Jenkins. Jenkins is a widely adopted CI/CD automation server that excels at orchestrating complex pipelines, including building Docker images, running unit tests, and pushing images to a private registry. Its pipeline-as-code feature (Jenkinsfile) allows defining stages, triggers, and post-build actions, making it the best fit for this microservices CI/CD workflow.

Answer

Git

Answer

cron

Answer

Ansible

Question 14

The company password policy requires minimum length, complexity, and that passwords cannot be based on dictionary words. Which file should be edited to configure these settings via pam_pwquality?

Accepted Answer

/etc/security/pwquality.conf. The pam_pwquality module enforces password quality rules such as minimum length, complexity, and dictionary checks. Its configuration file is /etc/security/pwquality.conf, where parameters like minlen, dcredit, ucredit, lcredit, ocredit, and dictcheck are set. Editing this file directly controls the PAM module's behavior without modifying PAM service files.

Answer

/etc/login.defs

Answer

/etc/pam.d/system-auth

Answer

/etc/pam.d/password-auth

Question 15

In a Bash script, what is the correct way to check if a file named '/etc/passwd' exists and is a regular file?

Accepted Answer

if [ -f /etc/passwd ]. The `-f` test operator in Bash returns true only if the path exists AND is a regular file (not a directory, device, or symlink to a non-regular file). This exactly matches the requirement to check that /etc/passwd exists and is a regular file.

Answer

if [ -r /etc/passwd ]

Answer

if [ -e /etc/passwd ]

Answer

if [ -s /etc/passwd ]