XK0-006 Practice Test 38 — 15 Questions

Question 1

An administrator needs to extend the size of a logical volume named 'lv_data' in volume group 'vg_data' by 10 GB. A new disk /dev/sdb has been added to the system. What is the correct sequence of commands?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

pvcreate /dev/sdb; vgextend vg_data /dev/sdb; lvextend -L +10G /dev/vg_data/lv_data. It follows the proper sequence for extending a logical volume when a new disk is added: first, initialize the new disk as a physical volume with pvcreate; second, add the physical volume to the volume group with vgextend; third, extend the logical volume by the desired size with lvextend. This order ensures the volume group has available physical extents before attempting to allocate them to the logical volume.

Answer

lvextend -L +10G /dev/vg_data/lv_data; vgextend vg_data /dev/sdb; pvcreate /dev/sdb

Answer

vgextend vg_data /dev/sdb; pvcreate /dev/sdb; lvextend -L +10G /dev/vg_data/lv_data

Answer

pvcreate /dev/sdb; lvextend -L +10G /dev/vg_data/lv_data; vgextend vg_data /dev/sdb

Question 2

Refer to the exhibit. A developer is pushing an image to a private registry at `192.168.1.100:5000` but receives an error about using an insecure registry. Which part of the Docker daemon configuration allows this registry without TLS?

Accepted Answer

The 'insecure-registries' setting. The error indicates the Docker client is attempting to push an image to a registry over HTTP (port 5000) without TLS. By default, Docker Engine requires TLS for all registry communications. The `insecure-registries` setting in `/etc/docker/daemon.json` allows the daemon to bypass TLS verification for specified IP addresses or CIDR ranges, enabling communication with registries that lack a valid TLS certificate.

Answer

The 'exec-opts' setting

Answer

The 'storage-driver' setting

Answer

The 'log-driver' setting

Question 3

A DevOps engineer is writing a Bash script to automate deployment of a containerized application. The script must: (1) exit immediately if any command fails, (2) build a Docker image with tag 'myapp:latest' from the current directory, (3) run a container from that image in detached mode with port mapping 8080:80, (4) set environment variable ENV=production inside the container, and (5) bind mount a host directory /data to /app/data inside the container. Which TWO of the following snippets should be included in the script to meet these requirements? (Choose TWO.)

Accepted Answer

set -e. (`set -e`) ensures the script exits immediately if any command fails, satisfying requirement 1. Option C (`docker build -t myapp:latest .`) builds the Docker image with the required tag, satisfying requirement 2. The run commands (A and E) are not selected because requirement 2 (building the image) must be completed before running the container, and the question asks for two snippets that meet the requirements; the run command would be a separate part of the script. Option D is also a valid build command but uses the long form `--tag`; either C or D would work, but C is the more common short form. Option E has a syntax error (`-eENV=production` missing space).

Answer

docker run -d -p 8080:80 -e ENV=production -v /data:/app/data myapp:latest

Answer

docker build --tag myapp:latest .

Answer

docker run -d -p 8080:80 -eENV=production -v /data:/app/data myapp:latest

Question 4

A server's root filesystem is 100% full according to df -h. Which command should the administrator use to locate large files?

Accepted Answer

du -sh /*. The `du -sh /*` command calculates disk usage for each top-level directory and file under `/`, summarizing the total in human-readable format. This directly identifies which directories or files consume the most space, allowing the administrator to pinpoint the cause of the 100% full root filesystem.

Answer

ls -la /

Answer

fdisk -l

Answer

find / -size +100M

Question 5

A Kubernetes pod has a container that fails with CrashLoopBackOff. The administrator runs 'kubectl logs pod-name' but sees no output. What is the most likely cause?

Accepted Answer

The container exited before writing to stdout, and logs need to be retrieved with 'kubectl logs --previous'.. When a container enters CrashLoopBackOff, it restarts repeatedly. If 'kubectl logs pod-name' shows no output, it means the current (restarted) container has not written anything to stdout yet. The previous instance of the container may have written logs before crashing, and those logs are accessible using 'kubectl logs --previous' to retrieve the output from the terminated container.

Answer

The container has no logging driver configured.

Answer

The log file is rotated and deleted.

Answer

The pod is not scheduled on any node.

Question 6

A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t webapp.conf && restorecon -v webapp.conf. The most appropriate command. It adds a persistent SELinux file context rule with semanage fcontext and then applies it with restorecon, ensuring the correct type (httpd_sys_content_t) is set and preserved across system relabeling. Option D (restorecon alone) may not work if the file's path lacks a default mapping in the SELinux policy, making it unreliable for non-standard locations. Therefore, only A fully addresses the requirement for a permanent and reliable fix.

Answer

setenforce 0

Answer

chcon -t httpd_sys_content_t webapp.conf

Answer

restorecon -v webapp.conf

Question 7

A Linux administrator receives reports that the system's log files are growing rapidly and consuming disk space. The administrator needs to configure the system to rotate logs weekly, keep 4 weeks of logs, compress old logs, and ensure that log rotation does not cause logs to be lost if the log file is still being written. Which configuration file and setting should be used?

Accepted Answer

/etc/logrotate.d/syslog with directives: weekly, rotate 4, compress, delaycompress. The logrotate utility is specifically designed for log rotation, and the configuration file /etc/logrotate.d/syslog is the standard location for per-service rotation rules. The directives 'weekly', 'rotate 4', 'compress', and 'delaycompress' together achieve weekly rotation, retain 4 weeks of logs, compress old logs, and prevent data loss by delaying compression until the next rotation cycle, ensuring the log file is no longer being written to.

Answer

/etc/rsyslog.conf with action(type="omfile" file="/var/log/syslog" rotate="weekly" keep="4" compress)

Answer

/etc/systemd/journald.conf with Settings=MaxRetentionSec=4weeks and Compress=yes

Answer

/etc/cron.daily/logrotate script that calls logrotate -f /etc/logrotate.conf

Question 8

Refer to the exhibit. An administrator is troubleshooting an issue where services cannot write log files. Based on the output, which filesystem is most likely the cause?

Accepted Answer

/dev/sda1 (/). The output shows that the root filesystem /dev/sda1 mounted on / is at 95% usage. Since log files are typically written under /var/log, which resides on the root partition unless /var is a separate mount point, a nearly full root filesystem prevents services from writing log files. The correct answer is D because the root filesystem is nearly full, causing the write failures.

Answer

/dev/sda3 (/home)

Answer

Swap partition

Answer

/dev/sda2 (/var)

Question 9

A system administrator needs to check the kernel ring buffer for hardware error messages. Which command should be used?

Accepted Answer

dmesg. The `dmesg` command is the standard tool for printing the kernel ring buffer, which contains messages from the kernel, including hardware error messages, device driver initialization, and system boot logs. It directly reads from `/dev/kmsg` or the syslog system call, making it the correct choice for diagnosing hardware issues at the kernel level.

Answer

journalctl -k

Answer

vmstat

Answer

lsof

Question 10

An administrator needs to check the status of NetworkManager connections and devices. Which TWO commands provide this information?

Accepted Answer

nmcli dev status. The `nmcli dev status` command (option B) displays a summary of all NetworkManager-managed devices and their connection states, such as 'connected' or 'disconnected'. The `nmcli con show` command (option C) lists all configured connections (profiles) and their current status, including whether they are active. Together, these two commands provide the administrator with both device-level and connection-level status information required by the question.

Answer

nmcli device show

Answer

ifconfig -a

Answer

ip link show

Question 11

A system administrator is investigating a slow website. The web server is responding but pages load slowly. Which THREE commands can help identify network latency or packet loss?

Accepted Answer

mtr example.com. B is correct because `mtr` (My TraceRoute) combines the functionality of `ping` and `traceroute` into a single diagnostic tool. It continuously sends ICMP packets to each hop along the path to the target, displaying per-hop latency and packet loss statistics in real time. This makes it ideal for identifying where network latency or packet loss is occurring between the server and the client, which directly addresses the symptom of a slow website.

Answer

dig example.com

Answer

ss -tlnp

Question 12

A security audit reveals that user accounts remain active after employees leave the company. Which TWO commands should be used to disable an account immediately?

Accepted Answer

usermod -e 1 username. To disable an account immediately, `usermod -e 1 username` (option B) sets the account expiration date to January 1, 1970, which immediately expires the account and prevents all login methods. `usermod -L username` (option C) locks the user's password, preventing password-based authentication. Both commands together provide immediate disablement covering all authentication paths. Option D also locks the password but is redundant with C; the question asks for two commands, so B and C are the most appropriate. Option A sets expiration to 0 days after epoch, which may not disable immediately. Option E deletes the account, which is not the same as disabling.

Answer

chage -E 0 username

Answer

passwd -l username

Answer

userdel username

Question 13

Which TWO of the following are valid methods for debugging a Bash script? (Choose TWO.)

Accepted Answer

Run the script with 'bash -x script.sh'. Running 'bash -x script.sh' enables an execution trace that prints each command and its arguments to stderr before executing it, which is a standard debugging method for Bash scripts. Option C is correct because adding 'set -x' at the start of the script achieves the same trace output, but from within the script itself, allowing granular control over which sections are traced.

Answer

Add 'set -r' to restrict shell

Answer

Run the script with 'bash -d script.sh'

Answer

Add 'set -n' to check syntax

Question 14

An administrator wants to replace all occurrences of 'oldstring' with 'newstring' in a configuration file named config.cfg, and save the changes. Which sed command should be used?

Accepted Answer

sed -i 's/oldstring/newstring/g' config.cfg. It uses -i for in-place editing and g to replace all occurrences on each line. Option A has -i but lacks g, so it replaces only the first occurrence per line. Option C adds an unnecessary i flag for case-insensitive matching, which deviates from the requirement to replace 'oldstring' exactly as given. Option D lacks -i, so changes are only printed to stdout and not saved.

Answer

sed -i 's/oldstring/newstring/' config.cfg

Answer

sed -i 's/oldstring/newstring/gi' config.cfg

Answer

sed 's/oldstring/newstring/' config.cfg

Question 15

A system administrator is troubleshooting a service that fails to start at boot. The system uses systemd. Which of the following commands would the administrator use to check the service's status and view its recent log entries?

Accepted Answer

systemctl status service && journalctl -n 50. 'systemctl status service' displays detailed status of the service, including recent logs. 'journalctl -n 50' shows the last 50 journal entries. Together, they provide both status and recent logs. Option A uses 'systemctl is-active', which only returns active/inactive, not detailed status. Option C lists failed units and error-level logs, not specific to the service. Option D also uses 'systemctl is-active' (boolean) and 'journalctl -n 50' without focusing on the service. Therefore, B is the best choice.

Answer

journalctl -u service -n 50 && systemctl is-active service

Answer

systemctl list-units --state=failed && journalctl -p err

Answer

systemctl is-active service && journalctl -n 50