XK0-006 Practice Test 47 — 15 Questions

Question 1

A Linux administrator is troubleshooting a server that intermittently loses network connectivity. They suspect duplicate IP address conflicts on the local subnet. Which TWO commands can be used to detect whether another host is using the same IP address as the server? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

arping -D -I eth0 192.168.1.50. Duplicate IP detection requires either actively probing with ARP, as `arping -D` does, or passively observing ARP traffic for conflicting MAC-to-IP mappings, which `tcpdump -i eth0 arp` provides. Both methods operate at layer 2 where the conflict manifests. Commands that merely list hosts or interface settings cannot reveal two hosts claiming the same address.

Answer

ip neigh show

Answer

nmap -sn 192.168.1.0/24

Answer

ethtool eth0

Question 2

A Linux administrator needs to create a new user account named 'jsmith' with a home directory /home/jsmith and the default shell /bin/bash. Which command should the administrator use?

Accepted Answer

useradd -m -s /bin/bash jsmith. The correct command is useradd -m -s /bin/bash jsmith, which creates the user, makes the home directory, and sets the login shell to /bin/bash. This is the most direct and portable way to create a user with specific attributes. Other commands either modify existing users, set passwords, or are interactive and less precise.

Answer

passwd jsmith

Answer

usermod -aG jsmith

Answer

adduser jsmith

Question 3

A Linux administrator needs to schedule a backup script to run every day at 2:30 AM. Which TWO of the following methods can be used to achieve this? (Choose two.)

Accepted Answer

Create a cron job with the schedule '30 2 * * *' in the root crontab.. Both cron and systemd timers are valid methods for scheduling recurring tasks at specific times. A cron job with the schedule '30 2 * * *' runs daily at 2:30 AM. A systemd timer with OnCalendar=*-*-* 02:30:00 also triggers daily at that time when enabled. These are the two correct approaches among the options.

Answer

Create a systemd service with Restart=always and RestartSec=86400.

Answer

Use the 'at' command to schedule the script with 'at 02:30' and repeat it daily.

Answer

Add the script to /etc/cron.daily/ with a filename that starts with '02:30'.

Question 4

A Linux administrator needs to check the available disk space on all mounted filesystems in a human-readable format. Which command should the administrator use?

Accepted Answer

df -h. df -h is the correct command because it reports filesystem disk space usage and free space for all mounted filesystems in human-readable units. The -h flag converts sizes to GB, MB, or KB as appropriate, making the output easy to interpret. Other commands either show file sizes, partition tables, or block device topology, not free space.

Answer

fdisk -l

Answer

du -h

Answer

lsblk

Question 5

A Linux administrator needs to check the amount of free disk space on all mounted filesystems in a human-readable format. Which command should be used?

Accepted Answer

df -h. df -h is the correct command to check free disk space on all mounted filesystems in human-readable format. It reads filesystem statistics and displays total, used, and available space along with mount points. The other commands serve different purposes: du estimates directory usage, lsblk shows block device and filesystem information without usage, and fdisk lists partitions. Only df directly reports free space per filesystem.

Answer

lsblk -f

Answer

du -sh /*

Answer

fdisk -l

Question 6

A Linux server is experiencing intermittent network connectivity issues. The administrator suspects that packets are being dropped due to a misconfigured firewall rule. Which command should the administrator use to view the current iptables rules and their packet counters?

Accepted Answer

iptables -L -v -n. To diagnose firewall-related packet drops, the administrator needs to see the iptables rules along with their match counters. The `iptables -L -v -n` command provides a verbose listing with packet and byte counts, and numeric output. This reveals which rules are being hit and can indicate if a drop rule is matching traffic. Other commands either modify the firewall or show unrelated information.

Answer

tcpdump -i eth0

Answer

iptables -F

Answer

netstat -tuln

Question 7

A Linux administrator is troubleshooting a server that is running out of disk space. Which TWO commands can be used to identify which directories or files are consuming the most space? (Choose two.)

Accepted Answer

du -sh /*. To identify space consumption, du -sh /* summarizes the size of top-level directories, quickly showing which are largest. The find command with -size +100M locates large individual files. Together, they help pinpoint both large directories and files. df only shows filesystem-level usage, ls -laR is too verbose, and iostat measures I/O performance, not space.

Answer

iostat -d

Answer

ls -laR /

Answer

df -h

Question 8

A Linux administrator wants to harden a server against brute-force attacks. They decide to use fail2ban to monitor SSH authentication failures. After installing and enabling the fail2ban service, they need to verify that the SSH jail is active and correctly configured. Which command should they use to check the current status of the sshd jail?

Accepted Answer

fail2ban-client status sshd. To verify that the sshd jail is active and functioning, the administrator should use fail2ban-client status sshd. This command queries the running fail2ban server and returns details such as the number of failed attempts, banned IPs, and total bans for that specific jail. It is the definitive way to confirm the jail's operational status after configuration.

Answer

fail2ban-client -v

Answer

systemctl status fail2ban

Answer

cat /etc/fail2ban/jail.conf

Question 9

A Linux administrator is troubleshooting a service that fails to start. They want to view the most recent log entries for that service using systemd's journal. Which command should they use?

Accepted Answer

journalctl -u servicename. The journalctl -u command filters the systemd journal by unit, providing all log messages for that service. This is the correct tool to diagnose why a service fails to start, as it captures the service's standard output, error messages, and systemd's own messages about the unit.

Answer

dmesg | grep servicename

Answer

systemctl status servicename

Answer

tail -f /var/log/messages

Question 10

A Linux administrator is configuring a system to use a centralized authentication service. The requirement is that if the central server is unreachable, users should still be able to log in using cached credentials. Which PAM module should be configured to provide this functionality?

Accepted Answer

pam_sss with caching enabled in SSSD. SSSD with caching enabled provides offline authentication by storing credentials locally. The pam_sss module integrates with SSSD, and when the central server is down, SSSD uses its cache to validate credentials. Other modules like pam_unix only handle local accounts, and pam_ccreds is deprecated.

Answer

pam_ccreds

Answer

pam_unix

Answer

pam_sss

Question 11

A Linux administrator needs to configure sudo so that members of the group 'webadmins' can run any command as any user without being prompted for a password, but only on the host 'web01'. Which entry should be added to the sudoers file?

Accepted Answer

%webadmins web01=(ALL) NOPASSWD: ALL. The sudoers syntax allows specifying a group with %, a host, a runas list, and commands. The entry %webadmins web01=(ALL) NOPASSWD: ALL correctly allows group members to run any command as any user on web01 without a password prompt. This is the precise configuration needed.

Answer

%webadmins ALL=(ALL) NOPASSWD: ALL

Answer

webadmins web01=(ALL) NOPASSWD: ALL

Answer

%webadmins web01=(root) NOPASSWD: /usr/bin/apt

Question 12

A Linux administrator is troubleshooting a server that intermittently loses network connectivity. They suspect duplicate IP address conflicts on the local subnet. Which TWO commands can be used to detect whether another host is using the same IP address as the server? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

journalctl -u myservice -b. To see boot-time messages for a specific systemd service, the correct tool is `journalctl` with the `-u` (unit) and `-b` (current boot) options. This filters the journal to show only entries from that unit during the current boot. Other commands either show unit file contents, unit properties, or rely on a non-authoritative log file, and none provide the targeted boot logs needed.

Answer

systemctl cat myservice

Answer

grep myservice /var/log/boot.log

Answer

systemctl show myservice

Question 13

A Linux administrator needs to configure a service to run as a specific user and group, and to restart automatically on failure. The service is managed by systemd. Which directive in the unit file should the administrator use to specify the user and group, and which directive to ensure automatic restart?

Accepted Answer

User= and Group= in the [Service] section; Restart=on-failure. The correct directives are User= and Group= in the [Service] section, and Restart=on-failure. These set the execution context and restart policy. User and Group must be in [Service] because they affect how the service process runs. Restart=on-failure restarts the service when it exits with a non-zero code or is killed by a signal, covering typical failure conditions.

Answer

User= and Group= in the [Service] section; Restart=on-abort

Answer

ExecStart= with su or sudo; Restart=on-abnormal

Answer

User= and Group= in the [Unit] section; Restart=always

Question 14

A Linux administrator is investigating why a user cannot log in via SSH. The SSH service is running, and the network is reachable. The administrator suspects that the user's account is locked or expired. Which command should they use to check the account status and expiration details for the user 'jdoe'?

Accepted Answer

chage -l jdoe. The chage -l command displays detailed account aging information, including expiration dates for the password and the account itself. In this scenario, it would reveal if the account is expired or if the password has expired, which are common reasons for SSH login failure despite the service running. This makes it the correct diagnostic tool.

Answer

passwd -S jdoe

Answer

usermod -L jdoe

Answer

id jdoe

Question 15

A Linux administrator needs to extract the value of the 'version' field from a JSON file named config.json. The file contains a top-level key 'version' with a string value. Which command should be used to retrieve just the value?

Accepted Answer

jq -r '.version' config.json. `jq` is designed specifically for parsing JSON. Using `jq -r '.version'` extracts the value of the 'version' key and outputs it as a raw string. This approach is robust and handles JSON syntax correctly. Other tools like `grep`, `sed`, or `awk` are text-based and may work in simple cases but are error-prone with JSON's structure and variations.

Answer

grep '"version"' config.json

Answer

sed -n 's/.*"version": *"$.*$".*/\1/p' config.json

Answer

awk -F'"' '/version/ {print $4}' config.json