XK0-006 Practice Test 45 — 15 Questions

Question 1

A security auditor notices that a service account's password never expires. The company policy requires password rotation every 60 days. Which command will enforce this policy for the service account?

Accepted Answer

chage -M 60 serviceacct && chage -d 0 serviceacct. chage -M 60 sets the maximum password age to 60 days. To also force a password change on next login, use -d 0.

Answer

chage -W 7 serviceacct

Answer

usermod -e 60 serviceacct

Answer

passwd -n 60 serviceacct

Question 2

A system administrator is configuring a firewall using iptables. The requirement is to allow incoming SSH connections from the 192.168.1.0/24 network only. Which iptables rule should be added to the INPUT chain?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. It uses the `-s` (source) flag to specify the 192.168.1.0/24 network, ensuring only incoming SSH traffic (TCP port 22) from that subnet is accepted. The `-A INPUT` appends this rule to the INPUT chain, which processes incoming packets destined for the local system. This matches the requirement exactly.

Answer

iptables -A INPUT -p tcp --dport 22 -d 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j REJECT

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j LOG

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Question 3

An administrator notices that new SSH sessions fail for all users. Which line in the exhibit is most likely causing the failure?

Accepted Answer

account required pam_nologin.so. The line 'account required pam_nologin.so' causes new SSH sessions to fail because the pam_nologin module checks for the existence of /etc/nologin. If that file exists, it denies login to all non-root users. This is commonly used during maintenance to prevent new logins, and since the question states 'all users' (including root if root is not explicitly exempted), this PAM module is the direct cause of the failure.

Answer

session include password-auth

Answer

auth required pam_sepermit.so

Answer

session required pam_loginuid.so

Question 4

An administrator needs to view all current nftables rules. Which command should be used?

Accepted Answer

nft list ruleset. nft list ruleset displays the entire ruleset. nft list table only shows a specific table.

Answer

nft --list

Answer

nft show ruleset

Answer

iptables -L

Question 5

Based on the exhibit, what is the most likely cause of the repeated connection refused errors?

Accepted Answer

The database service is down.. The 'connection refused' error indicates that the client's TCP SYN packet reached the target host on port 3306, but the host actively rejected the connection because no process is listening on that port. This is the classic symptom of the MySQL/MariaDB database service being stopped or crashed, as the OS TCP stack sends an RST packet when a connection attempt hits a port with no listening socket.

Answer

The DNS resolution for the database host fails.

Answer

A firewall is blocking port 3306.

Answer

The database credentials are incorrect.

Question 6

A technician is troubleshooting a user's inability to execute a script. The script has execute permissions for the user. Which of the following could be causing the issue? (Choose two.)

Accepted Answer

The script is in a directory without execute permission. Even if the script file itself has execute permissions, the user must also have execute permission on the directory containing the script. The directory's execute bit (often called the 'search' bit) is required to traverse the directory and access files within it. Without it, the kernel will deny access to any file in that directory, regardless of the file's own permissions.

Answer

The user is not the owner

Answer

The script has a syntax error

Answer

The script is being blocked by a firewall

Question 7

A web server on RHEL 8 is serving content from a non-default directory /data/web. The SELinux context is set to default_t for the directory, causing access denials. Which command should be used to set the correct context for web content?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t "/data/web(/.*)?". `semanage fcontext` modifies the SELinux file context policy persistently, and the regular expression `/data/web(/.*)?` ensures that the directory and all its contents are labeled with `httpd_sys_content_t`, which is the type required for web content served by Apache. This persistent change survives file system relabeling, unlike `chcon` which only sets a temporary context.

Answer

setsebool -P httpd_can_network_connect on

Answer

restorecon -R /data/web

Answer

chcon -t httpd_sys_content_t /data/web

Question 8

After a kernel update, the system boots but the network interface enp0s3 is not detected. The administrator verifies that the kernel module for the NIC is built for the new kernel. Which of the following should be done to ensure the module loads correctly?

Accepted Answer

Rebuild the initramfs. After a kernel update, the initramfs (initial RAM filesystem) must be rebuilt to include the new kernel's modules. Even though the NIC module is built for the new kernel, the initramfs may still contain the old kernel's modules or lack the new module entirely, preventing it from being loaded during early boot. Running `dracut -f` (or `update-initramfs -u` on Debian-based systems) rebuilds the initramfs to match the current kernel, ensuring the NIC module is available at boot time.

Answer

Load the module with modprobe

Answer

Update the udev rules

Answer

Reinstall the kernel package

Question 9

An administrator views the exhibit output. Which command should be used first to investigate why sshd failed?

Accepted Answer

journalctl -u sshd.service. The `journalctl -u sshd.service` command is the correct first step because it displays the systemd journal logs specifically for the sshd service, providing detailed error messages and timestamps that explain why the service failed. This diagnostic approach follows the principle of checking logs before attempting to restart or modify a service, as the logs contain the root cause information needed for troubleshooting.

Answer

systemctl status sshd.service

Answer

systemctl restart sshd.service

Answer

systemctl list-units

Question 10

After making changes to /etc/grub.d/ and /etc/default/grub, an administrator needs to regenerate the GRUB2 configuration file. Which command should be used?

Accepted Answer

grub2-mkconfig -o /boot/grub2/grub.cfg. After modifying /etc/grub.d/ scripts or /etc/default/grub, the GRUB2 configuration file must be regenerated to apply the changes. The command `grub2-mkconfig -o /boot/grub2/grub.cfg` reads the configuration snippets and defaults, then writes the final boot menu configuration to the specified output file. This is the standard method on RHEL/CentOS 7+ and other distributions using GRUB2.

Answer

grub2-install

Answer

grub2-set-default 0

Answer

update-grub

Question 11

A developer needs to run a one-time script after the network is up on a systemd-based server. Which unit type should be used?

Accepted Answer

oneshot. The `oneshot` unit type is correct because it is designed for services that run a single task to completion and then exit, making it ideal for a one-time script that must execute after the network is up. In systemd, `oneshot` units can be configured with `RemainAfterExit=no` (the default) to indicate they do not need to stay running, and they support ordering dependencies like `After=network-online.target` to ensure the network is available before the script runs.

Answer

forking

Answer

exec

Answer

simple

Question 12

A Linux administrator is writing a systemd service unit file. Which three of the following directives are valid in the [Service] section? (Select THREE.)

Accepted Answer

Restart. A is correct because `Restart` is a valid directive in the `[Service]` section of a systemd service unit file. It controls whether and how the service is restarted when it exits, with common values like `always`, `on-failure`, or `no`. This directive is essential for ensuring service resilience in production environments.

Answer

After

Answer

Requires

Question 13

Scenario: A cloud hosting company uses SELinux in enforcing mode on all Linux servers. A developer reports that a custom web application running under Apache (httpd) is unable to write log files to /var/log/myapp/. The directory /var/log/myapp/ has permissions 755 and is owned by root:root. The httpd process runs as the 'apache' user. The administrator checks SELinux context: /var/log/myapp is labeled with default_t type. The administrator wants to allow httpd to write to this directory while maintaining security. Which command should the administrator run?

Accepted Answer

Run 'semanage fcontext -a -t httpd_log_t "/var/log/myapp(/.*)?"' and then 'restorecon -Rv /var/log/myapp'. It permanently relabels the directory with the httpd_log_t SELinux type, which is specifically designed to allow Apache (httpd) to write log files. The semanage fcontext command adds a file context mapping to the SELinux policy database, and restorecon applies that mapping to the filesystem. This approach maintains SELinux enforcing mode and does not rely on temporary changes like chcon or insecure workarounds like disabling SELinux.

Answer

Change ownership with 'chown apache:apache /var/log/myapp'

Answer

Run 'setenforce 0' to disable SELinux

Answer

Run 'chcon -t httpd_log_t /var/log/myapp'

Question 14

A user cannot delete a file owned by another user on a shared filesystem. The file's permissions are 644, and the directory has permissions 777 with the sticky bit set. Which action would allow the user to delete the file?

Accepted Answer

Remove the sticky bit from the directory. The directory has permissions 777, meaning all users have read, write, and execute permissions. Write permission on the directory is required to delete files. However, the sticky bit prevents users from deleting files they do not own, even if they have write permission on the directory. Removing the sticky bit (option B) removes this restriction, allowing the user to delete the file.

Answer

Change the directory's group to include the user

Answer

Add write permission for others on the file

Answer

Change the file's group to match the user's group

Question 15

A systems administrator is writing a bash script that must accept command-line options: -f for a configuration file, -v for verbose mode, and -d for a directory. Which TWO of the following are correct ways to parse these options using getopts? (Select TWO).

Accepted Answer

while getopts ':f:vd:' opt; do. getopts option string 'f:vd:' means -f requires an argument, -v is boolean, -d requires an argument. The colon after f and d indicates argument required.

Answer

while getopts 'f v d' opt; do

Answer

while getopts 'f:vd' opt; do

Answer

while getopts 'fv:d:' opt; do