XK0-006 Practice Test 39 — 15 Questions

Question 1

Refer to the exhibit. Which service is likely causing the longest boot delay?

Accepted Answer

firewalld.service. The exhibit shows that firewalld.service has the longest time in the 'active' state during boot, as indicated by the 'time' column in the systemd-analyze blame output. Firewalld initializes complex netfilter/iptables rules and applies them to all network interfaces, which can be CPU-intensive and take several seconds, especially with many rules or zones. This makes it the primary contributor to boot delay compared to the other listed services.

Answer

sshd.service

Answer

network.service

Answer

postfix.service

Question 2

A Docker container using port 8080 fails to start with the error 'port is already allocated'. Which command should the administrator use to identify the process using that port?

Accepted Answer

ss -tlnp. The `ss -tlnp` command lists TCP listening sockets (`-l`) with numeric addresses (`-n`) and shows the process identifier (PID) and process name (`-p`) that owns each socket. This directly identifies which process has bound port 8080, allowing the administrator to resolve the 'port is already allocated' error.

Answer

ss -tan

Answer

ss -tln

Answer

ss -r

Question 3

A Linux administrator needs to locate all files in the /var/log directory that have been modified within the last 2 days and contain the word 'error' (case-insensitive). Which command accomplishes this?

Accepted Answer

find /var/log -mtime -2 -exec grep -li 'error' {} \;. The correct command uses -mtime -2 to find files modified less than 2 days ago, and -exec grep -li 'error' to perform a case-insensitive search for 'error' in file contents, listing filenames. Option A uses -mtime +2 (files older than 2 days). Option B uses -name to match filenames, not content. Option C uses grep -l without -i, so it would miss case variations.

Answer

find /var/log -mtime +2 -exec grep -li 'error' {} \;

Answer

find /var/log -name '*error*' -mtime -2

Answer

find /var/log -mtime -2 -exec grep -l 'error' {} \;

Question 4

Which command displays the current SELinux mode?

Accepted Answer

sestatus. The 'sestatus' command displays the current SELinux mode, including whether it is enforcing, permissive, or disabled, along with other SELinux status information.

Answer

selinuxenabled

Answer

getsebool -a

Answer

chcon

Question 5

An administrator configures a new web server with Apache and needs to ensure it starts automatically after a system reboot. The administrator runs 'systemctl enable httpd' but the service still does not start after reboot. What is the most likely reason?

Accepted Answer

The httpd service is masked, preventing it from starting.. The most likely reason the httpd service does not start after reboot despite being enabled is that it is masked. A masked service is symlinked to /dev/null, which prevents systemd from starting it even if it is enabled. The 'systemctl enable' command creates the necessary symlinks for automatic startup, but a mask overrides this by blocking the service unit entirely.

Answer

The service name is incorrect; it should be 'apache2' instead of 'httpd'.

Answer

The administrator forgot to run 'systemctl start httpd' after enabling it.

Answer

The systemd daemon needs to be reloaded with 'systemctl daemon-reload'.

Question 6

A server shows /dev/sda1 mounted at / is 100% full in df -h, but du -sh / shows only 50% usage. What is the most likely explanation?

Accepted Answer

A process is still holding a deleted file open. When a file is deleted but still held open by a running process, the file's inode remains allocated and its disk blocks are not freed until the process closes the file descriptor. The `df` command reports filesystem usage by querying the superblock for total and free blocks, so it still counts the space occupied by the deleted-but-open file. In contrast, `du` traverses the directory tree and sums the sizes of files reachable from the specified path; since the deleted file is no longer linked in the directory, `du` does not include it, leading to the discrepancy.

Answer

The filesystem is corrupted

Answer

Hidden files are not counted by du

Answer

The disk has many hard links

Question 7

A system administrator wants to encrypt a large directory of files using GPG with a symmetric cipher. Which two steps are necessary? (Select TWO).

Accepted Answer

Use a passphrase to encrypt. Symmetric encryption in GPG requires a passphrase to derive the encryption key. When using `gpg --symmetric`, the cipher key is generated from a passphrase provided by the user, making the passphrase the essential secret for both encryption and decryption. Without a passphrase, symmetric encryption cannot proceed.

Answer

gpg --decrypt file.gpg

Answer

gpg --encrypt --recipient user file

Answer

Import a public key

Question 8

An administrator is debugging a Docker container that exits immediately after starting. Which THREE commands can help diagnose the issue? (Select THREE).

Accepted Answer

docker run --rm -it <image> sh. docker logs shows the container's output; docker exec -it can run commands inside a running container (but if it exits, you may need to start it interactively); docker inspect shows low-level config and state; docker ps shows running containers, not helpful for exited ones.

Answer

docker exec -it <container> sh

Answer

docker ps

Question 9

An administrator needs to determine why a service failed to start due to an unresponsive network filesystem. Which systemd unit dependency directive should be added to ensure the service starts only after the remote filesystem is mounted?

Accepted Answer

Requires. The Requires directive creates a strong dependency where the service unit will fail to start if the specified remote filesystem unit is not active. This ensures the service only starts after the remote filesystem is mounted, as systemd will attempt to start the required unit and fail the service if it cannot be activated.

Answer

Wants

Answer

After

Answer

BindsTo

Question 10

A user can access a web server on this Linux system via HTTPS but cannot connect via SSH. Based on the exhibit, what is the most likely cause?

Accepted Answer

The firewall is missing a rule to allow SSH traffic.. The exhibit likely shows that the INPUT chain has a default policy of DROP and contains an explicit rule to allow HTTPS (port 443) but no rule to allow SSH (port 22). With a default DROP policy, only traffic matching explicit allow rules passes. Since SSH traffic does not match any allow rule, it is dropped, preventing SSH connections while HTTPS (with an explicit rule) works. Therefore, the most likely cause is that the firewall is missing a rule to allow SSH traffic.

Answer

The SSH service is not running.

Answer

The eth0 interface is down.

Answer

The INPUT chain default policy is DROP.

Question 11

During peak hours, a web server experiences timeouts. The kernel log shows 'possible SYN flooding'. Which kernel parameter should be increased to mitigate this?

Accepted Answer

net.ipv4.tcp_max_syn_backlog. The kernel log message 'possible SYN flooding' indicates that the system's SYN backlog queue is full, causing new connection requests to be dropped. Increasing `net.ipv4.tcp_max_syn_backlog` expands the maximum number of SYN requests that can be queued before the kernel starts dropping them, directly mitigating the issue.

Answer

net.ipv4.tcp_syncookies

Answer

net.core.somaxconn

Answer

net.core.rmem_default

Question 12

A Linux server experiences a kernel panic during boot. You need to capture the panic message for analysis. Which kernel parameter should be added to the GRUB command line to ensure the panic message is displayed before the system halts?

Accepted Answer

panic=10. The `panic=<seconds>` kernel parameter instructs the kernel to wait the specified number of seconds after a kernel panic before automatically rebooting. By setting `panic=10`, the system pauses for 10 seconds, allowing the panic message to remain on the console for capture and analysis before the system halts or reboots. This is the correct parameter to ensure the panic output is visible.

Answer

nomodeset

Answer

quiet

Answer

single

Question 13

A file on an SELinux-enabled system has the security context 'unconfined_u:object_r:httpd_sys_content_t:s0'. A web server needs to read it, but it is being denied. Which command changes the context to allow access?

Accepted Answer

setsebool -P httpd_read_content on. The file already has the correct SELinux type 'httpd_sys_content_t', so the denial is likely due to a missing policy boolean. The command `setsebool -P httpd_read_content on` enables a boolean that permits the web server to read content labeled with that type. This permanently resolves the access issue without altering the file's context.

Answer

chcon -t httpd_sys_content_t /path/to/file

Answer

semanage fcontext -a -t httpd_sys_content_t /path/to/file

Answer

restorecon -v /path/to/file

Question 14

An administrator needs to create a Docker image from a Dockerfile located in the current directory and tag it as 'myapp:v1'. Which command should be used?

Accepted Answer

docker build -t myapp:v1 .. docker build with -t tag creates the image. The period indicates the build context.

Answer

docker create -t myapp:v1 .

Answer

docker commit myapp:v1 .

Answer

docker image create myapp:v1 .

Question 15

A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?

Accepted Answer

pam_faillock.so. pam_faillock is the recommended PAM module in modern Linux distributions (e.g., RHEL 7+, CentOS 7+) for locking accounts after a specified number of failed login attempts. While pam_tally2 is an older module, it is considered deprecated and not the standard answer for this exam. pam_pwquality is for password quality checking, and pam_unix handles standard authentication, not account locking. Therefore, only pam_faillock is the correct choice.

Answer

pam_tally2.so

Answer

pam_pwquality.so

Answer

pam_unix.so