XK0-006 Practice Test 49 — 15 Questions

Question 1

A Linux administrator needs to grant a user the ability to run a specific command as root without being prompted for a password, while restricting all other commands. Which file should be edited to configure this using sudo?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the standard configuration file for sudo, where administrators define user privileges and command restrictions. To allow a user to run a specific command without a password, an entry with NOPASSWD is added. This file should be edited with visudo to ensure syntax correctness. Other files like sudo.conf or PAM configurations serve different purposes and do not control command authorization.

Answer

/etc/security/access.conf

Answer

/etc/sudo.conf

Answer

/etc/pam.d/sudo

Question 2

A Linux administrator needs to ensure that a new service, `myapp.service`, starts automatically at boot and is also started immediately, without rebooting. The service unit file is already installed in `/etc/systemd/system/`. Which sequence of commands should the administrator run?

Accepted Answer

systemctl enable --now myapp.service. The administrator must both enable the service for automatic startup at boot and start it immediately. The `systemctl enable --now` command accomplishes both tasks in one step, making it the correct choice. Other options either omit the immediate start, omit enabling, or use unnecessary commands like `daemon-reload` or `link` that do not address the requirements.

Answer

systemctl start myapp.service && systemctl enable myapp.service

Answer

systemctl link /etc/systemd/system/myapp.service && systemctl start myapp.service

Answer

systemctl daemon-reload && systemctl enable myapp.service

Question 3

A Linux administrator is configuring an SSH server to use certificate-based authentication. The administrator has generated a CA key pair and wants to sign a user's public key. Which command should be used to sign the user's public key with the CA and produce a certificate?

Accepted Answer

ssh-keygen -s /etc/ssh/ca_key -I user_id -n username -V +52w user_key.pub. To sign a user's public key with a CA in OpenSSH, the ssh-keygen command is used with the -s flag pointing to the CA private key, -I for the key identity, -n for principals, -V for validity, and the public key file as the final argument. This produces a certificate file that can be used for authentication. The other options misuse flags like -f, omit the .pub extension, or incorrectly use -O for the public key.

Answer

ssh-keygen -s /etc/ssh/ca_key -I user_id -n username -V +52w user_key

Answer

ssh-keygen -s /etc/ssh/ca_key -I user_id -n username -V +52w -f user_key

Answer

ssh-keygen -s /etc/ssh/ca_key -I user_id -n username -V +52w -O user_key.pub

Question 4

A Linux administrator is writing a Bash script that processes a list of hostnames stored one per line in /etc/app/hosts.list. The script must read each line into the variable host and run a command against it, and the loop must not consume standard input from the terminal so that interactive commands inside the loop can still read from the keyboard. Which construct satisfies these requirements?

Accepted Answer

while IFS= read -r host <&3; do probe "$host"; done 3< /etc/app/hosts.list. Redirecting the list to an alternate file descriptor and reading with read <&3 keeps standard input attached to the terminal, so interactive commands invoked in the loop body can still prompt the user. Using IFS= read -r also preserves hostname characters verbatim, which the whitespace-splitting for loop and the stdin-consuming while form cannot guarantee.

Answer

for host in $(cat /etc/app/hosts.list); do probe "$host"; done

Answer

until read host; do probe "$host"; done < /etc/app/hosts.list

Answer

while read -r host; do probe "$host"; done < /etc/app/hosts.list

Question 5

A Linux administrator notices that a server's root filesystem is filling up rapidly. After running `df -h`, the root filesystem shows 100% usage. However, when the administrator runs `du -sh /*` from the root directory, the total size is only about 40% of the filesystem. The administrator suspects that a deleted file is still being held open by a process. Which command should the administrator use to identify the process holding the deleted file?

Accepted Answer

lsof +L1. The `lsof +L1` command is specifically designed to list open files with a link count less than 1, meaning they have been deleted but are still held open by a process. This is the most direct and reliable way to identify the process causing the disk space discrepancy. Other commands may show open files but do not target deleted files specifically.

Answer

ls -l /proc/*/fd | grep deleted

Answer

fuser -mv /

Answer

find / -inum 0 -print

Question 6

A Linux administrator is writing a Bash script that must continue running even if an unset variable is referenced, but must still abort on a failed command. Currently the script has only `#!/bin/bash` at the top. Which line should be added to meet these requirements?

Accepted Answer

set -e. The requirement is to abort on a failed command while still tolerating references to unset variables. `set -e` provides the abort-on-error behavior, and because `-u` is not enabled, unset variables do not trigger termination. Enabling trace output or altering pipeline exit status does not produce the requested failure semantics, and enabling unset-variable errors would do the opposite of what is required.

Answer

set -x

Answer

set -u

Answer

set -o pipefail

Question 7

A user reports that an application fails with 'Permission denied' when writing to /srv/reports, even though the user is a member of the group that owns the directory. Running `ls -ld /srv/reports` returns 'drwxr-x--- 2 root reports 4096 Jun 10 09:14 /srv/reports'. The user's `id` output confirms membership in the reports group. Which action will allow the user to create files in that directory?

Accepted Answer

Run chmod g+w /srv/reports as root. The mode string shows the group triad as r-x, so members of the reports group can list and enter the directory but cannot create entries. Since the user's group membership is verified, the correct fix is to add write permission to the group triad only. This grants exactly the needed capability while preserving the restrictive access for all other accounts.

Answer

Run chmod u+w /srv/reports as root

Answer

Run chmod o+w /srv/reports as root

Answer

Run chown user:reports /srv/reports as root

Question 8

A Linux administrator is writing a Bash script that must run a cleanup routine when the script exits, whether it exits normally or is interrupted by a signal. The script defines a function named cleanup. Which command should the administrator use to ensure cleanup runs on exit?

Accepted Answer

trap 'cleanup' EXIT. The trap builtin is the standard Bash mechanism for running commands in response to signals or shell events. Using the EXIT pseudo-signal makes the handler run on any script termination, including normal completion and receipt of catchable signals, which is exactly what the administrator needs for a guaranteed cleanup routine.

Answer

setsid cleanup &

Answer

at now + 1 minute <<< cleanup

Answer

trap 'cleanup' SIGKILL

Question 9

A user reports that they cannot log in to a Linux server via SSH. The administrator checks /etc/passwd and sees the user's shell is set to /sbin/nologin. What is the most likely reason for the login failure?

Accepted Answer

The user is not allowed to have an interactive shell.. The shell /sbin/nologin is designed to prevent interactive logins. When a user with this shell attempts to log in via SSH, the shell is executed and immediately exits, denying access. This is the most likely reason for the failure, as it directly matches the observed configuration.

Answer

The SSH service is not running.

Answer

The user's account is locked.

Answer

The user's password has expired.

Question 10

A junior administrator needs to check whether a user account named 'bob' is locked and view the password aging information. Which command should be used?

Accepted Answer

passwd -S bob. The passwd -S command reports the password status for a user, indicating locked, no password, or usable states, and includes aging data. This single command lets the administrator verify lock status and review password aging, which matches the scenario's need for inspection without modifying the account.

Answer

usermod -L bob

Answer

chage -l bob

Answer

id bob

Question 11

A Linux administrator is configuring sudo for a team of developers. The developers need to run commands as the user 'webadmin' without being prompted for a password, but only for commands located in /usr/local/bin. Which sudoers entry correctly implements this?

Accepted Answer

%developers ALL=(webadmin) NOPASSWD: /usr/local/bin/*. The sudoers entry must specify the group, the target user (webadmin), the NOPASSWD tag, and the command path with a wildcard to allow all commands in /usr/local/bin. The correct syntax uses (webadmin) and NOPASSWD: followed by the path with /*. Other options either target the wrong user, use the wrong tag, or incorrectly specify a directory without a wildcard.

Answer

%developers ALL=(ALL) NOPASSWD: /usr/local/bin/*

Answer

%developers ALL=(webadmin) PASSWD: /usr/local/bin/*

Answer

%developers ALL=(webadmin) NOPASSWD: /usr/local/bin/

Question 12

A team wants a shared directory /srv/project where members of the group devteam can create and edit files, but files created by one member must remain editable by other members. The directory is on an ext4 filesystem, and the team does not want to manually change group ownership on every new file. Which command set achieves this?

Accepted Answer

chgrp devteam /srv/project && chmod 2775 /srv/project. The setgid bit on a directory causes new entries to inherit the directory's group rather than the creator's primary group. Pairing that with group ownership of devteam and mode 2775 gives the group read, write, and execute on the directory, so members can create and modify files. This is the traditional Unix approach for shared group workspaces and works on ext4 without additional ACL configuration.

Answer

setfacl -R -m g:devteam:rwx /srv/project && setfacl -R -d -m g:devteam:rwx /srv/project

Answer

chown :devteam /srv/project && chmod 1777 /srv/project

Answer

chmod g+s /srv/project && chmod o+t /srv/project

Question 13

A Linux administrator is configuring a server that must meet strict security guidelines. The server uses firewalld and should drop all incoming traffic on the public zone by default, but allow outgoing SSH connections initiated by the server itself to a remote management host. Which firewalld configuration should the administrator apply?

Accepted Answer

Set the target of the public zone to DROP, and ensure the default outbound behavior allows SSH to the remote host.. The public zone target DROP ensures all incoming traffic is silently discarded unless explicitly allowed. Outgoing traffic is not filtered by firewalld zones, so SSH connections initiated by the server are allowed by default. Adding inbound service rules or using REJECT would violate the drop requirement or send rejection messages.

Answer

Set the target of the public zone to DROP, and add a rich rule to allow outbound SSH to the remote host.

Answer

Set the target of the public zone to %%REJECT%%, and create a direct rule to allow outgoing SSH to the remote host.

Answer

Set the target of the public zone to DROP, and add a service rule for ssh to the public zone.

Question 14

A Linux administrator receives reports that a server becomes unresponsive for several seconds at a time. Running `uptime` shows a load average of 14.2 on a system with 4 CPU cores, and `vmstat 1` reports a steadily rising 'r' column with a 'wa' column near zero. Which command should the administrator run NEXT to identify which processes are consuming CPU time?

Accepted Answer

top -o %CPU. A load average of 14.2 on four cores with a growing run queue and almost no I/O wait indicates CPU contention, not storage or memory pressure. The fastest way to attribute that contention is a live, CPU-sorted process view, which shows exactly which tasks are runnable and consuming cycles so the administrator can decide whether to renice, restart, or investigate further.

Answer

iostat -x 1

Answer

free -m

Answer

df -h

Question 15

A Linux administrator is troubleshooting a systemd service that fails to start with the error 'Failed to start myservice.service: Unit myservice.service not found.' The service file exists at /etc/systemd/system/myservice.service and has correct permissions. Which command should the administrator run to resolve the issue?

Accepted Answer

systemctl daemon-reload. When a new unit file is added to /etc/systemd/system/, systemd does not automatically detect it. The administrator must run 'systemctl daemon-reload' to reload the systemd manager configuration. This command scans for new or changed unit files and makes them available for starting and enabling.

Answer

systemctl reexec myservice.service

Answer

systemctl start myservice.service

Answer

systemctl enable myservice.service