XK0-006 Practice Test 50 — 15 Questions

Question 1

A Linux administrator is writing a Bash script that processes a list of filenames stored one per line in a file. Some filenames contain spaces. The administrator wants the loop to treat each full line as a single item without word-splitting, and also wants to strip the trailing newline from each item. Which construct accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

while IFS= read -r line; do process "$line"; done < filelist. Reading lines safely in Bash requires neutralizing both whitespace trimming and escape processing. IFS= preserves the line exactly, and -r stops backslashes from acting as escapes. Quoting the variable at every use prevents a second round of word splitting. Only the construct that combines all three elements keeps filenames with spaces or special characters as single, unmodified arguments.

Answer

while read line; do process "$line"; done < filelist

Answer

while IFS= read -r line; do process $line; done < filelist

Answer

for line in $(cat filelist); do process "$line"; done

Question 2

A Linux administrator needs to grant the user 'alice' the ability to run all commands as root without being prompted for a password, but only from the host 'server1'. Which entry in /etc/sudoers accomplishes this?

Accepted Answer

alice server1=(ALL) NOPASSWD: ALL. The sudoers file uses the format user host=(runas) command. To allow alice to run all commands as root without a password only on server1, the correct entry is 'alice server1=(ALL) NOPASSWD: ALL'. The host field restricts the rule to server1, and NOPASSWD: ALL removes the password requirement for all commands.

Answer

alice server1=(root) NOPASSWD: /bin/bash

Answer

alice ALL=(server1) NOPASSWD: ALL

Answer

alice ALL=(ALL) NOPASSWD: server1

Question 3

An administrator needs to monitor a service's log output and wants systemd to capture the output of a specific service unit into the journal, tagged so it can be filtered by the unit name. The administrator also wants to limit how much disk space the journal may consume so it does not fill the root filesystem. Which configuration accomplishes both goals?

Accepted Answer

Set SystemMaxUse in /etc/systemd/journald.conf and ensure the service logs to the journal via StandardOutput=journal in its unit file. Capturing a service's output in the journal with unit tagging requires the unit to send output to the journal, and journald limits total disk usage through SystemMaxUse in journald.conf. Filtering by unit then works with journalctl -u. Disabling storage, redirecting output to files, or limiting only the runtime journal fails to both capture and cap the data as required.

Answer

Set RuntimeMaxUse in journald.conf and add StandardOutput=file:/var/log/report.log to the service unit

Answer

Set Storage=none in journald.conf and add StandardOutput=syslog to the service unit

Answer

Set MaxLevelStore in journald.conf and add StandardError=null to the service unit

Question 4

A Linux administrator wants to allow the web server (httpd) to bind to a non-standard port, TCP 8080, without disabling SELinux. The system is running SELinux in enforcing mode. Which command should the administrator run to permanently allow httpd to listen on TCP port 8080?

Accepted Answer

semanage port -a -t http_port_t -p tcp 8080. To allow httpd to listen on TCP port 8080 in enforcing mode, the port must be added to the http_port_t SELinux type using semanage port -a. This is persistent and does not require disabling SELinux. Modifying an existing port definition is only for reassigning a port that is already defined, and boolean or file context changes do not affect port bindings.

Answer

semanage port -m -t http_port_t -p tcp 8080

Answer

chcon -t http_port_t /etc/httpd/conf/httpd.conf

Answer

setsebool -P httpd_can_network_connect 1

Question 5

A Linux administrator is writing a Bash script that processes a list of filenames stored one per line in a file. Some filenames contain spaces. The administrator wants the loop to treat each full line as a single item without word-splitting, and also wants to strip the trailing newline from each item. Which construct accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$1 with the -z test, as in [ -z "$1" ]. The first positional parameter is referenced as $1, and quoting it preserves its value even when empty. The -z test evaluates to true for a zero-length string, so checking [ -z "$1" ] reliably detects a missing filename argument and lets the script print an error and exit before proceeding.

Answer

$0 with the -z test, as in [ -z "$0" ]

Answer

$# with the -z test, as in [ -z "$#" ]

Answer

$@ with the -z test, as in [ -z "$@" ]

Question 6

A security engineer must ensure that a new SSH host key is generated using the Ed25519 algorithm and stored in the default location. Which command accomplishes this?

Accepted Answer

ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key. Host keys are generated with ssh-keygen using -t to select the algorithm and -f to specify the output file. For an Ed25519 host key in the default location, the correct invocation is ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key. This ensures sshd will find and use the key without additional configuration.

Answer

ssh-keygen -A

Answer

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519

Answer

ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key

Question 7

A security policy mandates that user 'alice' must change her password every 60 days and must be warned 7 days before expiration. Which command should be used to enforce this?

Accepted Answer

chage -M 60 -W 7 alice. The chage command directly manipulates the password aging fields in /etc/shadow. Using -M 60 enforces the maximum days a password is valid, and -W 7 provides a warning to the user seven days before expiration. This is the correct and portable method to comply with the stated security policy.

Answer

passwd -x 60 -w 7 alice

Answer

chage -m 60 -I 7 alice

Answer

usermod -e 2025-01-01 -f 7 alice

Question 8

A Linux administrator is hardening a server that runs a custom application. The security team requires that the system enforce password complexity and account lockout policies. The administrator decides to use PAM. Which TWO modules should be added to the appropriate PAM configuration files to enforce these requirements? (Choose two.)

Accepted Answer

pam_faillock.so. To enforce password complexity, pam_pwquality.so is the standard module, checking password strength against configured criteria. For account lockout, pam_faillock.so is the modern replacement for pam_tally2.so, tracking failed attempts and locking accounts after a threshold. Together, they meet the security team's requirements when placed in the correct PAM stacks.

Answer

pam_unix.so

Answer

pam_tally2.so

Answer

pam_limits.so

Question 9

A Linux administrator notices that the /home directory is running low on space. They need to identify which user directories are consuming the most disk space. Which command will display the total disk usage of each immediate subdirectory under /home, in human-readable format, sorted by size?

Accepted Answer

du -sh /home/* | sort -h. The du command with -s and -h summarizes each specified directory in human-readable units; using a glob for immediate subdirectories and piping to sort -h orders them by size. This gives a clear ranking of which user directories consume the most space, directly addressing the low-space issue. Other tools either report filesystem-level totals or list files without per-directory aggregation.

Answer

ls -lS /home

Answer

df -h /home

Answer

find /home -type f -size +100M

Question 10

A Linux administrator is configuring a new server and needs to ensure that the SSH service starts automatically at boot and that the firewall allows SSH connections. The system uses systemd and firewalld. Which two commands should the administrator run? (Choose two.)

Accepted Answer

firewall-cmd --permanent --add-service=ssh. To ensure SSH starts at boot, the service must be enabled with systemctl enable. To allow SSH through firewalld, the SSH service must be added permanently with firewall-cmd --permanent --add-service=ssh. Together, these two commands satisfy both the startup and firewall requirements. Starting the service without enabling it would not survive a reboot, and reloading the firewall without adding the rule would not open the port.

Answer

systemctl start sshd

Answer

firewall-cmd --reload

Answer

systemctl mask sshd

Question 11

A Linux administrator needs to schedule a maintenance script to run every Monday at 03:15 on a systemd-based server. The script must persist across reboots and must not depend on a user being logged in. Which of the following is the BEST approach?

Accepted Answer

Create a systemd timer unit with OnCalendar=Mon 03:15:00 and a matching service unit, then enable the timer with systemctl enable --now.. Systemd timers are the modern, native scheduling mechanism on systemd-based Linux distributions. Pairing a timer unit that defines OnCalendar=Mon 03:15:00 with a service unit that runs the script, then enabling the timer, satisfies the requirement for a recurring, reboot-persistent job that runs without any logged-in user. This approach is more robust than legacy cron or one-shot at jobs.

Answer

Add the entry to /etc/crontab using the root user field, then run systemctl restart crond.

Answer

Place a script in /etc/profile.d/ that invokes the maintenance command, ensuring it runs for every user session.

Answer

Create an at job with at 03:15 Mon and save it with atq so it repeats weekly.

Question 12

A Linux server has a logical volume that is running out of space. The administrator extends the underlying volume group by adding a new physical volume, then extends the logical volume and resizes the filesystem. Which command should be used to resize the ext4 filesystem after extending the logical volume?

Accepted Answer

resize2fs /dev/vg0/lv_data. After extending the logical volume, the ext4 filesystem must be resized to use the new space. The resize2fs command is designed for this purpose and can resize ext4 filesystems online. It is the correct tool after lvextend.

Answer

xfs_growfs /dev/vg0/lv_data

Answer

lvextend -r /dev/vg0/lv_data

Answer

vgextend vg0 /dev/sdb1

Question 13

A Linux administrator needs to configure a system to automatically mount an NFS share at /mnt/data during boot. The NFS server is 192.168.1.100 exporting /export/data. Which file should the administrator edit to add the appropriate entry?

Accepted Answer

/etc/fstab. To ensure an NFS share is mounted automatically at boot, the administrator must add an entry to /etc/fstab. This file contains static filesystem information that systemd uses to generate mount units. The entry includes the server export, local mount point, filesystem type, and options. Other files like /etc/mtab or /etc/nfs.conf serve different purposes and do not control persistent mounts.

Answer

/etc/nfs.conf

Answer

/etc/mtab

Answer

/etc/exports

Question 14

A Linux administrator needs to schedule a script to run every Monday at 3:00 AM. The script is located at /opt/scripts/weekly_report.sh. Which entry should be added to the crontab to accomplish this?

Accepted Answer

0 3 * * 1 /opt/scripts/weekly_report.sh. Cron entries consist of five time fields followed by the command. The correct sequence for Monday at 3:00 AM is minute 0, hour 3, any day of month, any month, and day-of-week 1. This ensures the script runs weekly on Monday at the specified time. Other options misplace fields or use incorrect day-of-week values, leading to unintended schedules.

Answer

3 0 * * 1 /opt/scripts/weekly_report.sh

Answer

0 3 1 * * /opt/scripts/weekly_report.sh

Answer

0 3 * * 0 /opt/scripts/weekly_report.sh

Question 15

A Linux administrator notices that a server's root filesystem is using 100% of its inodes, even though `df -h` shows only 60% of the disk space used. Users are unable to create new files. Which command most directly helps identify directories containing large numbers of small files that are consuming inodes?

Accepted Answer

du --inodes -s /* | sort -n. The root filesystem has run out of inodes, not blocks, so tools that report disk space are ineffective. `du --inodes -s /*` followed by numeric sorting reveals which top-level directories contain the most inodes, allowing the administrator to drill down and remove unneeded small files. This approach directly targets the exhausted resource and avoids wasted effort on block-space analysis.

Answer

find / -xdev -type f | wc -l

Answer

du -sh /*

Answer

df -i