XK0-006 Practice Test 44 — 15 Questions

Question 1

A system administrator notices that the httpd service fails to start. Which command should be used to view the most recent log entries for that specific service?

Accepted Answer

journalctl -u httpd. C is correct because `journalctl -u httpd` queries the systemd journal for log entries specifically associated with the httpd service unit. This command shows the most recent log messages for that service, including startup failures, error codes, and dependency issues, making it the direct and precise tool for troubleshooting a service that fails to start.

Answer

systemctl status httpd

Answer

dmesg | grep httpd

Answer

tail -f /var/log/messages

Question 2

A user reports that they cannot access a web server at 192.168.1.100. The administrator wants to check if the server is reachable and measure round-trip time. Which command is most appropriate?

Accepted Answer

ping 192.168.1.100. The `ping` command sends ICMP Echo Request packets to the target host and waits for ICMP Echo Reply packets, which directly tests reachability and measures round-trip time (RTT). This is the most appropriate tool for the administrator's stated goal of checking if the server is reachable and measuring RTT.

Answer

nmap -sn 192.168.1.100

Answer

traceroute 192.168.1.100

Answer

ss -tlnp | grep 192.168.1.100

Question 3

An Apache web server hosted on a Linux system is unable to connect to a backend database server on port 3306. Based on the exhibit, which action should the administrator take to resolve the issue?

Accepted Answer

Set the httpd_can_network_connect boolean to on.. The Apache web server cannot connect to the backend database server on port 3306 because SELinux is blocking the outbound network connection. The boolean `httpd_can_network_connect` controls whether the httpd daemon is allowed to initiate outbound TCP connections to remote hosts. Setting this boolean to `on` permits Apache to connect to the database server, resolving the connectivity issue without disabling SELinux entirely.

Answer

Disable SELinux by setting SELINUX=disabled in /etc/selinux/config.

Answer

Enable the httpd_enable_home_dirs boolean.

Answer

Change the SELinux context of the index.html file to httpd_sys_content_t.

Question 4

You are a Linux administrator at a company that runs a web application in Docker containers on a single host. The application consists of a front-end container (nginx) and a back-end container (node.js). Recently, after a system update, the front-end container fails to start with the error: 'Error response from daemon: driver failed programming external connectivity on endpoint frontend: (iptables failed: iptables --wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.17.0.2 --dport 80 -j ACCEPT: iptables: No chain/target/match by that name)'. Which action should you take to resolve the issue?

Accepted Answer

Restart the Docker daemon with systemctl restart docker. The error indicates that the Docker daemon's iptables rules are corrupted or missing, often caused by a system update that restarted or modified the iptables service. Restarting the Docker daemon with `systemctl restart docker` forces Docker to reinitialize its iptables chains (e.g., DOCKER, DOCKER-USER) and reapply the necessary rules, resolving the connectivity failure.

Answer

Reinstall iptables

Answer

Change the network driver to macvlan

Answer

Update the kernel to the latest version

Question 5

An AppArmor profile for a web server is in complain mode. After testing, the administrator wants to enforce the profile. Which command accomplishes this?

Accepted Answer

aa-enforce /etc/apparmor.d/usr.sbin.httpd. The correct command to enforce an AppArmor profile that is currently in complain mode is `aa-enforce`. This command switches the profile from complain (log-only) to enforce (block violations) mode. The option `-r` in `apparmor_parser` reloads the profile but does not change its mode; `aa-complain` sets it to complain mode, and `aa-status` only displays status.

Answer

apparmor_parser -r /etc/apparmor.d/usr.sbin.httpd

Answer

aa-complain /etc/apparmor.d/usr.sbin.httpd

Answer

aa-status /etc/apparmor.d/usr.sbin.httpd

Question 6

A senior administrator is troubleshooting a shell script that fails to execute properly. The script starts with #!/bin/bash and has execute permissions. Which of the following could cause the script to fail to run when invoked as ./script.sh?

Accepted Answer

The script contains carriage return characters (\r).. Carriage return characters (\r) are a common issue when scripts are edited on Windows and then transferred to Linux. The shebang line #!/bin/bash expects a Unix-style line ending (LF), but \r characters cause the shell to interpret the command interpreter as '/bin/bash\r', which is not a valid executable path. This results in a 'No such file or directory' error when the script is invoked as ./script.sh, even though permissions are correct.

Answer

The shebang line is not on the first line.

Answer

The script uses #!/bin/sh instead of bash.

Answer

The script starts with a byte order mark (BOM).

Question 7

An administrator wants to change the default systemd target to multi-user.target so the system boots to a text console. Which command should be used?

Accepted Answer

systemctl set-default multi-user.target. systemctl set-default multi-user.target sets the default target. systemctl isolate changes the current target but not the default. enable and mask are for services, not targets.

Answer

systemctl isolate multi-user.target

Answer

systemctl enable multi-user.target

Answer

systemctl mask multi-user.target

Question 8

A team uses Ansible for configuration management. A playbook fails with the error 'ERROR! Syntax Error while loading YAML script'. Which of the following is the most likely cause?

Accepted Answer

Incorrect indentation in the YAML file. The error 'Syntax Error while loading YAML script' indicates that Ansible's YAML parser encountered a structural problem in the playbook file. The most common cause in YAML is incorrect indentation, because YAML relies on consistent spacing (typically 2 spaces per level) to define the hierarchy of tasks, plays, and variables. A missing SSH key would produce a connection or authentication error, not a YAML syntax error.

Answer

Missing SSH key

Answer

Invalid module name

Answer

Playbook not executable

Question 9

A junior administrator is tasked with setting up a file server using NFS on a Linux server. The /etc/exports file currently contains: /srv/nfs *(rw,sync,no_subtree_check). The administrator wants to restrict access to only the 192.168.10.0/24 network and require clients to use a privileged port (less than 1024) for added security. Additionally, the administrator wants to prevent root users on the client from having root access to the NFS share. Which exports configuration meets these requirements?

Accepted Answer

/srv/nfs 192.168.10.0/24(rw,sync,no_subtree_check,secure,root_squash). It restricts access to the 192.168.10.0/24 network, uses the 'secure' option to require client connections from a privileged port (less than 1024), and applies 'root_squash' to map root users on the client to the anonymous 'nobody' user, preventing root-level access to the NFS share.

Answer

/srv/nfs 192.168.10.0/24(rw,sync,no_subtree_check,no_all_squash)

Answer

/srv/nfs 192.168.10.0/24(rw,sync,no_subtree_check,insecure,root_squash)

Answer

/srv/nfs 192.168.10.0/24(rw,sync,no_subtree_check,secure,no_root_squash)

Question 10

Which command displays the disk usage of files and directories in a human-readable format (e.g., KB, MB)?

Accepted Answer

du -h. The `du -h` command (disk usage with human-readable flag) recursively summarizes disk usage for files and directories, appending size suffixes like K, M, G for kilobytes, megabytes, and gigabytes. This directly matches the question's requirement to display disk usage in a human-readable format.

Answer

df -h

Answer

ls -lh

Answer

stat -h

Question 11

A junior administrator is asked to automate the backup of a configuration file every night at 11 PM. The script /usr/local/bin/backup.sh already exists. Which command should the administrator run to schedule this task?

Accepted Answer

echo "0 23 * * * /usr/local/bin/backup.sh" | crontab -. The `crontab -` command reads from standard input and installs the cron job. The line `0 23 * * * /usr/local/bin/backup.sh` specifies that the script should run at 23:00 (11 PM) every day, matching the requirement exactly. This is the standard method for scheduling recurring tasks in Linux using cron.

Answer

systemctl start backup.timer

Answer

at 23:00 /usr/local/bin/backup.sh

Answer

nohup /usr/local/bin/backup.sh &

Question 12

A user wants to change the permissions of a file to give the owner full control, the group read and execute, and others no access. Which of the following chmod commands will achieve this?

Accepted Answer

chmod 750 file. The numeric chmod mode 750 translates to owner=7 (read+write+execute = 4+2+1), group=5 (read+execute = 4+1), and others=0 (no access). This exactly matches the requirement: owner full control, group read and execute, others no access.

Answer

chmod 700 file

Answer

chmod 770 file

Answer

chmod 755 file

Question 13

A user reports that they cannot access a file because permission is denied. The file's permissions are -rwsr-xr-x. What special permission is set?

Accepted Answer

SUID. The permissions string `-rwsr-xr-x` shows an 's' in the owner's execute position, which is the SUID (Set User ID) bit. When SUID is set on an executable, the process runs with the effective UID of the file's owner rather than the invoking user — commonly used by utilities like `passwd` to allow normal users to modify protected files.

Answer

No special permission

Answer

Sticky bit

Answer

SGID

Question 14

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

Accepted Answer

The process is running in an unconfined domain.. The context 'unconfined_u:unconfined_r:unconfined_t:s0' indicates that the process is running in the unconfined domain (unconfined_t). In SELinux, processes in the unconfined domain are not restricted by the targeted policy, meaning they have full access subject to standard Linux permissions.

Answer

The process is running in permissive mode.

Answer

SELinux is disabled.

Answer

The process is confined by a targeted policy.

Question 15

An Apache web server (httpd) is serving content from a custom directory /webapps/company. The root directory is labeled with the default_t context, causing httpd to be denied access. Which command should the administrator use to persistently relabel the directory for httpd access?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t '/webapps/company(/.*)?'. `semanage fcontext` modifies the SELinux file context policy persistently, and the regex `/webapps/company(/.*)?` ensures the rule applies to the directory and all its contents. This is necessary because `restorecon` (option A) only applies the default context from the policy, which is `default_t` for this custom path, and `chcon` (option B) is non-persistent and will be overwritten by a file system relabel. The `setsebool` (option C) controls a boolean for user content, not the file context of a custom directory.

Answer

restorecon -v /webapps/company

Answer

chcon -t httpd_sys_content_t /webapps/company

Answer

setsebool -P httpd_read_user_content on