XK0-006 Practice Test 43 — 15 Questions

Question 1

A security policy requires that user passwords must be changed every 60 days, and users should be warned 7 days before expiration. Which two chage commands set these requirements for user 'jsmith'? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

chage -M 60 jsmith. Option A, `chage -M 60 jsmith`, is correct because the `-M` flag sets the maximum number of days a password remains valid before it must be changed, which directly enforces the 60-day password expiration requirement. Option C, `chage -W 7 jsmith`, is correct because the `-W` flag sets the number of days of advance warning before the password expires, satisfying the requirement to warn users 7 days ahead. Option B (`-E 60`) sets an account expiration date, not a password change interval, so it does not meet the policy. Option D (`-m 60`) sets the minimum days between password changes, which would prevent users from changing passwords for 60 days rather than requiring a change every 60 days. Option E (`-I 7`) sets the number of inactive days after password expiration before the account is locked, which is unrelated to the warning requirement.

Answer

chage -E 60 jsmith

Answer

chage -m 60 jsmith

Answer

chage -I 7 jsmith

Question 2

A Linux engineer needs to restrict resource usage for users in the 'developers' group. Which TWO files or commands can be used to set ulimit values?

Accepted Answer

/etc/security/limits.conf. Option B, /etc/security/limits.conf, is correct because this is the PAM configuration file where persistent per-user or per-group resource limits (such as nproc, nofile, or memlock) are defined using entries like '@developers hard nproc 20'. Option E, the ulimit command, is correct because it is the shell builtin used to view or set soft and hard resource limits for the current shell session, for example 'ulimit -u 20' to cap processes. Option C is not correct on its own because /etc/pam.d/login with pam_limits.so is the PAM module that enforces the limits defined in limits.conf, but it is not where the ulimit values themselves are set. Option A, sysctl, is incorrect because it tunes kernel parameters at runtime (e.g., net.ipv4.ip_forward) rather than per-user resource limits. Option D, /etc/ulimit.conf, is incorrect because no such standard file exists for setting ulimit values.

Answer

sysctl command

Answer

/etc/pam.d/login with pam_limits.so

Answer

/etc/ulimit.conf

Question 3

A DevOps engineer is creating a Dockerfile for a Node.js application. Which THREE of the following instructions are valid and commonly used in a Dockerfile? (Choose THREE.)

Accepted Answer

COPY . /app. Option B, COPY . /app, is correct because COPY is a valid Dockerfile instruction that copies files from the build context into the image filesystem, here placing the application source into /app. Option C, RUN npm install, is correct because RUN executes commands during the image build, and npm install is the standard way to install Node.js dependencies inside the image. Option E, FROM node:14, is correct because FROM is the required first instruction in a Dockerfile that sets the base image, and node:14 is a valid Node.js base image tag. Option A, EXECUTE node app.js, is not a Dockerfile instruction; the correct instruction for starting the container process is CMD or ENTRYPOINT. Option D, INSTALL package.json, is also not a Dockerfile instruction; dependency installation is done with RUN, and package.json is typically copied with COPY.

Answer

EXECUTE node app.js

Answer

INSTALL package.json

Question 4

In a Bash script, which THREE of the following are valid ways to define a function? (Select THREE.)

Accepted Answer

Answer

myfunc = () { commands; }

Answer

def myfunc { commands; }

Question 5

A Linux administrator needs to locate all files in the /etc directory that have been modified in the last 24 hours and are not owned by root. Which two commands can be combined to achieve this? (Select TWO.)

Accepted Answer

find /etc -mtime 0 -not -user root. Option A is correct because 'find /etc -mtime 0 -not -user root' searches /etc for files whose modification time falls within the last 24 hours (-mtime 0 means modified less than 1 day ago) and excludes files owned by root via -not -user root. Option C is correct because 'find /etc -mmin -1440 -not -user root' uses -mmin -1440, which matches files modified less than 1440 minutes (24 hours) ago, and likewise filters out root-owned files with -not -user root. Option B is wrong because -ctime checks inode change time, not modification time, and -not -group root filters by group ownership rather than user ownership. Option D is wrong because -uid 0 selects files owned by root, the opposite of what is required. Option E is wrong because -atime checks access time, not modification time, so it does not identify recently modified files.

Answer

find /etc -ctime 0 -not -group root

Answer

find /etc -mtime 0 -uid 0

Answer

find /etc -atime 0 -not -user root

Question 6

An administrator wants to harden SSH access by implementing the following: disallow root login, disable password authentication, and limit the number of authentication attempts. Which three configuration directives should be set in /etc/ssh/sshd_config? (Choose THREE.)

Accepted Answer

PermitRootLogin no. Option A, PermitRootLogin no, is correct because it directly disallows direct root logins over SSH, forcing administrators to authenticate as a regular user and then escalate privileges, which is the stated hardening goal. Option D, PasswordAuthentication no, is correct because it disables password-based authentication, requiring key-based (or other non-password) authentication methods instead. Option E, MaxAuthTries 3, is correct because it limits the number of authentication attempts allowed per connection, throttling brute-force guessing as requested. Option B, Port 22, is not correct because it merely sets the default SSH listening port and does not harden authentication. Option C, PermitEmptyPasswords no, is not correct here because it only prevents logins with blank passwords, which is unrelated to the three specific requirements of disallowing root login, disabling password authentication, and limiting authentication attempts.

Answer

Port 22

Answer

PermitEmptyPasswords no

Question 7

An administrator is troubleshooting a slow system. Which two commands can be used to identify processes consuming excessive CPU or memory? (Choose two.)

Accepted Answer

ps aux --sort=-%mem. Option C, `ps aux --sort=-%mem`, is correct because it lists all processes with their CPU and memory usage and sorts them in descending order by memory percentage, immediately revealing the top memory consumers. Option E, `top`, is correct because it provides a real-time, dynamically refreshing view of running processes ranked by CPU usage (and can be toggled to sort by memory with Shift+M), making it ideal for spotting processes consuming excessive CPU or memory. Option A, `free -m`, only reports total, used, and available system memory in megabytes; it shows overall memory pressure but not which processes are responsible. Option B, `iostat -x`, reports extended disk I/O statistics per device, which is useful for storage bottlenecks but not for identifying CPU- or memory-hungry processes. Option D, `df -h`, displays filesystem disk space usage in human-readable form, which is unrelated to per-process CPU or memory consumption.

Answer

free -m

Answer

iostat -x

Answer

df -h

Question 8

A Linux administrator is troubleshooting a service that fails to start. Which THREE files or commands should be checked to diagnose the issue? (Select THREE.)

Accepted Answer

journalctl -u service-name. Option B, journalctl -u service-name, is correct because it queries the systemd journal specifically for the unit's log messages, showing startup errors, exit codes, and dependency failures for that service. Option C, /var/log/messages (or /var/log/syslog), is correct because these traditional syslog files capture daemon and service messages on many distributions, providing historical context when the journal is not persistent. Option E, systemctl status service-name, is correct because it reports the unit's current state, loaded configuration, main PID, exit code, and recent log lines, immediately revealing why the service failed. Option A, dmesg, is not among the marked answers because it primarily shows kernel ring buffer messages and is less useful for user-space service startup failures. Option D, /etc/rc.local, is not marked because it is a legacy SysV init compatibility script and is not a diagnostic tool for systemd service failures.

Answer

dmesg

Answer

/etc/rc.local

Question 9

A systems administrator wants to monitor system performance in real time. Which TWO commands can be used to display live updating information about processes, CPU, and memory usage? (Select TWO.)

Accepted Answer

top. Option A, top, is correct because it launches an interactive, continuously refreshing view of running processes along with live CPU and memory utilization, updating by default every few seconds until you quit. Option B, htop, is also correct because it is an enhanced interactive process viewer that likewise refreshes in real time and displays per-process CPU and memory statistics in a full-screen, live-updating interface. Option C, ps aux, is not correct because ps produces a one-time static snapshot of current processes and exits immediately rather than updating live. Option D, sar -u 1 5, is not correct because although it samples CPU utilization at one-second intervals for five iterations, it reports historical/interval statistics rather than an interactive live-updating display. Option E, vmstat 1, is not correct because it prints periodic one-second samples of virtual memory, CPU, and I/O statistics to standard output but does not provide the live, interactive process-level monitoring the scenario requires.

Answer

ps aux

Answer

sar -u 1 5

Answer

vmstat 1

Question 10

Which THREE of the following are valid methods to troubleshoot a service that fails to start?

Accepted Answer

Run the service executable manually from the command line to see error output.. Option A is correct because running the service executable directly from the command line bypasses the service manager and surfaces stdout/stderr error messages that systemd may otherwise capture or suppress, making the actual failure reason visible. Option B is correct because journalctl queries the systemd journal, allowing you to inspect the unit's logged output and error messages (e.g., journalctl -u <service>) to identify why it failed to start. Option C is correct because a service often fails when its required dependencies (libraries, packages, or other units) are missing or not running, so verifying and starting those dependencies is a valid troubleshooting step. Option D is not a targeted method for a service startup failure; df -h only reports filesystem disk usage and is not specific to diagnosing why a particular service won't start. Option E is not a troubleshooting method for a failing service; systemctl daemon-reload only reloads unit file definitions after they are edited and does not diagnose or fix a service that fails to start.

Answer

Run df -h to check disk space.

Answer

Reload the systemd daemon with systemctl daemon-reload.

Question 11

An administrator needs to update the package cache and upgrade all installed packages on a Debian-based system. Which TWO commands are appropriate for this task? (Select TWO.)

Accepted Answer

apt update. Option B, `apt update`, is correct because it refreshes the local package index/cache from the repositories configured in /etc/apt/sources.list and sources.list.d, which is the required first step before any upgrade so APT knows the latest available versions. Option C, `apt upgrade`, is correct because it installs the newest versions of all currently installed packages using the refreshed cache, while safely holding back packages that would require removing or adding other packages. Together, `apt update` followed by `apt upgrade` accomplishes updating the package cache and upgrading installed packages on a Debian-based system. Option A, `apt dist-upgrade`, is not one of the marked answers here; it performs a more aggressive upgrade that can add or remove packages to resolve dependencies, which goes beyond the stated task. Option D, `dpkg --configure -a`, only reconfigures packages left unconfigured after an interrupted installation and does not update the cache or upgrade packages. Option E, `apt list --upgradable`, merely lists packages with available upgrades and performs no cache refresh or installation.

Answer

apt dist-upgrade

Answer

dpkg --configure -a

Answer

apt list --upgradable

Question 12

A Linux server is configured to allow SSH access for remote administration. The security team wants to limit SSH access to only users in the 'ssh-users' group. Which configuration should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups ssh-users. The AllowGroups directive in /etc/ssh/sshd_config restricts SSH logins to only those users who are members of the specified group. By setting 'AllowGroups ssh-users', only users belonging to the 'ssh-users' group will be permitted to authenticate via SSH, directly fulfilling the security team's requirement.

Answer

AllowUsers ssh-users

Answer

DenyUsers root

Answer

PermitRootLogin yes

Question 13

An administrator notices that a user's crontab file is not executing. Which two commands can the administrator use to verify the user's crontab configuration? (Select TWO.)

Accepted Answer

crontab -l -u username. `crontab -l -u username` lists the current crontab entries for the specified user, allowing the administrator to verify the configured jobs. Option C is correct because on many Linux distributions, user crontab files are stored as plain text files under `/var/spool/cron/crontabs/username`, and reading that file directly shows the same content. Both commands let the administrator inspect the exact cron schedule and commands for that user.

Answer

crontab -e -u username

Answer

systemctl status cron

Answer

grep username /etc/crontab

Question 14

An Ansible playbook is being written to install the Nginx web server on a group of Ubuntu servers. Which module should be used in the playbook to install the package?

Accepted Answer

apt. The apt module is used for package management on Debian/Ubuntu systems.

Answer

command

Answer

package

Answer

yum

Question 15

A pod in the Kubernetes cluster is in CrashLoopBackOff. Based on the exhibit, what is the most likely cause?

Accepted Answer

The application inside the container is crashing repeatedly.. The CrashLoopBackOff status indicates that a container in a pod is repeatedly crashing after starting. Kubernetes attempts to restart the container, but the application inside exits with a non-zero exit code, causing the restart loop. This is most commonly caused by the application itself crashing due to a bug, misconfiguration, or resource issue.

Answer

The container failed to start because of a missing configuration file.

Answer

The image pull failed due to authentication issues.

Answer

The container image is not available in the registry.