XK0-006 Practice Test 42 — 15 Questions

Question 1

A user is trying to log in to a Linux server via SSH but receives 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic)'. The user's public key is in ~/.ssh/authorized_keys with proper permissions (600) and owned by the user. The server's sshd_config has 'PubkeyAuthentication yes' and 'PasswordAuthentication no'. What is the most likely additional cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user's home directory has incorrect permissions (e.g., group-writable).. SSH server's `StrictModes` (enabled by default) checks that the user's home directory is not group-writable or world-writable. If the home directory has group-write permission (e.g., 775), SSH refuses to trust `~/.ssh/authorized_keys` even if the file itself has 600 permissions. This is a security measure to prevent other group members from modifying the authorized_keys file indirectly.

Answer

The server's firewall is blocking port 22.

Answer

SELinux is blocking the key authentication.

Answer

The SSH server is not running.

Question 2

A developer reports that a Docker container on a CentOS 7 host cannot connect to the internet. The host itself can access the internet. The container is started with default bridge network. The administrator checks iptables and sees the FORWARD policy is DROP. What is the most likely cause and solution?

Accepted Answer

Add iptables rules to allow forwarding and enable masquerading.. The default Docker bridge network relies on iptables NAT (masquerading) and FORWARD rules to allow containers to reach external networks. When the FORWARD policy is set to DROP, the host drops all forwarded packets from the container, blocking outbound internet access. Adding iptables rules to allow forwarding (e.g., `-A FORWARD -i docker0 -j ACCEPT`) and enabling masquerading (e.g., `-t nat -A POSTROUTING -s 172.17.0.0/16 -o eth0 -j MASQUERADE`) restores connectivity.

Answer

The container needs to be run with --network host.

Answer

The container's DNS configuration is incorrect.

Answer

AppArmor is blocking outbound connections.

Question 3

A system administrator is troubleshooting a service that fails to start. They want to see the recent logs for that specific service unit. Which journalctl command should be used?

Accepted Answer

journalctl -u service_name. The `-u` option in `journalctl` filters logs by the systemd unit name, allowing you to view recent logs specifically for a service. This is the correct approach when troubleshooting a service that fails to start, as it isolates the relevant log entries without noise from other system messages.

Answer

journalctl -k

Answer

tail -f /var/log/syslog

Answer

journalctl -p err

Question 4

Which two of the following are valid methods to pass environment variables to a Docker container at runtime? (Select TWO.)

Accepted Answer

Defining variables in a .env file and using --env-file. Option A is correct because `docker run --env-file <file>` reads a file of KEY=VALUE lines (commonly named .env) and injects those variables into the container's environment at runtime. Option B is correct because `docker run -e KEY=VALUE` (or `--env`) sets an environment variable directly on the container when it starts. Option C is not a runtime method: the Dockerfile `ENV` instruction bakes variables into the image at build time, so they exist by default but are not passed at runtime. Option D is invalid because `export` executed inside a running container only affects that shell session, not the container's startup environment. Option E is incorrect because the Dockerfile `ARG` instruction defines build-time variables, which are not automatically available as runtime environment variables.

Answer

Using the ENV instruction in the Dockerfile

Answer

Using the export command inside the container

Answer

Using the ARG instruction in the Dockerfile

Question 5

Which command displays the current routing table on a Linux system?

Accepted Answer

ip route. ip route shows the routing table. The older route command is deprecated.

Answer

ip neigh

Answer

ip addr

Answer

ip link

Question 6

A Linux administrator needs to view all current IPv4 addresses assigned to network interfaces on a system. Which command should be used?

Accepted Answer

ip addr. The 'ip addr' command displays all IP addresses assigned to network interfaces. 'ifconfig' is deprecated, 'ip link' shows link-layer info, and 'hostname -I' only shows primary IPs.

Answer

ip link show

Answer

ifconfig -a

Answer

hostname -I

Question 7

A Linux administrator needs to find large log files that may be consuming disk space. Which command should be used to locate files larger than 100MB in the /var/log directory?

Accepted Answer

find /var/log -type f -size +100M. The `find` command with `-type f` (regular files) and `-size +100M` (files larger than 100 megabytes) is the correct tool to locate large log files in /var/log. This directly meets the requirement to find files by size, unlike other commands that only show disk usage or directory listings without size filtering.

Answer

df -h

Answer

ls -lR /var/log

Answer

du -sh /var/log/*

Question 8

A file has permissions -rwxr-x---. The administrator wants to give the group write permission using symbolic mode. Which command is correct?

Accepted Answer

chmod g+w file. The symbolic mode `g+w` adds write permission to the group owner of the file. The current permissions are `-rwxr-x---`, meaning the group has read and execute (`r-x`) but not write. The `g` stands for group, and `+w` adds write, resulting in `-rwxrwx---`.

Answer

chmod 775 file

Answer

chmod o+w file

Answer

chmod u+w file

Question 9

A system administrator notices that a server's disk space is critically low. Which command should be used to identify the largest files or directories consuming space?

Accepted Answer

du -sh /*. `du -sh /*` recursively calculates disk usage for each top-level directory and file under root, summarizing sizes in human-readable format. This directly identifies the largest space consumers, which is the stated goal. The `-s` flag provides a total per argument, and `/*` targets all immediate children of `/`.

Answer

ls -la /

Answer

fdisk -l

Answer

df -h

Question 10

An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?

Accepted Answer

ops webserver=(root) /usr/bin/systemctl restart httpd. The sudoers entry format is: user host=(runas) command. To allow user 'ops' to run only the specified command on host 'webserver' as root, the correct entry is 'ops webserver=(root) /usr/bin/systemctl restart httpd'. This restricts both the host and the command, and specifies the runas user as root.

Answer

ops ALL=(root) /usr/bin/systemctl restart httpd

Answer

ops webserver=(ALL) /usr/bin/systemctl restart httpd

Answer

ops webserver=(root) ALL

Question 11

A Linux administrator needs to ensure that only the root user can run commands in the /usr/local/bin/scripts directory. Which command should be used to set the appropriate permissions?

Accepted Answer

chmod 700 /usr/local/bin/scripts. The requirement is that only the root user can run commands in the directory. Permission 700 (owner: rwx, group: ---, others: ---) grants full access exclusively to the owner (root), while denying all access to the group and others. This matches the requirement precisely.

Answer

chmod 750 /usr/local/bin/scripts

Answer

chmod 755 /usr/local/bin/scripts

Answer

chmod 770 /usr/local/bin/scripts

Question 12

A system administrator notices that the /var partition is full, causing log services to malfunction. Which command should be used to quickly reclaim space by removing compressed old log files?

Accepted Answer

find /var/log -type f -name '*.gz' -delete. It uses `find` to locate all files ending in `.gz` under `/var/log` and deletes them with `-delete`. Compressed old log files are typically archived with gzip, so removing them directly reclaims disk space without affecting active logs or requiring additional tools.

Answer

journalctl --vacuum-size=100M

Answer

rm -rf /var/log/*.gz

Answer

logrotate -f

Question 13

A system administrator is investigating a performance issue and wants to view kernel-related messages. Which three commands can be used to access kernel ring buffer messages? (Choose three.)

Accepted Answer

dmesg. Option B (dmesg) is correct because dmesg directly reads and prints the kernel ring buffer, which is exactly the kernel-related message store the administrator needs. Option C (cat /var/log/kern.log) is correct because on many Linux distributions the kernel ring buffer messages are persisted to /var/log/kern.log, so reading that file exposes kernel messages. Option D (journalctl -k) is correct because the -k (or --dmesg) flag restricts systemd journal output to kernel messages only, providing access to kernel ring buffer content. Option A (tail -f /var/log/syslog) is not correct here because syslog is a general system log that may include kernel messages only indirectly and is not the kernel ring buffer itself. Option E (systemctl status) is not correct because it reports the status of systemd units and does not display kernel ring buffer messages.

Answer

tail -f /var/log/syslog

Answer

systemctl status

Question 14

An administrator wants to generate a self-signed certificate and private key for testing. Which command creates both in one step?

Accepted Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. The `openssl req -x509 -newkey rsa:2048` command generates a new private key (via `-newkey`) and immediately creates a self-signed X.509 certificate (via `-x509`) in a single step. The `-keyout` and `-out` flags specify the output files for the private key and certificate, respectively, and `-nodes` ensures the private key is not encrypted with a passphrase, which is typical for testing scenarios.

Answer

openssl genrsa -out key.pem 2048

Answer

openssl req -new -x509 -days 365 -key key.pem -out cert.pem

Answer

openssl x509 -req -in req.pem -signkey key.pem -out cert.pem

Question 15

A user has a file with permissions set to 644. Which of the following commands will add the setuid permission to the file? (Choose two.)

Accepted Answer

chmod u+s file. Option A, chmod u+s file, is correct because the u+s symbolic mode adds the setuid bit to the user (owner) permission triad, which is exactly the setuid permission requested. Option D, chmod 4644 file, is correct because in the four-digit octal notation the leading digit represents special permissions, and the value 4 in that position is the setuid bit, so 4644 sets setuid while preserving the existing 644 rw-r--r-- permissions. Option B, chmod g+s file, is wrong because g+s sets the setgid bit on the group triad, not setuid. Option C, chmod 1644 file, is wrong because the leading 1 sets the sticky bit, not setuid. Option E, chmod 2644 file, is wrong because the leading 2 sets the setgid bit, not setuid.

Answer

chmod g+s file

Answer

chmod 1644 file

Answer

chmod 2644 file