XK0-006 Practice Test 45 — 15 Questions

Question 1

A Linux administrator discovers that a user's home directory contains a file with setuid bit set, owned by root. The file is not part of any authorized software. What is the most appropriate immediate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the setuid bit with 'chmod u-s <file>'. The immediate priority is to neutralize the unauthorized setuid root binary, which poses a privilege escalation risk. Removing the setuid bit with 'chmod u-s' disables the ability for any user to execute the file with root privileges, containing the threat without destroying evidence that may be needed for forensic analysis. This aligns with security best practices of preserving artifacts while mitigating active risks.

Answer

Move the file to /tmp for further analysis

Answer

Delete the file immediately to remove the threat

Answer

Change the file owner to the user with 'chown user:user <file>'

Question 2

A user wants to create a hard link named 'linkfile' to an existing file 'original'. Which command accomplishes this?

Accepted Answer

ln original linkfile. The ln command without -s creates a hard link. ln -s creates a symbolic link. cp copies the file; mv moves it.

Answer

mv original linkfile

Answer

ln -s original linkfile

Answer

cp original linkfile

Question 3

A company needs to verify that the Apache HTTP server is running and see its current status along with recent log entries. Which command should be used?

Accepted Answer

systemctl status httpd. The `systemctl status httpd` command is correct because it provides a comprehensive view of the Apache HTTP server's current state (active/inactive), its process ID, memory usage, and the most recent log entries from the service's journal. This aligns with the question's requirement to both verify the service is running and see its status along with recent log entries, all in a single command output.

Answer

service httpd status

Answer

journalctl -u httpd

Answer

systemctl list-units --type=service

Question 4

Which command displays the amount of disk space used and available on mounted filesystems in a human-readable format (e.g., GB, MB)?

Accepted Answer

df -h. The `df -h` command displays disk space usage for all mounted filesystems, with the `-h` flag converting raw block counts into human-readable units like GB or MB. This is the standard Linux utility for reporting filesystem capacity, usage, and available space, making it the correct choice for the question.

Answer

lsblk

Answer

du -h

Answer

fdisk -l

Question 5

After a kernel update, the system boots but the network interface enp0s3 is not detected. The administrator verifies that the kernel module for the NIC is built for the new kernel. Which of the following should be done to ensure the module loads correctly?

Accepted Answer

Rebuild the initramfs. After a kernel update, the initramfs (initial RAM filesystem) must be rebuilt to include the new kernel's modules. Even though the NIC module is built for the new kernel, the initramfs may still contain the old kernel's modules or lack the new module entirely, preventing it from being loaded during early boot. Running `dracut -f` (or `update-initramfs -u` on Debian-based systems) rebuilds the initramfs to match the current kernel, ensuring the NIC module is available at boot time.

Answer

Load the module with modprobe

Answer

Update the udev rules

Answer

Reinstall the kernel package

Question 6

A system administrator notices that a service named 'myapp' fails to start on a Linux server. The command 'systemctl status myapp' shows 'Active: failed (Result: exit-code)'. Which of the following is the BEST first step to diagnose the issue?

Accepted Answer

Run 'journalctl -u myapp.service' to inspect the service logs.. The 'journalctl -u myapp.service' command retrieves the systemd journal logs specifically for the myapp service, which contain the service's stdout, stderr, and any error messages generated during its failed startup attempt. Since the service failed with an exit code, these logs are the most direct source of diagnostic information to identify why the process terminated abnormally.

Answer

Run 'dmesg' to view kernel messages.

Answer

Run 'ps aux | grep myapp' to check if the process is running.

Answer

Edit the service file with 'systemctl edit myapp' and increase timeout values.

Question 7

A developer wants to grant a user named 'john' read and write permissions to a file, but the file currently has an ACL that gives 'jane' full control. The administrator wants to add an ACL entry for 'john' without modifying existing entries. Which command accomplishes this?

Accepted Answer

setfacl -m u:john:rw file. The `setfacl -m` command modifies the ACL by adding or updating an entry for the specified user, leaving all other existing ACL entries intact. This directly satisfies the requirement to grant 'john' read and write permissions without altering 'jane's full control entry. The `-m` flag is specifically designed for modifying ACLs in this additive manner.

Answer

setfacl -x u:john:rw file

Answer

setfacl -b u:john:rw file

Answer

chmod u+rw file; setfacl -m u:john:rw file

Question 8

A security team wants to restrict SSH access to only users in the 'sshusers' group. Which configuration line in /etc/ssh/sshd_config achieves this?

Accepted Answer

AllowGroups sshusers. The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH login to users who are members of the specified group. By setting `AllowGroups sshusers`, only users in the 'sshusers' group are permitted to authenticate via SSH, meeting the security team's requirement.

Answer

DenyGroups sshusers

Answer

AllowUsers sshusers

Answer

Subsystem sftp /usr/lib/openssh/sftp-server

Question 9

Refer to the exhibit. A server administrator wants to ensure that when a user logs out, all processes started by that user are terminated. Which line should be added to the configuration?

Accepted Answer

KillUserProcesses=yes. KillUserProcesses=yes is the correct directive in systemd's logind.conf that ensures all processes belonging to a user are terminated when the user logs out. This setting enforces session cleanup by sending SIGTERM to user processes, then SIGKILL if they don't exit. It directly addresses the requirement to terminate all user-started processes upon logout.

Answer

IdleAction=kill

Answer

HandleLidSwitch=ignore

Answer

NAutoVTs=0

Question 10

An administrator runs 'mount -a' and receives the error shown in the exhibit. The /home partition was recently removed and replaced with a new disk. Which of the following steps should the administrator take to resolve the issue?

Accepted Answer

Run 'blkid /dev/sda3' to find the new UUID and update /etc/fstab.. The error occurs because the /home partition was replaced with a new disk, so its UUID (or device identifier) in /etc/fstab no longer matches the actual disk. Running 'blkid /dev/sda3' retrieves the new UUID, which must then be updated in /etc/fstab so that 'mount -a' can mount the correct device automatically.

Answer

Run 'mount /dev/sda3 /home' to mount the partition manually.

Answer

Run 'fsck /dev/sda3' to check the filesystem.

Answer

Run 'mkfs.ext4 /dev/sda3' to create a new filesystem.

Question 11

Refer to the exhibit. A user reports that they cannot write to /data, receiving a 'No space left on device' error. However, the df output shows 5.2G available. What is the most likely cause?

Accepted Answer

The filesystem is out of inodes.. 'No space left on device' despite df showing free space is the classic symptom of inode exhaustion. Each file and directory consumes an inode, and a filesystem can run out of inodes even when blocks (space) remain available. This commonly happens with directories containing millions of tiny files, such as mail queues, session files, or cache directories.

Answer

The /data entry in fstab is incorrect, causing the mount to fail.

Answer

The partition is mounted read-only.

Answer

The UUID for /data has changed.

Question 12

During a security audit, a Linux administrator finds that an unauthorized service is listening on TCP port 4444. The service is not managed by systemd. Which of the following commands should the administrator use to identify the process and disable it?

Accepted Answer

Run 'ss -tlnp | grep :4444' to find the PID, then use 'kill' to terminate the process.. 'ss -tlnp' lists TCP listening sockets with numeric addresses and the associated process PID. Piping the output through 'grep :4444' isolates the unauthorized service, and the PID can then be used with 'kill' to terminate the process. Since the service is not managed by systemd, systemctl commands are irrelevant, making 'kill' the appropriate method to stop the process.

Answer

Run 'fuser 4444/tcp' to find the PID and then use 'systemctl stop' to stop the service.

Answer

Run 'lsof -i :4444' to find the PID, then use 'systemctl disable' to disable the service.

Answer

Run 'systemctl status' to find the service name, then use 'systemctl stop' to stop it.

Question 13

The script in the exhibit runs successfully but the administrator expects it to indicate success. What change should be made?

Accepted Answer

Change 'exit 1' to 'exit 0'. The script uses 'exit 1' to terminate, which indicates a failure or error condition to the shell. The administrator expects the script to indicate success, so the exit code must be changed to 'exit 0', which is the standard Unix/Linux convention for successful execution. Exit codes are how scripts communicate their status to the calling process, and only exit 0 means success.

Answer

Replace $system_info with just system_info

Answer

Change the variable name to SYSTEM_INFO

Answer

Change 'exit 1' to 'exit 0' and remove the quotes around $system_info

Question 14

To limit the number of processes a user can create, which file should be configured?

Accepted Answer

/etc/security/limits.conf. The /etc/security/limits.conf file is used on Linux systems to set resource limits for users and groups, including the maximum number of processes (nproc). This file is read by PAM (Pluggable Authentication Modules) during login to apply ulimit settings. Configuring nproc there limits the number of processes a user can create.

Answer

/etc/pam.d/login

Answer

/etc/ulimit.conf

Answer

/etc/systemd/system.conf

Question 15

Which command can be used to generate an SSH key pair for user authentication?

Accepted Answer

ssh-keygen. The `ssh-keygen` command is the standard tool for generating SSH key pairs (public and private keys) used for user authentication. It creates RSA, ECDSA, Ed25519, or DSA key files (e.g., `~/.ssh/id_rsa` and `~/.ssh/id_rsa.pub`) and supports options like `-t` for key type and `-b` for bit length, directly enabling passwordless login via public key authentication.

Answer

ssh-keyscan

Answer

ssh-copy-id

Answer

ssh-add