XK0-006 Practice Test 49 — 15 Questions

Question 1

A developer creates a hard link to a file and then deletes the original file. What happens to the hard link?

Accepted Answer

The hard link still contains the data and is accessible.. Hard links share the same inode; deleting the original file removes one link, but the data remains accessible via the hard link until all links are removed.

Answer

The hard link is broken and cannot be accessed.

Answer

The hard link is automatically converted to a copy of the file.

Answer

The hard link becomes a symbolic link.

Question 2

A file has permissions rwxr-x--- and is owned by user alice and group devs. Which command would add the SUID bit while preserving existing permissions?

Accepted Answer

chmod u+s file. chmod u+s adds the SUID bit. The symbolic mode 'u+s' sets the SUID without changing the existing permission bits.

Answer

chmod a+s file

Answer

chmod 2755 file

Answer

chmod 4750 file

Question 3

An administrator needs to add an ACL entry to a file that grants the user 'john' read and write permissions. The file currently has no ACLs. Which command should the administrator use?

Accepted Answer

setfacl -m u:john:rw file. The correct command is setfacl -m u:john:rw file. setfacl is used to modify ACLs. getfacl is used to display ACLs and does not support a -m option for modifying ACLs on standard Linux systems.

Answer

chmod u+rw file

Answer

setfacl -x u:john file

Answer

getfacl -m u:john:rw file

Question 4

Which of the following directories is defined by the Filesystem Hierarchy Standard (FHS) as containing essential user command binaries that need to be available in single-user mode?

Accepted Answer

/bin. /bin contains essential command binaries required for booting and single-user mode.

Answer

/sbin

Answer

/opt/bin

Answer

/usr/bin

Question 5

Which of the following directories in the Filesystem Hierarchy Standard (FHS) contains variable data files such as logs, spool files, and temporary files that persist across reboots?

Accepted Answer

/var. /var is for variable data like logs, spool, and temporary files that persist. /tmp is for temporary files that may be cleared on reboot. /etc is for configuration files. /opt is for optional add-on software.

Answer

/opt

Answer

/etc

Answer

/tmp

Question 6

Which command would display the disk usage of each file and directory in /home in a human-readable format, but only showing one level deep?

Accepted Answer

du -h --max-depth=1 /home. du -h --max-depth=1 /home shows human-readable sizes for each item one level deep.

Answer

du -hs /home

Answer

du -h /home

Answer

df -h /home

Question 7

An administrator needs to find all files in /etc that have the SUID bit set. Which find command is correct?

Accepted Answer

find /etc -perm /4000. The SUID bit is represented by the permission 4000. -perm /4000 checks if any of the bits in 4000 are set (SUID).

Answer

find /etc -exec ls -l {} \; | grep '^...s'

Answer

find /etc -perm -4000

Answer

find /etc -type f -perm 4000

Question 8

A Linux administrator wants to change the permissions of a file to allow the owner to read, write, and execute; the group to read and execute; and others to read only. Which chmod command should be used?

Accepted Answer

chmod 754 file. Octal 754 corresponds to rwxr-xr--: owner rwx (7), group r-x (5), others r-- (4).

Answer

chmod 764 file

Answer

chmod 744 file

Answer

chmod 755 file

Question 9

A system administrator needs to monitor system performance over time. Which THREE tools can be used to collect and display CPU, memory, and I/O statistics? (Choose three.)

Accepted Answer

iostat. iostat reports CPU utilization and I/O statistics for devices, making it suitable for monitoring I/O and CPU over time. sar collects and displays system activity including CPU, memory, and I/O, and can log data for historical analysis. vmstat provides information about processes, memory, paging, block I/O, and CPU activity. top only shows CPU and memory per process and does not display I/O statistics, so it does not meet the full requirement. htop is similar to top and also lacks I/O statistics. Therefore, the three correct tools are iostat, sar, and vmstat.

Answer

top

Answer

htop

Question 10

A Linux server running RHEL 9 has SELinux in enforcing mode. A web application (Apache) is serving content from a custom directory /var/www/html/myapp. The application needs to write to a subdirectory /var/www/html/myapp/uploads. The administrator sets the context of the uploads directory to httpd_sys_content_t and also runs `restorecon -Rv /var/www/html/myapp`. However, Apache still cannot write to the uploads directory. The administrator checks the SELinux denials in /var/log/audit/audit.log and sees AVC denials related to writing. Which step should the administrator take next?

Accepted Answer

Change the type of the uploads directory to httpd_sys_rw_content_t.. The httpd_sys_content_t type is for read-only content. For read-write access, the directory must have type httpd_sys_rw_content_t (or httpd_sys_script_rw_t for scripts). Setting this type via `chcon -t httpd_sys_rw_content_t /var/www/html/myapp/uploads` will allow Apache to write. Option A (boolean httpd_enable_homedirs) is unrelated. Option C (add to group) does not address SELinux.

Answer

Disable SELinux temporarily.

Answer

Set the boolean httpd_enable_homedirs to on.

Answer

Add the apache user to the group that owns uploads.

Question 11

A system administrator needs to configure PAM to lock a user account after 5 failed login attempts for 15 minutes. Which two PAM modules and configuration lines are appropriate? (Select TWO.)

Accepted Answer

auth required pam_tally2.so deny=5 unlock_time=900. pam_faillock can be used to lock accounts after failed attempts. The 'deny' option sets the threshold, and 'unlock_time' sets the lockout duration. Alternatively, pam_tally2 can be used with similar options.

Answer

session required pam_limits.so

Answer

account required pam_faillock.so deny=5 unlock_time=900

Answer

password required pam_pwquality.so retry=5

Question 12

A firewall administrator wants to add a rule to allow incoming SSH traffic (port 22) using firewalld. Which command correctly adds this rule to the default zone permanently?

Accepted Answer

firewall-cmd --add-service=ssh --permanent. firewall-cmd --add-service=ssh --permanent adds the SSH service permanently. Option A lacks --permanent, Option C is missing the required protocol specification (e.g., /tcp), and Option D lacks --permanent. While --add-port=22/tcp would also work, --add-service is more descriptive and easier to manage.

Answer

firewall-cmd --add-port=22/tcp

Answer

firewall-cmd --add-port=22 --permanent

Answer

firewall-cmd --zone=public --add-service=ssh

Question 13

A system administrator needs to configure sudo so that members of the 'wheel' group can execute any command without a password. Which line should be added to /etc/sudoers (using visudo)?

Accepted Answer

%wheel ALL=(ALL) NOPASSWD: ALL. To allow wheel group to run all commands without a password, the line should be '%wheel ALL=(ALL) NOPASSWD: ALL'.

Answer

%wheel ALL=(ALL) ALL

Answer

wheel ALL=(ALL) NOPASSWD: ALL

Answer

%wheel ALL=NOPASSWD: ALL

Question 14

A security audit reveals that a Linux system allows password-based SSH logins and has weak password policies. Which THREE actions should the administrator take to improve security? (Choose three.)

Accepted Answer

Configure pam_faillock.so to lock accounts after failed attempts. Disabling password authentication, enforcing password complexity via pam_pwquality, and setting account lockout via pam_faillock are three strong measures. Changing SSH port is a minor hardening but not as effective as the other three. Enabling root login is bad.

Answer

Change SSH port to 2222

Answer

Set PermitRootLogin yes

Question 15

A system administrator wants to monitor changes to the /etc/passwd file using auditd. Which auditctl command sets up a watch on this file?

Accepted Answer

auditctl -a always,exit -F path=/etc/passwd -F perm=wa. The correct command is `auditctl -a always,exit -F path=/etc/passwd -F perm=wa`. This creates a syscall-based audit rule that triggers on every syscall that accesses /etc/passwd with write (w) or attribute change (a) permissions, effectively monitoring any changes to the file. Option D uses `-w` for a file watch but with `-p rwxa`, which monitors reads and executes as well—not just changes—making it less precise for monitoring changes only.

Answer

ausearch -f /etc/passwd

Answer

aureport -f /etc/passwd

Answer

auditctl -w /etc/passwd -p rwxa