XK0-006 Practice Test 41 — 15 Questions

Question 1

An administrator is tasked with creating a systemd service that runs a Python script after the network is available. The script must restart automatically if it fails. Which systemd service unit directive should be used to ensure restart on failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restart=on-failure. The `Restart=on-failure` directive instructs systemd to restart the service unit only when the process exits with a non-zero exit code, is terminated by a signal (including SIGKILL), or times out. This is the correct choice because the requirement is to restart the script only if it fails, not unconditionally. Using `Restart=always` would restart the service even after a clean exit, which is unnecessary and could mask intentional stops.

Answer

Restart=always

Answer

RemainAfterExit=yes

Answer

RestartSec=5

Question 2

A company uses a Linux server running Ubuntu 22.04 LTS as a file server to share documents via Samba. The server has been in operation for over a year without issues. Following a routine system update that included kernel patches and updated Samba packages, users began reporting that they could no longer access any shared folders. The administrator verifies that the smbd and nmbd services are running and have not failed. The Samba configuration has not been changed recently. The server uses ufw as its firewall. When the administrator runs 'ufw status', the output shows that only SSH (port 22) is allowed. The administrator checks for SELinux but finds it is not installed; however, AppArmor is active and the smbd profile is in enforce mode. The administrator examines the AppArmor logs and finds no denials related to smbd. Which of the following is the most likely reason for the connectivity failure?

Accepted Answer

The firewall is blocking Samba ports 137, 138, 139, and 445.. The firewall (ufw) is only allowing SSH (port 22), which means Samba ports 137/138 (NetBIOS), 139 (SMB over NetBIOS), and 445 (SMB over TCP) are blocked. Since the smbd and nmbd services are running and AppArmor shows no denials, the most likely cause is that the firewall rules were reset or not updated after the system update, preventing Samba traffic from reaching the server.

Answer

The Samba configuration file was corrupted during the update.

Answer

The kernel update changed the default file system mount options, restricting access.

Answer

The AppArmor profile is preventing smbd from binding to network interfaces.

Question 3

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups sshusers. The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH login to users who are members of the specified group. By setting `AllowGroups sshusers`, only users belonging to the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This matches the administrator's requirement precisely.

Answer

AllowUsers sshusers

Answer

DenyUsers sshusers

Answer

PermitRootLogin no

Question 4

A container started with the above Compose configuration fails to set the system time (clock_settime syscall). Which additional capability is required?

Accepted Answer

SYS_TIME. The `clock_settime` syscall requires the `SYS_TIME` capability to modify the system clock. In Docker Compose, capabilities are added via the `cap_add` directive, and without `SYS_TIME`, the container lacks the privilege to change the system time, resulting in a failure.

Answer

SYS_NICE

Answer

SYS_RESOURCE

Answer

SYS_CLOCK

Question 5

After a power failure, a Linux server boots into emergency mode. The system logs indicate an unclean filesystem on /dev/sda2. Which command should the administrator run to repair the filesystem?

Accepted Answer

fsck -f /dev/sda2. After a power failure, the system logs indicate an unclean filesystem on /dev/sda2, meaning the filesystem was not properly unmounted and may contain inconsistencies. The `fsck -f /dev/sda2` command forces a filesystem check even if the filesystem appears clean, which is necessary to repair corruption on ext2/ext3/ext4 filesystems. This is the standard tool for checking and repairing such filesystems after an unclean shutdown.

Answer

badblocks /dev/sda2

Answer

xfs_repair /dev/sda2

Answer

mount -o remount,ro /

Question 6

A server is secured with SELinux in enforcing mode. A custom web application needs to write logs to /var/log/webapp. The SELinux type for httpd is httpd_t. Which command sets the correct context for the log directory?

Accepted Answer

semanage fcontext -a -t httpd_log_t "/var/log/webapp(/.*)?" && restorecon -Rv /var/log/webapp. It uses `semanage fcontext` to add a persistent file context rule that assigns the `httpd_log_t` type to the `/var/log/webapp` directory and its contents, then applies it with `restorecon`. The `httpd_log_t` type is specifically designed for log files written by the httpd process, allowing Apache (running as `httpd_t`) to write logs while maintaining SELinux enforcement.

Answer

chcon -t httpd_sys_content_t /var/log/webapp

Answer

setsebool -P httpd_enable_homedirs on

Answer

chcon -t httpd_t /var/log/webapp

Question 7

An administrator notices that a custom application uses port 8443/TCP. To allow external access, which firewalld command permanently opens this port in the default zone?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent. The correct command is firewall-cmd --permanent --add-port=8443/tcp. The --permanent flag makes it persistent, --add-port opens the port, and the syntax includes protocol. --add-service is for predefined services, not port numbers.

Answer

firewall-cmd --add-service=8443/tcp --zone=public --permanent

Answer

firewall-cmd --add-port=8443 --permanent

Answer

firewall-cmd --permanent --add-port=8443

Question 8

A user named 'jdoe' needs to run commands as root without being given the root password. The administrator wants to grant jdoe the ability to run any command as root, but only after entering their own password. Which entry in /etc/sudoers accomplishes this?

Accepted Answer

jdoe ALL=(ALL) ALL. The format is 'user host=(runas) commands'. The correct entry grants jdoe full root access with password authentication.

Answer

jdoe ALL=(ALL) NOPASSWD: ALL

Answer

jdoe ALL=(root) /usr/bin/su

Answer

jdoe ALL= /bin/su -

Question 9

A system administrator needs to configure sudo so that members of the 'wheel' group can execute any command without a password. Which line should be added to /etc/sudoers (using visudo)?

Accepted Answer

%wheel ALL=(ALL) NOPASSWD: ALL. To allow wheel group to run all commands without a password, the line should be '%wheel ALL=(ALL) NOPASSWD: ALL'.

Answer

%wheel ALL=(ALL) ALL

Answer

wheel ALL=(ALL) NOPASSWD: ALL

Answer

%wheel ALL=NOPASSWD: ALL

Question 10

A system is experiencing boot failures. The administrator wants to view kernel messages from the current boot to diagnose the issue. Which two commands can be used to see these messages? (Choose two.)

Accepted Answer

journalctl -k. Option A, journalctl -k, is correct because the -k (--dmesg) filter restricts systemd-journald output to kernel messages only, and by default journalctl shows the current boot's entries, so it displays kernel messages from the present boot. Option D, dmesg, is correct because it reads the kernel ring buffer, which contains the kernel messages generated during the current boot, making it ideal for diagnosing boot failures. Option B, cat /proc/kmsg, is not a good choice because /proc/kmsg is a blocking, consume-once interface intended for a single reader such as klogd or dmesg; reading it directly can steal messages and it does not cleanly present the current boot log. Option C, tail -f /var/log/boot.log, is incorrect because boot.log contains service startup output from the init/boot process, not kernel messages, and it may not exist on systemd systems. Option E, vmstat -f, is incorrect because it reports the number of forks since boot, which is unrelated to viewing kernel messages.

Answer

cat /proc/kmsg

Answer

tail -f /var/log/boot.log

Answer

vmstat -f

Question 11

After a kernel upgrade, the system fails to boot. Which file should be edited to configure GRUB2 to boot into the previous kernel version by default?

Accepted Answer

/etc/default/grub. /etc/default/grub, because this file contains the GRUB2 configuration variables (such as GRUB_DEFAULT) that control which kernel is booted by default. After editing this file, you must run 'grub2-mkconfig -o /boot/grub2/grub.cfg' to regenerate the boot configuration, which sets the previous kernel as the default entry.

Answer

/etc/grub.d/40_custom

Answer

/boot/grub/grub.conf

Answer

/boot/grub2/grub.cfg

Question 12

A system administrator is configuring centralized logging for a cluster of web servers. Each web server runs rsyslog and needs to forward its Apache access logs to a central log server at 192.168.1.100 over UDP port 514. The administrator adds the following line to /etc/rsyslog.conf on each web server: '*.* @192.168.1.100:514'. After restarting rsyslog, no logs appear on the central server. The administrator checks the network connectivity and finds that the central server is reachable and listening on UDP 514. Which additional configuration is most likely required on the web servers to forward the Apache logs?

Accepted Answer

Configure Apache to send access logs to syslog using the 'syslog' facility in the LogFormat directive.. Apache writes access logs to files by default, not to syslog, so rsyslog's '*.*' rule never sees the Apache log lines. The administrator must reconfigure Apache's LogFormat to use the syslog facility (or pipe logs to logger), which causes Apache to emit access log entries into the local syslog socket that rsyslog then forwards to the central server.

Answer

Enable the 'imuxsock' module in rsyslog to listen on a Unix socket for Apache logs.

Answer

Create a configuration file in /etc/rsyslog.d/ with a more specific filter for Apache logs.

Answer

Change the forwarding protocol from UDP to TCP in both the sender and receiver.

Question 13

Which command is used to display the contents of a compressed log file without decompressing it?

Accepted Answer

zcat. zcat (equivalent to gzip -dc) reads a gzip-compressed file and writes the decompressed content to standard output without modifying the original file. It is the standard tool for viewing .gz log files in place, and it can be piped to less or grep for further processing.

Answer

head

Answer

cat

Answer

less

Question 14

An administrator needs to apply a set of permissions to an existing directory and all its contents, setting the owner to 'rwx', group to 'rx', and others to '---'. Additionally, newly created files within the directory should inherit the group. Which commands should the administrator run? (Assume the directory is /data, and the group is 'staff'.)

Accepted Answer

chmod -R 750 /data; chmod g+s /data. The command 'chmod -R 750 /data' recursively sets permissions for the directory and all its contents to owner rwx, group rx, and others none. The command 'chmod g+s /data' sets the setgid bit on the directory, ensuring that newly created files and subdirectories inherit the group ownership of the directory (staff). Together, these commands meet the requirements.

Answer

chmod 750 /data; chmod g+s /data

Answer

chmod -R 755 /data; chmod g+s /data

Answer

chmod -R 750 /data

Question 15

A containerized application writes logs to /var/log/app.log. The administrator wants to ensure logs persist even if the container is removed. Which approach should be used?

Accepted Answer

Use a Docker volume mounted at /var/log. Docker volumes are managed by Docker and persist independently of the container lifecycle. By mounting a volume at /var/log, the application writes logs directly to the volume, ensuring the data survives container removal and can be reused by other containers.

Answer

Copy logs to a bind mount

Answer

Set the log driver to syslog

Answer

Redirect logs to stdout and use docker logs