XK0-006 Practice Test 46 — 15 Questions

Question 1

Which command displays the current default umask value for a user?

Accepted Answer

umask. The umask command, when run without arguments, prints the current file-mode creation mask for the shell session. This mask determines which permission bits are removed from newly created files and directories.

Answer

chmod

Answer

set

Answer

ls -l

Question 2

A technician needs to troubleshoot a system that is not booting. Which of the following is the most appropriate first step when using a rescue environment?

Accepted Answer

Mount the root filesystem to /mnt/sysimage.. When using a rescue environment, the first priority is to gain access to the system's configuration and log files by mounting the root filesystem. Mounting to /mnt/sysimage (a conventional mount point in Red Hat-based rescue modes) allows the technician to chroot into the environment and treat it as the running system, enabling further troubleshooting steps like checking logs or repairing the bootloader. This step is foundational because without the root filesystem mounted, commands like checking logs or running fsck cannot operate on the actual system data.

Answer

Check the system logs in /var/log/messages.

Answer

Run fsck on all partitions.

Answer

Reinstall the bootloader immediately.

Question 3

Which of the following correctly describes the purpose of the /etc/shadow file?

Accepted Answer

It stores encrypted passwords and password aging fields.. The /etc/shadow file stores encrypted (hashed) user passwords and password aging information such as the date of last password change, minimum/maximum password age, and account expiration. This file is readable only by root to protect password hashes from unauthorized access, unlike /etc/passwd which is world-readable.

Answer

It stores the list of users who can use sudo.

Answer

It stores group memberships and group passwords.

Answer

It stores user account information including UID, GID, and shell.

Question 4

A security policy requires that all users must have passwords with at least one uppercase letter, one digit, and a minimum length of 12 characters. Which PAM configuration file and module should be used to enforce this?

Accepted Answer

/etc/pam.d/common-password with pam_pwquality.so. The pam_pwquality.so module is specifically designed to enforce password complexity policies such as minimum length, uppercase, digit, and special character requirements. It is configured in the password stack of PAM, typically in /etc/pam.d/common-password on Debian-based systems or /etc/pam.d/system-auth on RHEL-based systems. The options for pam_pwquality (e.g., minlen=12, ucredit=-1, dcredit=-1) directly map to the policy requirements. Therefore, /etc/pam.d/common-password with pam_pwquality.so is the correct choice.

Answer

/etc/pam.d/login with pam_securetty.so

Answer

/etc/pam.d/sshd with pam_unix.so

Answer

/etc/pam.d/sudo with pam_permit.so

Question 5

Refer to the exhibit. The service fails to start with the error 'Failed to start My Service: Unit not found'. What is the most likely cause?

Accepted Answer

The service file is not in the correct directory.. The error 'Unit not found' indicates that systemd cannot locate the service unit file. Systemd service files must be placed in specific directories such as /etc/systemd/system/ or /usr/lib/systemd/system/. If the file is in the wrong directory, systemd will not recognize the unit, causing the 'Unit not found' error. Option B correctly identifies this as the most likely cause.

Answer

The User specified does not exist.

Answer

The network target is not reached.

Answer

The ExecStart script is missing.

Question 6

A Linux administrator writes a bash script that needs to exit immediately if any command fails. Which of the following should be included at the beginning of the script?

Accepted Answer

set -e. set -e (errexit) causes the shell to exit immediately if any command returns a non-zero exit status, which is exactly the requirement. It is the standard way to make bash scripts fail fast rather than continuing after an error.

Answer

set -x

Answer

set -u

Answer

set -o pipefail

Question 7

A systems administrator needs to restrict SSH access to a Linux server so that only users in the 'sshusers' group can log in. Which configuration change should be made in /etc/ssh/sshd_config?

Accepted Answer

Add 'AllowGroups sshusers'. The 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH login to only users who are members of the specified group. By adding 'AllowGroups sshusers', only users in the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This is the standard OpenSSH mechanism for group-based access control.

Answer

Add 'AllowUsers sshusers'

Answer

Add 'DenyGroups all'

Answer

Add 'PermitRootLogin no' and add users to sshusers

Question 8

A Linux administrator needs to add a new user named 'jdoe' with a home directory and default shell /bin/bash. Which command should be used?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command creates a new user account, and the -m flag creates the home directory while -s /bin/bash sets the login shell. This is the standard Linux utility for adding users with a specified home directory and shell in a single command.

Answer

chage -m -s /bin/bash jdoe

Answer

passwd -m -s /bin/bash jdoe

Answer

usermod -m -s /bin/bash jdoe

Question 9

A Linux administrator is troubleshooting a Bash script that unexpectedly terminates when a command fails. The script uses `#!/bin/bash`. Which of the following commands, if placed at the beginning of the script, would cause it to exit on any command failure?

Accepted Answer

set -e. The `set -e` option makes the shell exit immediately if a command exits with a non-zero status.

Answer

set -u

Answer

trap 'exit 1' ERR

Answer

set -o pipefail

Question 10

A system administrator needs to change the hostname of a Linux server running systemd to 'webserver01'. Which command will accomplish this?

Accepted Answer

hostnamectl set-hostname webserver01. On systemd-based systems, hostnamectl is the correct tool to set the hostname persistently. The set-hostname subcommand updates the static hostname and writes it to /etc/hostname, ensuring it survives reboots. Other methods like the hostname command or sysctl are temporary or incorrect for this purpose.

Answer

hostname webserver01

Answer

sysctl kernel.hostname=webserver01

Answer

echo webserver01 > /etc/hosts

Question 11

A security team wants to harden a Linux server against unauthorized access. They need to restrict which users can authenticate via SSH and ensure that only key-based authentication is allowed for a specific group. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Use AllowGroups sshusers in /etc/ssh/sshd_config to limit SSH access to members of the sshusers group.. Disabling PasswordAuthentication enforces key-based logins, and AllowGroups restricts SSH access to a defined set of users. Together they meet the hardening goals. The other options either weaken security, add unrelated controls, or grant unnecessary privileges. Restarting sshd after changes is required for them to take effect.

Answer

Configure PAM to require two-factor authentication for all SSH sessions.

Answer

Add all users to the wheel group and set UsePAM yes in sshd_config.

Answer

Set PermitRootLogin yes in /etc/ssh/sshd_config to allow administrative access.

Question 12

A Linux administrator is troubleshooting a server that cannot resolve hostnames. The administrator suspects a misconfiguration in the DNS resolver. Which file should be checked first to verify the DNS server addresses?

Accepted Answer

/etc/resolv.conf. /etc/resolv.conf is the standard file for configuring DNS resolvers on Linux. It contains nameserver entries that specify the IP addresses of DNS servers. Checking this file directly verifies the DNS server addresses in use. Other files may influence resolution but do not store the DNS server addresses themselves.

Answer

/etc/nsswitch.conf

Answer

/etc/hosts

Answer

/etc/sysconfig/network-scripts/ifcfg-eth0

Question 13

A Linux administrator is automating container builds and needs to reduce image size and ensure reproducibility. Which TWO practices should be applied when writing the Dockerfile? (Choose two.)

Accepted Answer

Pin base images and package versions to specific tags or digests. Image size and reproducibility are improved by minimizing layers and pinning inputs. Combining install and cleanup in one RUN prevents deleted cache files from persisting in earlier layers, and pinning base images and package versions ensures identical builds. Using mutable tags, splitting update from install, or copying the full context early all work against these goals.

Answer

Add a separate RUN apt-get update in every RUN instruction that installs packages

Answer

Copy the entire build context into the image with COPY . /app before installing dependencies

Answer

Use the `latest` tag for all base images to always receive security updates

Question 14

A Linux administrator needs to automate the deployment of a Kubernetes application from a manifest file and verify that the rollout completes successfully within a script. Which pair of actions should the script perform to apply the manifest and block until the Deployment's rollout finishes?

Accepted Answer

kubectl apply -f deploy.yaml followed by kubectl rollout status deployment/myapp. Idempotent automation uses kubectl apply to create or update resources from a manifest, then kubectl rollout status to block until the Deployment rollout completes, which exits non-zero on failure. Alternatives like get with watch or describe do not provide a deterministic completion signal, and create or replace are not idempotent for repeated script runs.

Answer

kubectl apply -f deploy.yaml followed by kubectl describe deployment/myapp

Answer

kubectl replace -f deploy.yaml followed by kubectl logs deployment/myapp

Answer

kubectl create -f deploy.yaml followed by kubectl get pods -w

Question 15

A Linux administrator is automating container lifecycle tasks with a script and needs to ensure a specific container, named webapp, is stopped cleanly and removed, while also removing its anonymous volumes. Which TWO docker commands should be used to accomplish this? (Choose two.)

Accepted Answer

docker rm -v webapp. A clean container teardown involves stopping the container so its main process receives SIGTERM and can exit gracefully, then removing the container with the -v flag to delete its anonymous volumes. Using SIGKILL or broad volume pruning bypasses graceful shutdown or affects unrelated resources, and removing an image does not address the container or its volumes.

Answer

docker volume prune -a

Answer

docker rmi webapp

Answer

docker kill webapp