XK0-006 Practice Test 50 — 15 Questions

Question 1

An administrator is configuring a firewall using iptables to block all incoming traffic except SSH on port 22. Which three rules correctly implement this? (Choose THREE.)

Accepted Answer

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT. The correct approach: set default policy to DROP on INPUT, then allow established/related connections, then allow SSH. The other options either drop all (blocking SSH), use wrong chain, or allow all.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP

Answer

iptables -A INPUT -j DROP

Question 2

A user reports they cannot log in after three failed password attempts. The system uses PAM with pam_faillock. Which command can the administrator use to view the number of failed attempts for the user?

Accepted Answer

faillock --user username. The system uses PAM with pam_faillock, a modern lockout module. The 'faillock' command is specifically designed to display and manage failure counts for this module. 'pam_tally2' is used with the older pam_tally2 module and is not applicable here.

Answer

ausearch -m USER_LOGIN -ui username

Answer

pam_tally2 --user username

Answer

lastb username

Question 3

A DevOps team is using Ansible to manage configuration of web servers. They need to ensure that the Apache service is running and enabled at boot on all servers in the 'webservers' group. Which playbook task accomplishes this?

Accepted Answer

- name: Ensure Apache is running
  service:
    name: httpd
    state: started
    enabled: yes. The Ansible service module can manage services; the 'enabled' and 'state' parameters control boot status and running state.

Answer

- name: Ensure Apache is running
  systemd:
    name: httpd
    state: started
    enabled: yes

Answer

- name: Ensure Apache is running
  shell: systemctl start httpd && systemctl enable httpd

Answer

- name: Ensure Apache is running
  command: systemctl enable --now httpd

Question 4

A technician needs to troubleshoot a system that is not booting. Which of the following is the most appropriate first step when using a rescue environment?

Accepted Answer

Mount the root filesystem to /mnt/sysimage.. When using a rescue environment, the first priority is to gain access to the system's configuration and log files by mounting the root filesystem. Mounting to /mnt/sysimage (a conventional mount point in Red Hat-based rescue modes) allows the technician to chroot into the environment and treat it as the running system, enabling further troubleshooting steps like checking logs or repairing the bootloader. This step is foundational because without the root filesystem mounted, commands like checking logs or running fsck cannot operate on the actual system data.

Answer

Check the system logs in /var/log/messages.

Answer

Run fsck on all partitions.

Answer

Reinstall the bootloader immediately.

Question 5

A development team uses Git for version control and wants to automate the testing of every commit pushed to the repository. They have a Jenkins server running on a Linux machine. The team wants to automatically trigger a Jenkins pipeline job whenever a push is made to the main branch of their Git repository. The Jenkins server is behind a firewall and cannot be accessed from the internet. The Git repository is hosted on a private GitHub repository. Which of the following is the best approach to trigger the Jenkins job automatically?

Accepted Answer

Configure Jenkins to poll the Git repository every minute for changes.. Jenkins' polling mechanism allows it to periodically check the Git repository for changes, which works even when the Jenkins server is behind a firewall and cannot receive inbound webhooks. Polling every minute provides near-real-time automation without requiring internet access to the Jenkins server, making it the only viable option given the network constraint.

Answer

Have developers manually click 'Build Now' in Jenkins after each push.

Answer

Configure a GitHub webhook to send a POST request to the Jenkins server.

Answer

Set up a cron job on the Git server to execute a script that triggers Jenkins.

Question 6

A Kubernetes administrator is creating a deployment YAML manifest. Which THREE fields are required in a Deployment spec? (Select THREE.)

Accepted Answer

apiVersion. In a Kubernetes Deployment manifest, the three required top-level fields for object identification are apiVersion, kind, and metadata. While spec is also mandatory for a Deployment, the question asks for three required fields and the standard required set is apiVersion, kind, and metadata.

Answer

replicas

Answer

spec

Question 7

A team uses Ansible for configuration management. They want to ensure a service is running on all managed nodes. Which Ansible module should be used in the playbook?

Accepted Answer

service. The service module manages services (start, stop, restart, etc.). The other modules are for different purposes.

Answer

systemd

Answer

command

Answer

shell

Question 8

An administrator is managing a Kubernetes cluster. A pod is running but not responding as expected. The administrator wants to view the standard output logs from the pod's main container. Which kubectl command should be used?

Accepted Answer

kubectl logs . kubectl logs retrieves the logs from the specified pod.

Answer

kubectl exec <pod-name> -- cat /var/log/app.log

Answer

kubectl get pod <pod-name> -o yaml

Answer

kubectl describe pod <pod-name>

Question 9

A script named 'test.sh' contains '#!/bin/bash' and is located in the current directory. Which command runs the script in the current shell environment without forking a subshell?

Accepted Answer

source test.sh. The `source` command (or its synonym `.`) executes the script in the current shell environment without forking a subshell. This is essential when you need the script to modify the current shell's environment, such as setting variables or changing directories, because a subshell would discard those changes upon exit.

Answer

./test.sh

Answer

sh test.sh

Answer

bash test.sh

Question 10

A system administrator wants to deploy a containerized application on a Linux server with minimal overhead and without a daemon. Which container runtime should be used?

Accepted Answer

Podman. Podman is the correct choice because it is a daemonless container engine that runs containers directly under the user's process space, using a fork-exec model rather than a background daemon. This aligns with the requirement for minimal overhead and no daemon, as Podman does not require a persistent service to manage containers.

Answer

containerd

Answer

LXC

Answer

Docker

Question 11

A system administrator wants to restrict SSH access to a specific group of users. Which two methods can achieve this? (Select TWO.)

Accepted Answer

Edit /etc/ssh/sshd_config and set AllowGroups engineers. The `AllowGroups` directive in `/etc/ssh/sshd_config` explicitly restricts SSH access to members of specified groups. When set to `AllowGroups engineers`, only users belonging to the 'engineers' group can authenticate via SSH, providing a straightforward and secure method for group-based access control.

Answer

Use /etc/security/access.conf

Answer

Modify /etc/pam.d/sshd to use pam_listfile.so

Answer

Add users to the sshd group

Question 12

A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?

Accepted Answer

ss -tlnp. The ss command is the modern replacement for netstat, and ss -tlnp shows listening TCP ports with process information.

Answer

nmap localhost

Answer

ip link show

Answer

dig -t any localhost

Question 13

A security audit reveals that the /var/log directory has permissions 777. Which command should restore secure permissions, assuming the owner is root and group is adm?

Accepted Answer

chmod 755 /var/log. /var/log typically contains sensitive system logs, and permissions of 755 (owner: rwx, group: r-x, others: r-x) allow the root owner full access, the adm group read/execute access (needed for log reading tools), and others read-only access without write permissions. This aligns with security best practices where only root should write to /var/log, and the 777 permission from the audit is overly permissive and a security risk.

Answer

chmod 777 /var/log

Answer

chmod 700 /var/log

Answer

chmod 750 /var/log

Question 14

During boot, a Linux system displays a kernel panic with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Corrupt initramfs missing a necessary kernel module for the root device. This error indicates that the root filesystem cannot be found, often due to a missing driver for the storage device in the initramfs.

Answer

Incorrect time configuration in the BIOS

Answer

The /etc/fstab file has an invalid filesystem type for the root partition

Answer

A defective network cable

Question 15

A Linux server fails to boot and drops into a GRUB prompt. The administrator needs to boot into single-user mode to repair the system. Which GRUB command should be added to the kernel line temporarily?

Accepted Answer

single. Adding 'single' to the kernel boot parameters boots into single-user mode.

Answer

rd.break

Answer

systemd.unit=rescue.target

Answer

debug