XK0-006 Practice Test 40 — 15 Questions

Question 1

An administrator needs to apply a set of permissions to an existing directory and all its contents, setting the owner to 'rwx', group to 'rx', and others to '---'. Additionally, newly created files within the directory should inherit the group. Which commands should the administrator run? (Assume the directory is /data, and the group is 'staff'.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

chmod -R 750 /data; chmod g+s /data. chmod -R 750 /data sets permissions recursively. chmod g+s /data sets the SGID bit so new files inherit the group. The other options are missing SGID or have wrong permissions.

Answer

chmod 750 /data; chmod g+s /data

Answer

chmod -R 755 /data; chmod g+s /data

Answer

chmod -R 750 /data

Question 2

A security policy requires that user passwords must expire every 90 days. Which command can enforce this policy for user 'jsmith'?

Accepted Answer

chage -M 90 jsmith. The `chage -M 90 jsmith` command sets the maximum number of days a password is valid for user 'jsmith' to 90, which enforces the 90-day expiration policy. The `-M` option directly modifies the `PASS_MAX_DAYS` field in `/etc/shadow`, and `chage` is the standard tool for managing password aging on Linux systems.

Answer

usermod -e 90 jsmith

Answer

passwd -x 90 jsmith

Answer

chfn -f 90 jsmith

Question 3

A storage administrator needs to automate the expansion of an LVM volume group when free space drops below 10%. The script must add a new physical volume from a spare disk. Which of the following commands should be used in the script to add the new disk to the volume group?

Accepted Answer

pvcreate /dev/sdb1 && vgextend vg01 /dev/sdb1. It first uses `pvcreate` to initialize the spare disk partition `/dev/sdb1` as a physical volume, which is a prerequisite for adding it to an LVM volume group. Then `vgextend vg01 /dev/sdb1` adds that initialized physical volume to the existing volume group `vg01`, expanding its total capacity. This two-step process ensures the disk is properly prepared for LVM management before being incorporated into the volume group.

Answer

vgcreate vg01 /dev/sdb

Answer

vgextend vg01 /dev/sdb1

Answer

lvresize -L +100G vg01

Question 4

A user is unable to resolve hostnames on a Linux system. Which three configuration files should be checked? (Select THREE).

Accepted Answer

/etc/hosts. The /etc/hosts file is a static table mapping hostnames to IP addresses, used for local name resolution before or instead of DNS queries. If a user cannot resolve hostnames, this file may be misconfigured or missing entries for the target hostnames, causing resolution failures.

Answer

/etc/hostname

Answer

/etc/sysconfig/network

Question 5

A security administrator is reviewing file permissions on a Linux system. They want to ensure that the /etc/shadow file is only readable by the root user. Which two commands can be used to set the correct permissions?

Accepted Answer

chown root:root /etc/shadow. The chown root:root /etc/shadow command changes both the owner and group of the /etc/shadow file to root. This ensures that only the root user has ownership, which is a prerequisite for setting restrictive permissions. However, the question asks for commands to set the correct permissions, and while ownership change is important, the primary requirement is that the file is only readable by root, which is achieved by setting permissions to 600 (owner read/write, no access for group or others). Thus, chmod 600 /etc/shadow (Option C) is also correct, making A and C the two commands that together ensure the file is only readable by root.

Answer

chmod 444 /etc/shadow

Answer

chmod 640 /etc/shadow

Answer

chown root:shadow /etc/shadow

Question 6

A system is running SELinux in enforcing mode. A custom application needs to write to /var/log/app.log. The log file shows the correct context, but access is denied. What is the most likely cause?

Accepted Answer

The SELinux boolean for the application is disabled.. SELinux policy may not allow the application's domain to write to that file; audit2allow can generate a policy. But the question implies a boolean or context issue. However, typical cause is missing policy rule. But among options, 'The application is running in an unconfined domain' is plausible but not best. Actually, the most common cause is that the file context is wrong. But given the file has correct context, the issue is likely a boolean or policy. However, the best answer is 'A transition to the wrong domain'? I'll go with 'The SELinux boolean for the application is disabled'.

Answer

The file context is incorrect.

Answer

The application is running in an unconfined domain.

Answer

SELinux is in permissive mode.

Question 7

A Linux administrator needs to ensure that user passwords expire after 90 days. Which command should be used to enforce this policy?

Accepted Answer

chage -M 90 username. The `chage -M 90 username` command sets the maximum number of days a password is valid before it must be changed, enforcing a 90-day expiration policy. This directly modifies the `PASS_MAX_DAYS` field in `/etc/shadow` for the specified user, which the system checks during authentication.

Answer

passwd -x 90 username

Answer

passwd -e 90 username

Answer

usermod -e 90 username

Question 8

An administrator needs to configure iptables to allow incoming SSH traffic only from the 10.0.0.0/8 network and drop all other incoming traffic except established connections. Which TWO rules are necessary?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT. It explicitly allows incoming SSH traffic (TCP port 22) from the 10.0.0.0/8 network, which matches the requirement to permit SSH only from that subnet. Option E is correct because it accepts all packets that are part of an established or related connection, ensuring that return traffic for outbound connections is not dropped by the default policy or subsequent rules.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP

Answer

iptables -P INPUT DROP

Answer

iptables -A INPUT -j DROP

Question 9

An administrator is troubleshooting a web server that is not accessible from the internet. The server is running on port 80. Based on the iptables output, which of the following is the MOST likely reason?

Accepted Answer

The HTTP rule only allows traffic from the internal network.. The iptables output shows an HTTP rule that explicitly matches traffic from the internal network (e.g., 192.168.1.0/24) and does not include a rule allowing HTTP traffic from external (internet) sources. Since the web server is running on port 80 but the only HTTP rule restricts source IPs to the internal subnet, traffic from the internet is not matched by any ACCEPT rule and will be subject to the default policy. This is the most likely reason the server is inaccessible from the internet.

Answer

The SSH rule is blocking HTTP traffic.

Answer

The loopback interface is not accepting traffic.

Answer

The default INPUT policy is DROP.

Question 10

An administrator runs auditctl -l and ausearch -k auth_log -ts today as shown in the exhibit. The administrator expects to see audit events for /var/log/auth.log but gets no matches. Which TWO actions should the administrator take to resolve this issue?

Accepted Answer

Verify that auditd is running with 'systemctl status auditd'. The audit daemon (auditd) must be running to process audit rules and generate events. If auditd is not active, rules loaded via auditctl will have no effect, and commands like ausearch will return no results. The administrator should verify the service status with 'systemctl status auditd' and start it if necessary.

Answer

Change '-p wa' to '-p rwxa' in the rule for /var/log/auth.log

Answer

Add '-a always,exit -S all -F path=/var/log/auth.log' to capture all syscalls

Answer

Run 'auditctl -R /etc/audit/rules.d/audit.rules' to reload rules

Question 11

A user cannot access a directory '/data/projects' even though they are in the 'projects' group. The directory permissions are 'drwxr-x---' and the group owner is 'projects'. Which command should the administrator run to grant the group write permission?

Accepted Answer

chmod g+w /data/projects. The directory '/data/projects' has permissions 'drwxr-x---', meaning the group owner 'projects' currently has read and execute (r-x) but not write (w) access. Since the user is a member of the 'projects' group, the administrator needs to add write permission for the group using 'chmod g+w /data/projects'. This directly modifies the group permission bits to grant write access without affecting other permissions.

Answer

chmod o+w /data/projects

Answer

chmod u+w /data/projects

Answer

chown :projects /data/projects

Question 12

A Linux engineer needs to restrict resource usage for users in the 'developers' group. Which TWO files or commands can be used to set ulimit values?

Accepted Answer

/etc/security/limits.conf. /etc/security/limits.conf is the standard configuration file used by the pam_limits.so PAM module to set per-user or per-group resource limits (ulimits) such as max number of open files, max processes, etc. This file allows system administrators to define hard and soft limits persistently across logins for users or groups, including the 'developers' group.

Answer

sysctl command

Answer

/etc/pam.d/login with pam_limits.so

Answer

/etc/ulimit.conf

Question 13

In an Ansible playbook, which THREE of the following are valid modules for managing files and packages? (Select THREE).

Accepted Answer

copy. (copy) is correct because the copy module is a dedicated Ansible module for copying files from the local control node to remote hosts, supporting attributes like owner, permissions, and content. It is the standard idempotent way to manage file distribution in playbooks.

Answer

get_url

Answer

command

Question 14

An administrator wants to view the current SELinux mode on a system. Which command displays whether SELinux is enforcing, permissive, or disabled?

Accepted Answer

getenforce. The `getenforce` command directly displays the current SELinux mode as either 'Enforcing', 'Permissive', or 'Disabled'. It reads the enforcing status from the kernel's SELinux state and outputs the mode in a simple, single-word format, making it the correct choice for this task.

Answer

seinfo

Answer

sestatus

Answer

getsebool -a

Question 15

A Linux administrator is troubleshooting a server that has become unresponsive. The administrator connects via IPMI and runs 'top' but the process list does not show any obvious CPU or memory hog. Which TWO commands could be used to identify I/O wait issues or disk bottlenecks? (Choose TWO.)

Accepted Answer

iostat -x 1. `iostat -x 1` provides extended disk I/O statistics, including `%util` (percentage of time the device was busy servicing requests) and `await` (average time for I/O operations). These metrics directly indicate disk bottlenecks and I/O wait issues. `iotop -o` displays only processes that are currently performing I/O operations, allowing the administrator to identify which specific processes are causing disk contention.

Answer

vmstat 1

Answer

sar -b 1

Answer

dstat --disk-util