XK0-005 Practice Questions 2 — 50 Questions

Question 1

An administrator needs to deploy a containerized web application on a Linux server. The application requires port 8080 to be mapped to host port 80. Which command will run the container in detached mode with this port mapping?

Accepted Answer

docker run -d -p 80:8080 webapp. Option D is correct because the `-d` flag runs the container in detached mode, and `-p 80:8080` maps host port 80 to container port 8080, which matches the requirement. The syntax is `-p host_port:container_port`, so `-p 80:8080` correctly exposes the application's container port 8080 on the host's port 80.

Answer

docker run -p 80:8080 webapp

Answer

docker run -d -p 8080:80 webapp

Answer

docker run -d -p 8080:80 webapp

Question 2

Refer to the exhibit. The system administrator runs the command 'auditctl -l' and sees the above rules. What is the purpose of these audit rules?

Accepted Answer

To log any changes (write or attribute) to the password, shadow, and group files. The audit rules use the `-w` flag to watch the files `/etc/passwd`, `/etc/shadow`, and `/etc/group` for `wa` (write and attribute change) syscalls. This logs any modification to these critical authentication and authorization files, such as user additions, password changes, or permission changes, which is essential for security monitoring.

Answer

To log all successful login attempts on the system

Answer

To log any modifications to the audit configuration itself

Answer

To log all read accesses to /etc/passwd, /etc/shadow, and /etc/group

Question 3

A Linux server is configured to allow SSH access for remote administration. The security team wants to limit SSH access to only users in the 'ssh-users' group. Which configuration should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups ssh-users. Option B is correct because the AllowGroups directive in /etc/ssh/sshd_config restricts SSH logins to only those users who are members of the specified group. By setting 'AllowGroups ssh-users', only users belonging to the 'ssh-users' group will be permitted to authenticate via SSH, directly fulfilling the security team's requirement.

Answer

AllowUsers ssh-users

Answer

DenyUsers root

Answer

PermitRootLogin yes

Question 4

An administrator runs the commands shown in the exhibit. The container is accessible via curl using the container IP. However, the administrator cannot access the web server using the host's IP address on port 80. What is the most likely cause?

Accepted Answer

The container's port 80 is not published to the host.. Option B is correct because the administrator ran `docker run -d nginx` without the `-p` or `--publish` flag, which means port 80 inside the container is not mapped to any port on the host. The container is accessible via its own IP because Docker networking allows direct container-to-container communication, but the host's IP on port 80 remains unbound, so curl to the host IP fails. Publishing the port with `-p 80:80` would expose the container's port 80 on the host's interface.

Answer

The container's IP address is incorrect.

Answer

Nginx is configured to listen on a different port.

Answer

The container is not running.

Question 5

A Linux administrator is writing a Bash script to automate the backup of a database. The script must run a pre-backup command, check its exit status, and if successful, proceed with the backup; otherwise, log an error and exit. Which code snippet correctly implements this logic?

Accepted Answer

pre_backup_cmd
if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi
backup_cmd. Option C correctly runs the pre-backup command, then checks its exit status with `$?`. If the exit status is not zero (indicating failure), it logs an error to stderr and exits with code 1. Only if the pre-backup command succeeds does the script proceed to the backup command. This matches the requirement exactly: check exit status, log error on failure, and exit.

Answer

set -e
pre_backup_cmd
backup_cmd

Answer

pre_backup_cmd && backup_cmd || echo 'Error' >&2

Answer

(pre_backup_cmd; if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi) && backup_cmd

Question 6

A container is running a database service that requires persistent storage. The administrator wants to ensure that data persists even if the container is removed. Which volume mount type should be used in the Docker run command?

Accepted Answer

--mount type=bind. Option B is correct because a bind mount directly maps a host directory into the container, ensuring that data written to that mount point persists on the host filesystem even after the container is removed. This is ideal for database services that require persistent storage independent of the container lifecycle.

Answer

--mount type=volume

Answer

COPY in Dockerfile

Answer

--mount type=tmpfs

Question 7

A Linux system experiences high CPU usage from a process that appears to be a fork bomb. The administrator wants to prevent such attacks in the future by limiting the number of processes a user can create. Which configuration file should be modified, and what parameter should be set?

Accepted Answer

Add 'username hard nproc 100' in /etc/security/limits.conf. Option C is correct because /etc/security/limits.conf is the PAM-based configuration file used to set per-user resource limits via the 'nproc' parameter. Adding 'username hard nproc 100' enforces a hard limit of 100 processes for that user, preventing a fork bomb from exhausting system resources.

Answer

Set 'kernel.pid_max=100' in /etc/sysctl.conf

Answer

Set 'DefaultLimitNPROC=100' in /etc/systemd/system.conf

Answer

Add 'ulimit -u 100' to /etc/profile

Question 8

A DevOps engineer needs to automate the deployment of a microservice using Ansible. The playbook should install the latest version of nginx on all web servers. Which Ansible module should be used in the playbook?

Accepted Answer

apt: name=nginx state=latest. Option C is correct because the `apt` module is the proper Ansible module for managing packages on Debian-based systems, and `state=latest` ensures the most recent version of nginx is installed. This aligns with the requirement to automate deployment using Ansible's declarative package management rather than imperative shell commands.

Answer

service: name=nginx state=started

Answer

command: apt install nginx

Answer

yum: name=nginx state=latest

Question 9

A system administrator notices that a cron job runs every 5 minutes but should run only on weekdays. The current crontab entry is: */5 * * * * /usr/local/bin/script.sh. Which change to the time fields will restrict execution to Monday through Friday?

Accepted Answer

*/5 * * * 1-5 /usr/local/bin/script.sh. Option C is correct because the fifth field in a crontab entry specifies the day of the week, where 1 represents Monday and 5 represents Friday. By setting this field to `1-5`, the cron job will only execute on weekdays, while the `*/5` in the minute field ensures it still runs every 5 minutes. The other fields remain as `*` to allow execution at any hour and any day of the month.

Answer

*/5 9-17 * * 1-5 /usr/local/bin/script.sh

Answer

*/5 * * * 1-6 /usr/local/bin/script.sh

Answer

5 * * * 1-5 /usr/local/bin/script.sh

Question 10

An administrator runs 'mount -a' and receives the error shown in the exhibit. The /home partition was recently removed and replaced with a new disk. Which of the following steps should the administrator take to resolve the issue?

Accepted Answer

Run 'blkid /dev/sda3' to find the new UUID and update /etc/fstab.. The error occurs because the /home partition was replaced with a new disk, so its UUID (or device identifier) in /etc/fstab no longer matches the actual disk. Running 'blkid /dev/sda3' retrieves the new UUID, which must then be updated in /etc/fstab so that 'mount -a' can mount the correct device automatically.

Answer

Run 'mount /dev/sda3 /home' to mount the partition manually.

Answer

Run 'fsck /dev/sda3' to check the filesystem.

Answer

Run 'mkfs.ext4 /dev/sda3' to create a new filesystem.

Question 11

Which THREE of the following are valid methods to troubleshoot a service that fails to start?

Accepted Answer

Run the service executable manually from the command line to see error output.. Option A is correct because running the service executable manually from the command line often reveals stderr output, error codes, or missing configuration details that are suppressed when the service is started by systemd. This direct execution bypasses the service manager's logging and can show immediate, unfiltered error messages that help pinpoint the failure reason.

Answer

Run df -h to check disk space.

Answer

Reload the systemd daemon with systemctl daemon-reload.

Question 12

Which TWO statements are true regarding the use of Ansible for automation? (Choose TWO.)

Accepted Answer

Ansible playbooks are written in YAML.. Option B is correct because Ansible playbooks are written in YAML (YAML Ain't Markup Language), which is a human-readable data serialization standard. YAML allows for simple, declarative syntax to define automation tasks, variables, and handlers, making playbooks easy to write and maintain without requiring programming expertise.

Answer

Ansible requires a dedicated master server to manage nodes.

Answer

Ansible uses a pull-based model where nodes fetch configurations from a central server.

Answer

Ansible modules are written in Ruby.

Question 13

A system administrator notices that a service named 'myapp' fails to start on a Linux server. The command 'systemctl status myapp' shows 'Active: failed (Result: exit-code)'. Which of the following is the BEST first step to diagnose the issue?

Accepted Answer

Run 'journalctl -u myapp.service' to inspect the service logs.. The 'journalctl -u myapp.service' command retrieves the systemd journal logs specifically for the myapp service, which contain the service's stdout, stderr, and any error messages generated during its failed startup attempt. Since the service failed with an exit code, these logs are the most direct source of diagnostic information to identify why the process terminated abnormally.

Answer

Run 'dmesg' to view kernel messages.

Answer

Run 'ps aux | grep myapp' to check if the process is running.

Answer

Edit the service file with 'systemctl edit myapp' and increase timeout values.

Question 14

A user runs the ping command and receives the output shown in the exhibit. Which of the following is the MOST likely cause of the issue?

Accepted Answer

The TTL value in the ping packet is too low.. The output shows 'Request timed out' or similar, which can occur when the TTL (Time to Live) value in the ping packet expires before reaching the destination. A TTL that is too low causes routers to decrement the value to zero and drop the packet, sending an ICMP Time Exceeded message back to the sender, but if the sender does not receive a reply, it indicates the packet never reached the destination. This is the most likely cause because the ping command uses a default TTL (e.g., 128 on Windows, 64 on Linux), and if the path requires more hops, the packet is silently discarded.

Answer

The destination host is down.

Answer

The local system does not have a default gateway configured.

Answer

There is a routing loop causing packets to be dropped.

Question 15

A Linux administrator is troubleshooting a server that is running slowly. The 'sar -q' command shows a run queue length of 12 and a load average of 8.5. The CPU utilization is 90% idle. Which of the following is the most likely cause of the performance issue?

Accepted Answer

The disk I/O subsystem is a bottleneck, causing processes to wait for I/O.. The 'sar -q' output shows a high run queue length (12) and load average (8.5) despite 90% CPU idle. This indicates that processes are in an uninterruptible sleep state (D state) waiting for I/O, not contending for CPU. A disk I/O bottleneck causes processes to queue for I/O completion, inflating the load average while CPU remains idle, making D the correct answer.

Answer

The CPU is overloaded and needs to be upgraded.

Answer

The network interface is saturated.

Answer

The system is low on memory and swapping heavily.

Question 16

A technician needs to troubleshoot a network connectivity issue on a Linux server. The server can ping its own IP address but cannot ping the default gateway. Which of the following is the most likely cause?

Accepted Answer

The Ethernet cable is disconnected or the switch port is down.. Option D is correct because the server can ping its own IP address (loopback or local interface), confirming that the network stack is functioning and the interface is up. However, the inability to ping the default gateway indicates a Layer 1 or Layer 2 issue, such as a disconnected Ethernet cable or a switch port that is administratively down, which prevents any traffic from leaving the local subnet.

Answer

The default gateway is misconfigured in the routing table.

Answer

The DNS resolver is not configured correctly.

Answer

The iptables firewall is blocking outgoing ICMP traffic.

Question 17

A Linux administrator is troubleshooting a server that has become unresponsive. The administrator connects via IPMI and runs 'top' but the process list does not show any obvious CPU or memory hog. Which TWO commands could be used to identify I/O wait issues or disk bottlenecks? (Choose TWO.)

Accepted Answer

iostat -x 1. `iostat -x 1` provides extended disk I/O statistics, including `%util` (percentage of time the device was busy servicing requests) and `await` (average time for I/O operations). These metrics directly indicate disk bottlenecks and I/O wait issues. `iotop -o` displays only processes that are currently performing I/O operations, allowing the administrator to identify which specific processes are causing disk contention.

Answer

vmstat 1

Answer

sar -b 1

Answer

dstat --disk-util

Question 18

During a security audit, a Linux administrator finds that an unauthorized service is listening on TCP port 4444. The service is not managed by systemd. Which of the following commands should the administrator use to identify the process and disable it?

Accepted Answer

Run 'ss -tlnp | grep :4444' to find the PID, then use 'kill' to terminate the process.. Option A is correct because 'ss -tlnp' lists TCP listening sockets with numeric addresses and the associated process PID. Piping the output through 'grep :4444' isolates the unauthorized service, and the PID can then be used with 'kill' to terminate the process. Since the service is not managed by systemd, systemctl commands are irrelevant, making 'kill' the appropriate method to stop the process.

Answer

Run 'fuser 4444/tcp' to find the PID and then use 'systemctl stop' to stop the service.

Answer

Run 'lsof -i :4444' to find the PID, then use 'systemctl disable' to disable the service.

Answer

Run 'systemctl status' to find the service name, then use 'systemctl stop' to stop it.

Question 19

A Linux server is running low on disk space in the /var partition. The administrator runs 'du -sh /var/log/*' and finds that /var/log/syslog is 10 GB. Which of the following is the BEST long-term solution to prevent recurrence?

Accepted Answer

Configure logrotate to rotate and compress the syslog file daily.. Option C is correct because logrotate is the standard Linux utility for managing log file growth. By configuring logrotate to rotate and compress /var/log/syslog daily, the system automatically archives old logs and prevents a single file from consuming excessive disk space, addressing the root cause without manual intervention.

Answer

Manually truncate the syslog file with '> /var/log/syslog'.

Answer

Delete the syslog file and restart the syslog service.

Answer

Increase the log rotation frequency in /etc/logrotate.conf to monthly.

Question 20

A Linux administrator suspects a memory leak in a process. Which TWO commands can be used to monitor memory usage over time for a specific process? (Choose two.)

Accepted Answer

top. Option A (top) is correct because it provides a real-time, interactive view of system processes, including memory usage (RES, VIRT, %MEM) that updates by default every 3 seconds. You can filter by PID to monitor a specific process over time, making it ideal for detecting memory growth patterns indicative of a leak.

Answer

vmstat

Answer

iostat

Answer

free