XK0-006 Practice Questions 2 — 50 Questions

Question 1

A Linux administrator needs to find large log files that may be consuming disk space. Which command should be used to locate files larger than 100MB in the /var/log directory?

Accepted Answer

find /var/log -type f -size +100M. The `find` command with `-type f` (regular files) and `-size +100M` (files larger than 100 megabytes) is the correct tool to locate large log files in /var/log. This directly meets the requirement to find files by size, unlike other commands that only show disk usage or directory listings without size filtering.

Answer

df -h

Answer

ls -lR /var/log

Answer

du -sh /var/log/*

Question 2

An administrator needs to add a script to be executed daily. The script is placed at /etc/cron.daily/myscript. After placing the script, it does not run. Based on the exhibit, what is the most likely issue?

Accepted Answer

The script is not executable. Scripts placed in /etc/cron.daily/ are executed by run-parts, which requires files to have the executable bit set. Without the execute permission (e.g., chmod +x), the script is skipped entirely, even if it is owned correctly and the cron daemon is active.

Answer

The script is owned by the wrong user

Answer

The cron daemon is not running

Answer

The script is not listed in /etc/crontab

Answer

Anacron is not installed

Question 3

A Linux administrator needs to add a new user named 'jdoe' with a home directory and default shell /bin/bash. Which command should be used?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command is used to create new users. The -m option creates the home directory, and -s sets the shell. usermod modifies existing users, passwd sets passwords, and chage manages password aging.

Answer

chage -m -s /bin/bash jdoe

Answer

passwd -m -s /bin/bash jdoe

Answer

usermod -m -s /bin/bash jdoe

Question 4

Which TWO tools are specifically designed to detect rootkits on a Linux system?

Accepted Answer

rkhunter. B is correct because rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors, and possible local exploits by comparing file hashes, checking for hidden processes, and analyzing system binaries for known rootkit signatures. It is specifically designed to detect rootkits on Linux systems.

Answer

lsof

Answer

netstat

Answer

clamav

Question 5

A system administrator notices that the /var partition is full, causing log services to malfunction. Which command should be used to quickly reclaim space by removing compressed old log files?

Accepted Answer

find /var/log -type f -name '*.gz' -delete. It uses `find` to locate all files ending in `.gz` under `/var/log` and deletes them with `-delete`. Compressed old log files are typically archived with gzip, so removing them directly reclaims disk space without affecting active logs or requiring additional tools.

Answer

journalctl --vacuum-size=100M

Answer

rm -rf /var/log/*.gz

Answer

logrotate -f

Question 6

An administrator wants to force a password change for user 'alice' on next login. Which command is appropriate?

Accepted Answer

passwd --expire alice. The correct command to force a password change on next login is `passwd --expire alice`. This immediately expires alice's password, requiring a change at next login. The other options are incorrect: `passwd -l` locks the account, `chage -l alice` lists account aging information without changing anything, and `usermod -f` sets the inactivity period.

Answer

passwd -l alice

Answer

chage -l alice

Answer

usermod -f alice

Question 7

Refer to the exhibit. What is the total amount of RAM installed on the system?

Accepted Answer

7.7G. The output of `free -h` shows the total memory in the 'total' column of the 'Mem:' row, which is 7.7G. This value represents the total physical RAM installed and available to the system, as reported by the kernel from the hardware.

Answer

7.5G

Answer

8.0G

Answer

0.1G

Question 8

Refer to the exhibit. A web application running under Apache cannot write to /var/log/app.log. The file has permissions 664 and is owned by apache. What is the correct action to allow writes while maintaining SELinux policies?

Accepted Answer

Change the SELinux context of the file to httpd_log_t.. The file /var/log/app.log has permissions 664 and is owned by apache, so the web server should be able to write to it. However, SELinux is blocking the write because the file's SELinux context does not match the type expected for files that Apache (httpd) is allowed to write to. Changing the SELinux context to httpd_log_t tells SELinux that this file is a log file that httpd can write to, which resolves the denial while keeping SELinux enforcing.

Answer

Change the ownership to root.

Answer

Set the httpd_can_network_connect boolean.

Answer

Disable SELinux for the httpd daemon.

Question 9

Which TWO commands can be used to immediately synchronize the system time with an NTP server, even if the time difference is large? (Choose two.)

Accepted Answer

ntpd -g. `ntpd -g` allows the NTP daemon to perform a one-time large time jump (even if the offset exceeds the default panic threshold of 1000 seconds) and then continue normal synchronization. Option E is correct because `ntpdate pool.ntp.org` immediately sets the system clock to the time returned by the NTP server, regardless of the current time difference, making it suitable for large corrections.

Answer

chronyd -q

Answer

systemctl restart ntp

Answer

timedatectl set-ntp true

Question 10

A junior administrator needs to view the logs of a running container named 'webapp'. Which command should be used?

Accepted Answer

docker logs webapp. The `docker logs webapp` command retrieves the stdout and stderr output streams from the container's main process, which is the standard way to view logs for a running or stopped container. This is the correct approach because Docker captures these streams and stores them in a JSON file on the host, accessible via the `docker logs` command.

Answer

docker attach webapp

Answer

docker inspect webapp

Answer

docker stats webapp

Question 11

Match each Linux filesystem to its typical use case.

Accepted Answer

ext4: General-purpose filesystem for Linux desktops and servers. Correct matches: ext4 for general use, XFS for large files, Btrfs for advanced features. Common confusions: swap vs tmpfs where swap is disk-based virtual memory and tmpfs is RAM-based temporary storage.

Answer

swap: Temporary filesystem stored in RAM

Answer

tmpfs: Space on disk used as virtual memory

Question 12

A system administrator notices that the root filesystem is at 95% capacity. Which command should be used to identify the directories consuming the most space?

Accepted Answer

du -sh /*. B is correct because `du -sh /*` calculates disk usage for each top-level directory under root, showing human-readable sizes. This directly identifies which directories consume the most space, allowing the administrator to pinpoint the source of the 95% capacity issue.

Answer

df -h

Answer

fdisk -l

Answer

ls -la /

Question 13

A user is unable to create new files in a directory. Which command can the administrator use to view the Access Control Lists (ACLs) associated with that directory?

Accepted Answer

getfacl. The `getfacl` command displays the Access Control Lists (ACLs) for a file or directory, showing both the standard POSIX permissions and any additional ACL entries (e.g., specific users or groups). Since the user cannot create new files, ACLs may be restricting write access beyond the basic mode bits, making `getfacl` the correct tool to inspect these extended permissions.

Answer

ls -l

Answer

setfacl

Answer

chmod

Question 14

Based on the exhibit, what is the most likely cause of the sshd service failure?

Accepted Answer

Another process is already listening on port 22. The sshd service failed because another process is already listening on port 22, which prevents sshd from binding to that port. This is indicated by the error message in the exhibit (e.g., 'bind: Address already in use'), which is a common symptom when a conflicting service or a previously running instance of sshd occupies the port. The system cannot start a new instance of sshd until the port is freed.

Answer

The firewall is blocking port 22

Answer

The sshd configuration file has incorrect permissions

Answer

The sshd service is not installed

Question 15

Refer to the exhibit. A system administrator notices that backend1.example.com is receiving significantly more traffic than the other two servers. What is the most likely reason?

Accepted Answer

Weighted load balancing distributes traffic proportionally; backend1 has the highest weight.. The upstream block uses weighted round-robin with weights 5, 3, and 2. The total weight is 10, so backend1 receives 5/10 = 50% of requests, backend2 receives 30%, and backend3 receives 20%. This distribution matches the observed pattern. Option A is incorrect because session persistence is not configured. Option C is incorrect because there is no health check mechanism shown. Option D is irrelevant as the proxy_next_upstream directive only affects retries on failure.

Answer

Session persistence (sticky sessions) is enabled, routing returning users to the same server.

Answer

backend1 is the only server that passes health checks.

Answer

The proxy_next_upstream directive causes requests to be retried on backend1 first.

Question 16

A system administrator needs to monitor file access attempts to /etc/shadow using auditd. Which auditctl command sets up the watch?

Accepted Answer

auditctl -w /etc/shadow -p wa -k shadow_watch. The correct syntax is 'auditctl -w /etc/shadow -p wa -k shadow_watch'. The -w specifies the file, -p wa watches for write and attribute changes (access is implied), but the -k is for a key. The other options have incorrect flags or order.

Answer

auditctl -a always,exit -F path=/etc/shadow -F perm=wa -k shadow_watch

Answer

auditctl -W /etc/shadow -p rwxa -k shadow_watch

Answer

auditctl -w /etc/shadow -k shadow_watch

Question 17

An administrator needs to schedule a backup script located at '/usr/local/bin/backup.sh' to run every Sunday at 2:30 AM. The server uses cron for task scheduling. The administrator currently has the following crontab entry: '30 2 * * 0 /usr/local/bin/backup.sh'. However, the administrator wants to verify that the cron job is configured correctly and will run as expected. Which of the following commands should the administrator use to list the current user's cron jobs and verify the entry?

Accepted Answer

crontab -l. The 'crontab -l' command lists the current user's crontab entries. Option D is correct. 'cron -l' is not a valid command. 'cat /var/spool/cron/crontabs/root' might work for root but not for a regular user, and the path varies. 'systemctl status cron' shows the cron service status, not the job list.

Answer

cat /var/spool/cron/crontabs/root

Answer

systemctl status cron

Answer

cron -l

Question 18

Which THREE statements about Ansible are true? (Choose three.)

Accepted Answer

Ansible playbooks are written in YAML. Three statements about Ansible are true. Playbooks are written in YAML (A). Ansible is idempotent, meaning that applying the same configuration multiple times yields the same result (D). Additionally, Ansible requires Python on the control node only (C) because the control node runs the automation; managed nodes can be contacted via SSH or WinRM and may use raw modules that don't require Python, though most modules do expect Python on the managed node. Statement B is false because Ansible is agentless and does not use a centralized master server; it uses a push model from a control node. Statement E is false because Ansible is agentless—no agent is installed on managed nodes.

Answer

Ansible uses a centralized master server

Answer

Ansible requires an agent to be installed on managed nodes

Question 19

A server is experiencing high CPU load. The administrator needs to identify which process is consuming the most CPU resources in real time. Which command should be used?

Accepted Answer

top. The `top` command provides a real-time, dynamic view of running processes, including CPU usage, and updates continuously by default. It is the standard tool for identifying which process is currently consuming the most CPU resources on a Linux system.

Answer

w

Answer

vmstat

Answer

uptime

Answer

ps aux --sort=-%cpu

Question 20

During the boot process, after the kernel is loaded and the initramfs is executed, which component is responsible for starting the user-space services and managing the system state?

Accepted Answer

systemd. Systemd is the init system that starts services and manages targets. GRUB2 is the bootloader that loads the kernel. The kernel itself initializes hardware. Initramfs is an initial root filesystem used to load drivers.

Answer

initramfs

Answer

GRUB2

Answer

Kernel