XK0-006 Practice Test 39 — 15 Questions

Question 1

An administrator wants to capture network traffic on interface eth0, writing the output to a file for later analysis, without resolving hostnames. Which command accomplishes this?

Accepted Answer

tcpdump -i eth0 -w capture.pcap -n. tcpdump -i eth0 -w capture.pcap -n captures packets on interface eth0, writes them to capture.pcap for later analysis, and the -n flag prevents hostname resolution (shows IP addresses instead). This matches all three requirements: interface selection, file output, and no name resolution.

Answer

tcpdump -i eth0 -r capture.pcap

Answer

tcpdump -i any -w capture.pcap

Answer

tcpdump -n -w eth0 capture.pcap

Question 2

A server fails to boot with a kernel panic after a system update. The administrator suspects a corrupt initramfs. Which GRUB boot parameter should be added temporarily to boot into an emergency shell where the filesystem can be repaired?

Accepted Answer

rd.break. rd.break is a kernel boot parameter that interrupts the boot process before the initramfs switches control to the real root filesystem, dropping the administrator into a debug shell (switch_root prompt). From there, the root filesystem can be mounted read-write and repaired, or the initramfs regenerated. This is the standard RHEL/CentOS method for recovering from a corrupt initramfs or forgotten root password.

Answer

emergency

Answer

single

Answer

nomodeset

Question 3

What does the output in the exhibit indicate about the /etc/shadow file?

Accepted Answer

The file has an SELinux context.. The output in the exhibit shows the SELinux context for the /etc/shadow file, which is indicated by the string 'system_u:object_r:shadow_t:s0' appended to the file's permissions. This is the SELinux security context, consisting of user, role, type, and sensitivity level. The `ls -Z` command displays this context, confirming that the file has an SELinux label applied.

Answer

The file is encrypted.

Answer

The file has an ACL applied.

Answer

The file is compressed.

Question 4

A system administrator needs to ensure that only specific users can execute the 'sudo' command. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file controls which users and groups can execute commands with elevated privileges via the sudo utility. It uses a specific syntax to define user privileges, such as 'username ALL=(ALL) ALL', and must be edited with the visudo command to prevent syntax errors that could lock out administrative access. Modifying this file is the standard method for granting or restricting sudo access on Linux systems.

Answer

/etc/shadow

Answer

/etc/passwd

Answer

/etc/group

Question 5

An administrator wants to monitor real-time system resource usage to identify performance bottlenecks. Which two commands are suitable? (Choose two.)

Accepted Answer

top. It provides a real-time, continuously refreshing view of CPU, memory, load average, and per-process resource consumption, making it ideal for spotting live performance bottlenecks. Option D (htop) is also correct since it is an interactive process viewer that displays the same real-time system metrics as top but with a more user-friendly interface, color-coded resource bars, and scrolling, which helps identify bottlenecks as they occur. Option B (vmstat) is not the best fit here because it typically reports virtual memory, CPU, and I/O statistics at sampled intervals rather than offering an interactive real-time monitoring view. Option C (iostat) is excluded because it focuses on I/O device and CPU statistics, usually in periodic reports, not a live interactive resource monitor. Option E (sar) is also not appropriate because it is designed to collect and report historical system activity data, often for later analysis rather than real-time bottleneck identification.

Answer

vmstat

Answer

iostat

Answer

sar

Question 6

A system administrator is hardening SSH and needs to disable root login and password authentication. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and PasswordAuthentication no. Disabling root login and password authentication are two separate directives in sshd_config. PermitRootLogin no prevents direct SSH access for the root user, and PasswordAuthentication no disables password-based logins, forcing the use of key-based authentication. Both directives are required to meet the hardening goal.

Answer

PermitRootLogin no and ChallengeResponseAuthentication no

Answer

DenyUsers root and PasswordAuthentication no

Answer

PermitRootLogin prohibit-password and PasswordAuthentication yes

Question 7

An administrator needs to find all files in /var/log that have been modified within the last 2 days. Which find command should be used?

Accepted Answer

find /var/log -mtime -2. The `-mtime -2` option in `find` matches files whose data was last modified less than 2 days ago (i.e., within the last 48 hours). The minus sign means 'less than', so `-mtime -2` correctly finds files modified in the last 2 days. This is the standard way to search by modification time in Linux.

Answer

find /var/log -mtime +2

Answer

find /var/log -atime -2

Answer

find /var/log -ctime 2

Question 8

A Linux administrator needs to configure sudo access for members of the 'wheel' group to run any command. Which two steps are required? (Choose TWO.)

Accepted Answer

Uncomment the line '%wheel ALL=(ALL) ALL' in /etc/sudoers using visudo. Option A is correct because the '%wheel ALL=(ALL) ALL' entry in /etc/sudoers is the standard sudoers rule that grants every member of the wheel group permission to run any command as any user on any host, and it must be uncommented (edited with visudo to preserve syntax safety and file locking). Option D is correct because users only receive that sudo privilege if they are actually members of the wheel group, so adding them with 'usermod -aG wheel username' (the -a avoids removing existing supplementary groups) is a required step. Option B is wrong because /usr/bin/sudo is already installed with the setuid root bit by the package; manually setting it is unnecessary and not part of granting wheel sudo rights. Option C is wrong because 'visudo -c' only validates sudoers syntax — it is a verification step, not a required configuration step. Option E is wrong because /etc/ssh/sshd_config controls SSH login behavior, not sudo authorization, and has nothing to do with granting wheel members command execution rights.

Answer

Set the setuid bit on /usr/bin/sudo

Answer

Run 'sudo visudo -c' to check syntax

Answer

Edit /etc/ssh/sshd_config to allow wheel group

Question 9

A user cannot access a website, but other websites work. The administrator wants to see the HTTP response headers from the web server. Which command is most appropriate?

Accepted Answer

curl -I https://example.com. The curl -I command sends a HEAD request to the server and displays only the HTTP response headers. This is the most appropriate way to quickly inspect headers like status codes, content-type, and server information without downloading the body. It directly addresses the administrator's need to see response headers.

Answer

wget --spider https://example.com

Answer

curl -v https://example.com

Answer

telnet example.com 80

Question 10

A system administrator is troubleshooting a network issue on a Linux server running CentOS 7. The server is unable to connect to the internet, but internal network connections work fine. The administrator checks the network configuration: the server has a static IP 192.168.1.100/24, default gateway 192.168.1.1, and DNS server 8.8.8.8. The administrator can ping the gateway but cannot ping 8.8.8.8. From the server, a traceroute to 8.8.8.8 stops at the gateway. The administrator also notices that the route table shows a default route via 192.168.1.1. What is the most likely cause?

Accepted Answer

The router is not performing NAT correctly. The server can ping the gateway (192.168.1.1) but cannot reach 8.8.8.8, and traceroute stops at the gateway. This indicates that the server’s default route is correctly configured and the gateway is reachable, but the router is not forwarding traffic beyond the local subnet. Since internal connections work, the most likely cause is that the router is not performing Network Address Translation (NAT) correctly, which is required to translate private IP addresses (192.168.x.x) to a public IP for internet access.

Answer

The DNS server is not responding

Answer

The default gateway is not reachable

Answer

The subnet mask is incorrectly configured

Question 11

After a security audit, it is recommended to disable SSH password authentication in favor of key-based authentication. Which configuration line should be set in /etc/ssh/sshd_config?

Accepted Answer

PasswordAuthentication no. Disabling password authentication forces SSH to use key-based authentication, which is more secure against brute-force attacks. Setting `PasswordAuthentication no` in `/etc/ssh/sshd_config` prevents SSH from prompting for a password, requiring a valid SSH key pair for authentication. This aligns with the security audit's recommendation to disable password authentication in favor of key-based authentication.

Answer

PasswordAuthentication yes

Answer

PubkeyAuthentication no

Answer

ChallengeResponseAuthentication yes

Question 12

A Linux administrator is writing a bash script that must exit immediately if any command fails. Which of the following should be included at the beginning of the script?

Accepted Answer

set -e. `set -e` (errexit) causes the shell to exit immediately when any command returns a non-zero exit status, which is exactly the requirement for a script that must stop on the first failure. It is the standard idiom placed at the top of defensive bash scripts.

Answer

set -o pipefail

Answer

set -u

Answer

set -x

Question 13

A service named 'myapp' is currently running but should be disabled so it does not start automatically at boot. Which command accomplishes this?

Accepted Answer

systemctl disable myapp. The correct command is `systemctl disable myapp` because it removes the symlinks that cause the service to start automatically at boot, while leaving the currently running service unaffected. This directly meets the requirement of disabling automatic startup without stopping the running process.

Answer

systemctl kill myapp

Answer

systemctl mask myapp

Answer

systemctl stop myapp

Question 14

An Ansible playbook includes a handler that restarts a service when a configuration file is changed. Which directive in a task triggers the handler?

Accepted Answer

notify:. In Ansible, a task uses the notify: directive to name one or more handlers that should be triggered when that task reports a change (i.e., when the task's state is 'changed'). Handlers then run once at the end of the play, in the order they were notified, only if at least one notifying task changed.

Answer

register:

Answer

when:

Answer

handlers:

Question 15

A system administrator is troubleshooting a network issue where a server cannot reach external websites. The server can ping the default gateway and internal hosts. Which TWO commands should the administrator use to further diagnose the problem? (Choose TWO.)

Accepted Answer

nslookup google.com. Option A (nslookup google.com) is correct because the server can already reach the gateway and internal hosts, so the next likely failure point is DNS resolution; nslookup queries the configured DNS server to verify that external names like google.com resolve to IP addresses. Option E (traceroute 8.8.8.8) is correct because it traces the hop-by-hop path to an external IP, revealing where packets are dropped (e.g., at the gateway, ISP, or beyond) and distinguishing a routing problem from a DNS problem. Option B (route -n) merely displays the local routing table, which is less useful since the server already pings the gateway and internal hosts, indicating basic routing works. Option C (ping 127.0.0.1) only tests the local loopback/TCP-IP stack, which is already proven functional by the successful pings to the gateway and internal hosts. Option D (ifconfig eth0) only shows interface configuration (IP, mask, MAC), which is also already validated by the successful internal connectivity.

Answer

route -n

Answer

ping 127.0.0.1

Answer

ifconfig eth0