XK0-005 Practice Test 37 — 15 Questions

Question 1

A company runs a web application on a Linux server (Ubuntu 22.04). The application writes log files to /var/log/app/access.log and error.log. Over time, these logs have grown to several gigabytes, causing the /var partition to reach 98% capacity. The administrator decides to implement log rotation using logrotate. They create a configuration file at /etc/logrotate.d/app with the following content:

/var/log/app/*.log {
    weekly
    rotate 7
    compress
    delaycompress
    size 100M
    missingok
}

They then run `logrotate -d /etc/logrotate.d/app` for debugging, which indicates no errors. However, after several days, the logs are not being rotated. Which step should the administrator take to resolve this?

Accepted Answer

Ensure that the logrotate cron job is enabled and that the configuration file is readable (644) and owned by root.. The most likely cause is that the logrotate cron job (typically /etc/cron.daily/logrotate) is not being executed, or the configuration file has incorrect permissions. The administrator should verify that the cron job is enabled and running daily, and that the config file is readable by the cron process (owned by root, permissions 644). Option A only forces a one-time rotation, not a permanent fix. Option B is unnecessary because logrotate runs daily by default. Option C is not the root cause; ownership of logs doesn't prevent rotation.

Answer

Change the ownership of /var/log/app to appuser:appgroup.

Answer

Run `logrotate -f /etc/logrotate.d/app` to force rotation immediately.

Answer

Add a cron job to run logrotate hourly.

Question 2

A server has a volume group 'vg_data' with a single logical volume 'lv_data' of 100GB mounted at /data. The filesystem on lv_data is XFS. The administrator needs to extend it to 150GB. A new 60GB disk /dev/sdc has been added and partitioned as LVM. The administrator runs `pvcreate /dev/sdc1`, then `vgextend vg_data /dev/sdc1`, then `lvextend -L +50G /dev/vg_data/lv_data`. The administrator runs `df -h /data` and sees that the filesystem still shows 100GB. Which command should be run next?

Accepted Answer

xfs_growfs /data. For XFS filesystems, after extending the logical volume, the filesystem must be grown using xfs_growfs with the mount point as argument. resize2fs is for ext2/3/4. Option C checks the filesystem, but it's not needed. Option D would shrink, which is incorrect.

Answer

lvreduce -L -50G /dev/vg_data/lv_data

Answer

fsck /dev/vg_data/lv_data

Answer

resize2fs /dev/vg_data/lv_data

Question 3

A server running Ubuntu 20.04 has a custom application that is started as a systemd service. The service often fails to start after a system reboot, although it can be started manually with 'systemctl start myapp' without errors. The administrator checks the service status after boot and sees 'Failed to start myapp.service: Unit is not loaded properly: Invalid argument'. Which of the following is the most likely cause of this issue?

Accepted Answer

The ExecStart line in the unit file contains an invalid parameter or malformed path.. The error 'Invalid argument' typically indicates a syntax error or invalid directive in the unit file. The most common cause is an incorrect path or syntax in the ExecStart line. Option A is correct. Option B would show a 'not found' error. Option C could be a cause but would produce a different error like 'unrecognized option'. Option D might cause a 'timeout' error.

Answer

The service binary does not exist at the specified path.

Answer

The service uses a Type=oneshot but no RemainAfterExit=yes is set.

Answer

The service file has a missing [Install] section.

Question 4

A junior administrator reports that users cannot connect to a file server running Samba. The server is reachable via ping. Logs from the Samba service show: 'smbd: error while loading shared libraries: libgnutls.so.30: cannot open shared object file: No such file or directory'. The administrator confirms the package 'libgnutls' is installed. Which of the following is the most likely cause and solution?

Accepted Answer

The library path is not set; run ldconfig.. The error 'cannot open shared object file' indicates that the dynamic linker cannot find the libgnutls.so.30 library at runtime, even though the libgnutls package is installed. Running `ldconfig` updates the linker cache, which rebuilds the mapping of shared library names to their actual file paths, resolving the missing library reference for Samba.

Answer

The system libraries are out of sync; run apt-get update.

Answer

The Samba package is corrupted; reinstall Samba.

Answer

The Samba service is not running; restart it.

Question 5

Sarah is a Linux systems administrator for a company that runs a web application inside a Podman container. The container is launched using a systemd service file on a Red Hat Enterprise Linux 8 server. The service file is located at /etc/systemd/system/webapp.service and includes an ExecStart directive that runs `podman run -d --name webapp -p 80:80 nginx`. The server was recently rebooted for kernel updates. After the reboot, the web application is not responding. Sarah logs in and runs `systemctl status webapp.service`, which shows the service is 'disabled' and 'inactive'. She wants to ensure that the container starts automatically after every future reboot. What should Sarah do?

Accepted Answer

Run `systemctl enable webapp.service` and then start the service.. Option C is correct because `systemctl enable webapp.service` creates the necessary symlinks to start the service automatically at boot, and `systemctl start webapp.service` immediately starts the container. Since the service is currently disabled and inactive, enabling it ensures the systemd unit is triggered on future reboots, which will execute the `ExecStart` command to run the Podman container.

Answer

Add the line `@reboot /usr/bin/podman start webapp` to root's crontab.

Answer

Modify the container image to include a restart policy of 'always'.

Answer

Run `podman generate systemd --new --name webapp` to create a new systemd unit.

Question 6

A company's web server running Apache on CentOS 7 has been compromised. The attacker exploited a vulnerability in the web application and gained access to the system as the 'apache' user. The administrator wants to prevent similar attacks in the future by hardening the server. Currently, the Apache process runs as the 'apache' user and can execute arbitrary code. The administrator considers enabling SELinux with targeted policy to confine the httpd daemon. However, after setting SELinux to enforcing and installing the 'httpd' SELinux package, the web server fails to serve pages over HTTPS. The administrator checks the audit log (/var/log/audit/audit.log) and sees denials related to port binding. What is the most likely cause of the issue?

Accepted Answer

The port 443 is not labeled with the http_port_t type; use semanage port -a -t http_port_t -p tcp 443. The issue is that SELinux is blocking Apache from binding to port 443 because that port is not labeled with the http_port_t type. By default, SELinux only allows httpd to bind to ports that have the http_port_t context (e.g., 80, 443, 8080). If port 443 lacks this label, the httpd process will be denied permission to bind, even though the firewall may allow it. The administrator must use `semanage port -a -t http_port_t -p tcp 443` to assign the correct SELinux port type.

Answer

The SSL certificate files have incorrect SELinux context (e.g., httpd_sys_content_t instead of cert_t)

Answer

The httpd binary must have the httpd_exec_t context

Answer

The boolean httpd_enable_homedirs must be enabled to allow HTTPS

Question 7

An administrator is auditing user accounts on a Linux system and finds that several users have accounts that are no longer needed. Instead of deleting the accounts immediately, the administrator wants to lock the accounts and expire the passwords so that the users cannot log in, but the home directories and files are preserved. The administrator then wants to generate a report of all locked accounts and their last login time. Which commands and steps should the administrator use?

Accepted Answer

Use 'usermod -L username' and 'chage -E 0 username', then run 'passwd -S -a' to list account status. Option D is correct because it uses `usermod -L` to lock the account by placing an exclamation mark in the password hash field, and `chage -E 0` to expire the account immediately, preventing all login methods. The `passwd -S -a` command then lists the status of all accounts, showing locked accounts with their last password change date, which can be cross-referenced with `lastlog` for last login times. This combination fully meets the requirement to lock accounts, expire passwords, preserve home directories, and generate a report of locked accounts with last login information.

Answer

Use 'usermod -L username' to lock the account, then run 'lastlog | awk -F: '{if ($1!="Username") system("passwd -S "$1)}'

Answer

Use 'userdel -r username' to remove the account and home directory, then run 'lastlog'

Answer

Use 'passwd -e username' to expire the password, then run 'lastlog | grep -v "Never logged in"'

Question 8

A Linux administrator needs to implement file integrity monitoring to detect unauthorized changes to critical system binaries. The administrator decides to use the 'aide' tool. After installing AIDE and initializing the database with 'aide --init', the database is placed at /var/lib/aide/aide.db.new.gz. The administrator then runs 'aide --check' and receives several warnings about files in /tmp being modified. However, the administrator is not concerned about /tmp. What is the simplest way to exclude the /tmp directory from future checks?

Accepted Answer

Edit /etc/aide.conf to add a '!/tmp' directive to exclude /tmp from checking, then run 'aide --init' to rebuild the database. Option D is correct because AIDE uses a configuration file (/etc/aide.conf) to define which directories and files to monitor. Adding '!/tmp' to this file tells AIDE to exclude the /tmp directory from all future checks. After editing the configuration, running 'aide --init' rebuilds the database based on the new rules, ensuring /tmp is no longer tracked.

Answer

Run 'aide --update' to update the database with current state of /tmp

Answer

Move the database to a different location so /tmp is not included

Answer

Run 'aide --check --verbose' to see more details and manually ignore /tmp messages

Question 9

A SysAdmin is investigating a server that has become unresponsive. The server was working fine, but after a recent update, it hangs during boot, showing 'A start job is running for /dev/mapper/rootvg-rootlv (xxs / no limit)'. This indicates a filesystem check is taking long. What is the most efficient way to skip the fsck and boot quickly?

Accepted Answer

Use the kernel parameter 'fsck.mode=skip'.. Option C is correct because the kernel parameter 'fsck.mode=skip' instructs systemd to skip all filesystem checks during boot, allowing the server to bypass the stuck fsck job and start quickly. This is the most efficient method for a one-time skip without permanently altering configuration files.

Answer

At boot, press Ctrl+D to continue.

Answer

Boot into single-user mode and run fsck.

Answer

Edit /etc/fstab to set the sixth field to 0 for the root filesystem.

Question 10

A file server running RHEL 8 uses NFS to export directories. Clients report that they cannot mount an NFS share. The server's firewall is configured but NFS-related services are enabled. The administrator checks `exportfs -v` and sees the export is listed. Which service must be added to the firewall to allow NFS?

Accepted Answer

nfs. Option B is correct because NFS on RHEL 8 requires the 'nfs' service to be added to the firewall to allow incoming NFS traffic. The 'nfs' service in firewalld opens TCP and UDP ports 2049, which is the standard port for NFSv4. Even though NFS-related services are enabled, the firewall must explicitly permit this port for clients to mount the share.

Answer

rpc-bind

Answer

samba

Answer

mountd

Question 11

A system administrator is using Ansible to deploy a web application across multiple servers. The playbook uses a variable `app_version` defined in a group_vars file for the `webservers` group. The playbook fails with the error: 'ERROR! 'app_version' is undefined'. The administrator confirms that the variable is correctly spelled and defined in `/etc/ansible/group_vars/webservers`. The playbook runs successfully on the Ansible control node but fails on all managed nodes. What is the most likely cause of this error?

Accepted Answer

The group_vars file is not being loaded because the inventory path is not correctly specified.. The error 'app_version' is undefined despite the variable being correctly defined in `/etc/ansible/group_vars/webservers` indicates that Ansible is not loading that group_vars file. This typically happens when the inventory path specified in the ansible.cfg or command line does not point to the directory containing the group_vars folder. Ansible automatically loads group_vars only from the directory where the inventory file resides, not from a hardcoded path like `/etc/ansible/group_vars/` unless the inventory is also located there.

Answer

The variable `app_version` is misspelled in the task.

Answer

The playbook uses `loop` keyword incorrectly.

Answer

The playbook is missing a `vars_files` directive to include the variable file.

Question 12

You are a Linux administrator at a company that runs a web application in Docker containers on a single host. The application consists of a front-end container (nginx) and a back-end container (node.js). Recently, after a system update, the front-end container fails to start with the error: 'Error response from daemon: driver failed programming external connectivity on endpoint frontend: (iptables failed: iptables --wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.17.0.2 --dport 80 -j ACCEPT: iptables: No chain/target/match by that name)'. Which action should you take to resolve the issue?

Accepted Answer

Restart the Docker daemon with systemctl restart docker. The error indicates that the Docker daemon's iptables rules are corrupted or missing, often caused by a system update that restarted or modified the iptables service. Restarting the Docker daemon with `systemctl restart docker` forces Docker to reinitialize its iptables chains (e.g., DOCKER, DOCKER-USER) and reapply the necessary rules, resolving the connectivity failure.

Answer

Reinstall iptables

Answer

Change the network driver to macvlan

Answer

Update the kernel to the latest version

Question 13

Your organization uses Ansible for configuration management across 500 servers. The management server is a Linux workstation. You have written a playbook to deploy a new monitoring agent. The playbook works on all test machines but fails on production machines at the 'Gather Facts' stage with the error: 'fatal: [server1]: FAILED! => {"msg": "Timed out waiting for privilege escalation prompt: become method 'sudo' requires a password" }'. All production servers have the same sudoers configuration. You have confirmed that the user 'ansible' has passwordless sudo configured correctly. What is the most likely cause?

Accepted Answer

The ansible_become_password is not set in the inventory. The error indicates that Ansible's privilege escalation (sudo) is prompting for a password, even though the 'ansible' user has passwordless sudo configured. This typically occurs when the 'ansible_become_password' variable is not set or is empty in the inventory, causing Ansible to wait for a password prompt that never comes. Since the playbook works on test machines, the difference is likely that the inventory for production lacks the required 'ansible_become_password' or 'ansible_become' settings, or the variable is not being passed correctly.

Answer

The production servers have a different SSH key

Answer

The SSH timeout is too low

Answer

The become_user is set incorrectly

Question 14

A company runs a critical web application on a single server using Docker containers. The application consists of a web frontend container and a backend API container. Recently, the server ran out of disk space due to Docker logs and temporary images. The sysadmin is tasked with automating cleanup to prevent recurrence. The solution must not disrupt running containers. Which approach should be taken?

Accepted Answer

Configure log rotation for containers using `--log-opt max-size=10m` and `--log-opt max-file=3` in the Docker run command, and schedule `docker image prune -f` weekly.. Option D is correct because it addresses both root causes: log growth and dangling images. Configuring `--log-opt max-size=10m` and `--log-opt max-file=3` limits container log file size and count without stopping containers, while `docker image prune -f` removes unused images safely. This combination prevents disk exhaustion without disrupting running containers, meeting all requirements.

Answer

Increase disk space by adding a new volume.

Answer

Create a script that stops all containers, removes unused images, and restarts containers.

Answer

Schedule a cron job to run `docker system prune -a -f` daily.

Question 15

An administrator needs to run a backup script every day at 2:00 AM. The script is located at /usr/local/bin/backup.sh and is executable. The administrator considers several methods to schedule this task. Which method should the administrator use to ensure the script runs at exactly 2:00 AM every day without additional configuration overhead?

Accepted Answer

Add the following line to the crontab for root: `0 2 * * * /usr/local/bin/backup.sh`. The correct method is to add a cron job via crontab because cron is the standard Unix/Linux utility for scheduling tasks at specific times. The syntax `0 2 * * *` precisely defines execution at 2:00 AM daily (minute 0, hour 2, every day, every month, every day of week), and the script path is fully qualified. This approach requires no additional configuration overhead beyond a single crontab entry.

Answer

Append the script path to /etc/rc.local file.

Answer

Place the script in /etc/cron.daily/ directory.

Answer

Create a systemd timer unit that triggers the script daily at 2:00 AM.