XK0-006 Practice Test 47 — 15 Questions

Question 1

A developer wants to grant a user named 'john' read and write permissions to a file, but the file currently has an ACL that gives 'jane' full control. The administrator wants to add an ACL entry for 'john' without modifying existing entries. Which command accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

setfacl -m u:john:rw file. setfacl -m adds or modifies an ACL entry without affecting others.

Answer

setfacl -x u:john:rw file

Answer

setfacl -b u:john:rw file

Answer

chmod u+rw file; setfacl -m u:john:rw file

Question 2

Match each Linux runlevel to its standard systemd target.

Accepted Answer

runlevel 0: poweroff.target. Systemd targets align with traditional SysV runlevels: runlevel 0 → poweroff.target, runlevel 1 → rescue.target, runlevel 2/3/4 → multi-user.target, runlevel 5 → graphical.target, runlevel 6 → reboot.target. Common confusions involve mixing up GUI and non-GUI targets or confusing runlevels for shutdown/reboot.

Answer

runlevel 3: graphical.target

Answer

runlevel 6: rescue.target

Answer

runlevel 2: poweroff.target

Question 3

A security policy requires that user home directories have permissions set so that only the owner has access. A new user 'john' has a home directory with permissions 755. Which command should the administrator run to enforce the policy?

Accepted Answer

chmod 700 /home/john. The security policy requires that only the owner has access to the home directory. The current permissions 755 grant read and execute access to the group and others. The chmod 700 command sets permissions to rwx------, which gives the owner full access and removes all permissions for the group and others, enforcing the policy.

Answer

chmod 711 /home/john

Answer

chmod 770 /home/john

Answer

chmod 750 /home/john

Question 4

A system administrator needs to determine which process is using the most memory on a Linux server. Which command should be used to display processes sorted by memory usage?

Accepted Answer

ps aux --sort=-%mem. `ps aux --sort=-%mem` lists all processes with detailed information and sorts them by memory usage in descending order, showing the most memory-intensive process first. The `-%mem` flag specifies sorting by the %MEM column (resident set size as a percentage of total physical memory) in reverse order, which directly answers the requirement to determine which process is using the most memory.

Answer

top -o %MEM

Answer

vmstat 1 5

Answer

free -m

Question 5

A security team wants to restrict SSH access to only users in the 'sshusers' group. Which configuration line in /etc/ssh/sshd_config achieves this?

Accepted Answer

AllowGroups sshusers. The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH login to users who are members of the specified group. By setting `AllowGroups sshusers`, only users in the 'sshusers' group are permitted to authenticate via SSH, meeting the security team's requirement.

Answer

DenyGroups sshusers

Answer

AllowUsers sshusers

Answer

Subsystem sftp /usr/lib/openssh/sftp-server

Question 6

A Linux engineer needs to ensure a bash script runs with strict error handling. Which TWO of the following should be included? (Choose two.)

Accepted Answer

set -o pipefail. 'set -o pipefail', is correct because it ensures that if any command in a pipeline fails (returns a non-zero exit status), the entire pipeline's exit status reflects that failure. Without it, only the last command's exit status is considered, which can mask errors in earlier pipeline stages. Option C, 'set -e', is correct because it causes the script to exit immediately upon any command returning a non-zero exit status, preventing silent failures from propagating.

Answer

set -n

Answer

set -x

Answer

shopt -s histappend

Question 7

A security audit identifies that the system's /etc/passwd file is world-readable. Which three security issues does this pose? (Select THREE.)

Accepted Answer

Attackers can obtain usernames easily.. The /etc/passwd file contains a list of all system usernames. Since the file is world-readable, any user or attacker can easily read this file to enumerate valid usernames, which is a common first step in password guessing or brute-force attacks. Usernames are stored in the first colon-delimited field of each line, making them trivially extractable.

Answer

Attackers can read the encrypted passwords.

Answer

Attackers can read password hashes.

Question 8

A security policy requires that user passwords must expire every 60 days and users should be warned 7 days before expiration. Which two commands can be used to set these policies? (Select TWO).

Accepted Answer

passwd -x 60 -w 7 username. The `passwd -x 60 -w 7 username` command sets the maximum password age to 60 days (`-x`) and the warning period to 7 days before expiration (`-w`). This directly satisfies the policy requirements for password expiration and advance warning.

Answer

chage -E 60 -W 7 username

Answer

usermod -e 60 -f 7 username

Answer

passwd -n 60 -m 7 username

Question 9

A technician notices a script fails to execute because the user does not have permission. The script currently has permissions 644. The technician needs to add execute permission for the owner only. Which command accomplishes this?

Accepted Answer

chmod u+x script.sh. The script currently has permissions 644, meaning the owner has read/write (6), group has read (4), and others have read (4). The requirement is to add execute permission for the owner only. The command `chmod u+x script.sh` adds (+) execute (x) permission to the user (u) — the owner — without affecting group or others. This is the precise and minimal command to achieve the goal.

Answer

chmod a+x script.sh

Answer

chmod 755 script.sh

Answer

chmod 744 script.sh

Question 10

A Linux server runs a web application that frequently runs out of file descriptors. Which configuration change would permanently increase the maximum number of open files for all users?

Accepted Answer

Edit /etc/security/limits.conf and add 'soft nofile 65536' and 'hard nofile 65536'. Editing /etc/security/limits.conf with both 'soft nofile' and 'hard nofile' entries permanently raises the per-user limit on open file descriptors for all users (or specified users/groups) at login. The soft limit is the current working limit, while the hard limit is the maximum ceiling; setting both ensures the user can reach the desired value without needing to run ulimit with root privileges.

Answer

Set 'fs.file-max = 65536' in /etc/sysctl.conf

Answer

Add 'session required pam_limits.so' to /etc/pam.d/login

Answer

Run 'ulimit -n 65536' in a startup script

Question 11

A containerized application writes logs to /var/log/app.log. The administrator wants to ensure logs persist even if the container is removed. Which approach should be used?

Accepted Answer

Use a Docker volume mounted at /var/log. Docker volumes are managed by Docker and persist independently of the container lifecycle. By mounting a volume at /var/log, the application writes logs directly to the volume, ensuring the data survives container removal and can be reused by other containers.

Answer

Copy logs to a bind mount

Answer

Set the log driver to syslog

Answer

Redirect logs to stdout and use docker logs

Question 12

Which command is used to convert a file to uppercase?

Accepted Answer

All of the above. All three commands (A, C, D) are valid ways to convert lowercase letters to uppercase using the `tr` command. Each uses a different syntax—character ranges, POSIX character classes, or bracket expressions—but all achieve the same result. The question asks which command is used, and since all options work, 'All of the above' is the correct answer.

Answer

tr '[a-z]' '[A-Z]'

Answer

tr [:lower:] [:upper:]

Answer

tr a-z A-Z

Question 13

A user reports that the /home partition is running out of space. Which command identifies the largest directories under /home?

Accepted Answer

du -sh /home/*. `du -sh /home/*` calculates the disk usage of each top-level item under /home, with `-s` summarizing each directory and `-h` providing human-readable sizes. This directly identifies the largest directories consuming space, which is exactly what the user needs to troubleshoot the /home partition running out of space.

Answer

df -h /home

Answer

ls -lhS /home

Answer

find /home -type d -size +100M

Question 14

A DevOps engineer is writing a Bash script to check if the configuration file /etc/myapp.conf exists and is readable. The script must exit with code 0 if the file is readable, and exit with code 1 otherwise. The script will be used on systems with Bash as the default shell. Which code snippet correctly implements this logic using the most efficient syntax available in Bash?

Accepted Answer

`if [[ -r /etc/myapp.conf ]]; then exit 0; else exit 1; fi`. The double-bracket [[ ... ]] construct is a Bash keyword that provides enhanced test functionality, including pattern matching and more efficient parsing without word splitting or pathname expansion. It directly supports the -r operator to check if a file is readable, and the script exits 0 if true, 1 otherwise, using the most efficient syntax available in Bash.

Answer

`if [ -r /etc/myapp.conf ]; then exit 0; else exit 1; fi`

Answer

`if test -r /etc/myapp.conf; then exit 0; else exit 1; fi`

Answer

`if ( -r /etc/myapp.conf ) then exit 0; else exit 1; fi`

Question 15

An administrator configures /etc/ssh/sshd_config with the following settings: PermitRootLogin no, PasswordAuthentication no, AllowUsers alice bob, MaxAuthTries 2. After restarting sshd, which of the following is true?

Accepted Answer

User bob can log in using a public key.. PasswordAuthentication no disables password logins, so public key authentication is required. PermitRootLogin no prevents root login entirely. AllowUsers restricts to alice and bob only. MaxAuthTries 2 limits authentication attempts. So root cannot log in even with keys, and alice/bob must use keys.

Answer

User charlie can log in using a public key.

Answer

User alice can log in using a password.

Answer

Root can log in using a valid password.