XK0-006 Practice Exam 51 — 20 Questions

Question 1

A Linux server is experiencing intermittent network connectivity issues. The administrator needs to capture and analyze network traffic to diagnose the problem. Which TWO commands or tools can be used to capture packets on the eth0 interface? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

tcpdump -i eth0. tcpdump and tshark are both packet capture tools that can operate on a specified interface like eth0. They allow real-time capture and analysis of network traffic, which is essential for diagnosing intermittent connectivity issues. The other commands provide statistics or connection lists but do not capture packets.

Answer

netstat -i eth0

Answer

nmap -sP 192.168.1.0/24

Answer

ss -t -a

Question 2

A security administrator is hardening a Linux server and wants to verify that the SSH daemon is configured to disallow direct root logins. The administrator has already edited /etc/ssh/sshd_config and set PermitRootLogin no. Which command should the administrator run to ensure the SSH daemon reloads the configuration without terminating existing SSH sessions?

Accepted Answer

systemctl reload sshd. Reloading the sshd service with systemctl reload sshd causes the daemon to re-read its configuration file without dropping existing connections, which is ideal when applying changes like PermitRootLogin no. Testing the syntax with sshd -t is good practice beforehand, but it does not activate the new setting. Restarting would disrupt sessions, and direct kill is less reliable than the systemd-managed reload.

Answer

sshd -t

Answer

systemctl restart sshd

Answer

kill -HUP $(pidof sshd)

Question 3

A Linux administrator is troubleshooting a server that is unresponsive. They suspect a process is consuming excessive CPU. Which TWO commands can be used to identify the process with the highest CPU usage? (Choose two.)

Accepted Answer

ps aux --sort=-%cpu | head -n 5. To identify a process consuming excessive CPU, the administrator needs tools that display per-process CPU usage. `top` provides a real-time, sorted list of processes by CPU usage. `ps aux --sort=-%cpu | head -n 5` gives a snapshot of the top CPU-consuming processes. Other commands like `free`, `vmstat`, and `iostat` show system-wide metrics but not per-process details.

Answer

vmstat 1

Answer

free -m

Answer

iostat -c

Question 4

A Linux administrator is troubleshooting a system that becomes unresponsive under heavy load. They suspect that a process is causing excessive disk I/O. Which command should the administrator use to identify the process performing the most disk writes in real time?

Accepted Answer

iotop -o. To identify the process causing heavy disk writes in real time, the administrator needs a tool that shows per-process I/O activity. iotop -o displays only active I/O processes, sorted by I/O usage, making it easy to spot the culprit. While pidstat -d can also show per-process I/O, iotop is specifically designed for interactive real-time monitoring and is more commonly used for this scenario.

Answer

iostat -x 1

Answer

pidstat -d 1

Answer

vmstat 1

Question 5

An administrator notices that the /var partition on a production server is nearly full and wants to determine which subdirectories consume the most space before deleting anything. The administrator has root privileges and wants a human-readable summary of each immediate subdirectory under /var, one line per directory. Which command accomplishes this?

Accepted Answer

du -sh /var/*. To see which directories under /var consume the most space, du with -s and -h summarizes each argument passed via shell glob expansion, producing one human-readable line per immediate subdirectory. This gives an actionable ranking of space consumers. Filesystem-level tools like df and metadata listings like ls do not aggregate directory totals, so they cannot answer the question.

Answer

df -h /var

Answer

find /var -size +100M

Answer

ls -lhR /var

Question 6

An automation engineer uses Ansible to configure a fleet of Linux servers. A playbook task installs a package and then starts a service, but the service fails to start because the package installs a configuration file only on the first run. The engineer wants the handler to notify only when the package actually changes state. Which Ansible construct ensures the service restart handler fires only when the package task reports a change?

Accepted Answer

Use the `notify` directive on the package task referencing a handler that restarts the service.. Ansible handlers run only when notified by a task that reports `changed`, which is exactly the behavior needed to restart a service only when its package is actually installed or upgraded. The `notify` directive wires the package task to the handler, so idempotent runs that leave the package untouched do not trigger a restart, preventing unnecessary service interruptions across the managed fleet.

Answer

Set `run_once: true` on the service handler so it executes a single time per play.

Answer

Add `changed_when: true` to the package task to guarantee the handler always runs.

Answer

Use the `when: ansible_facts.pkg_mgr == 'apt'` conditional on the handler.

Question 7

A junior administrator runs `sudo useradd -m -s /bin/bash devops` on an Ubuntu 24.04 server, then immediately tries to SSH in as devops using a key that was copied to /home/devops/.ssh/authorized_keys. The login fails with 'Permission denied (publickey)'. The sshd_config has PubkeyAuthentication yes and PasswordAuthentication no. Which command is the most appropriate next step to resolve the login failure while preserving the intended account setup?

Accepted Answer

Run `sudo chown -R devops:devops /home/devops/.ssh && sudo chmod 700 /home/devops/.ssh && sudo chmod 600 /home/devops/.ssh/authorized_keys`.. When sudo is used to copy a public key into a user's home, the resulting authorized_keys and .ssh directory are typically owned by root and may be group- or world-writable. OpenSSH's StrictModes then refuses to use the key and reports 'Permission denied (publickey)'. Correcting ownership to the target user and setting directory mode 700 and file mode 600 satisfies StrictModes and restores key-based login without altering the account's shell or group membership.

Answer

Run `sudo passwd -u devops` to unlock the account, then retry SSH.

Answer

Append `AllowUsers devops` to /etc/ssh/sshd_config and reload sshd.

Answer

Regenerate the user's key pair with `ssh-keygen -t ed25519` and re-copy the public key.

Question 8

A security administrator needs to configure a Linux server so that all users must use a password of at least 12 characters and include at least one uppercase letter, one lowercase letter, one digit, and one special character. Which file should be edited to enforce these requirements?

Accepted Answer

/etc/security/pwquality.conf. Password complexity requirements are enforced by the pam_pwquality PAM module, which reads its settings from /etc/security/pwquality.conf. This file allows administrators to set minimum length and required character classes globally. Other files like login.defs or system-auth serve different purposes and do not contain the specific parameters for password composition.

Answer

/etc/login.defs

Answer

/etc/shadow

Answer

/etc/pam.d/system-auth

Question 9

A Linux administrator is troubleshooting a Bash script that must parse each line of a file named `servers.txt` and process fields separated by colons. The script currently uses `for line in $(cat servers.txt)` and breaks on lines containing spaces. Which construct should replace the loop to correctly iterate over lines while preserving whitespace?

Accepted Answer

while IFS= read -r line; do ... done < servers.txt. Reading lines reliably requires disabling word splitting and backslash processing with `IFS= read -r line`, and attaching the input redirection to the `while` loop so the loop does not run in a subshell. Piping into the loop loses variable state, command substitution splits on whitespace, and placing the redirection on the `read` command reopens the file on each iteration instead of advancing through it.

Answer

for line in $(< servers.txt); do ... done

Answer

cat servers.txt | while read line; do ... done

Answer

while read -r line < servers.txt; do ... done

Question 10

A user reports that they are unable to write to a USB drive mounted at /mnt/usb. The administrator checks the mount options and sees that the drive is mounted read-only. Which command should the administrator use to remount the filesystem as read-write without unmounting it?

Accepted Answer

mount -o remount,rw /mnt/usb. The administrator needs to change the mount options of a mounted filesystem from read-only to read-write without unmounting. The mount command with the remount option allows this. Specifying -o remount,rw along with the mount point performs the remount in place. This is efficient and avoids disruption to processes using the filesystem.

Answer

mount -o rw,remount /dev/sdb1

Answer

fsck -y /dev/sdb1 && mount -o remount,rw /mnt/usb

Answer

umount /mnt/usb && mount -o rw /dev/sdb1 /mnt/usb

Question 11

A Linux administrator needs to ensure that a custom application service, implemented as a oneshot systemd unit, runs only after the network is fully online and the /data filesystem is mounted. The unit file currently has no ordering directives. Which systemd directive should be added to the [Unit] section to define these ordering dependencies?

Accepted Answer

After=network-online.target data.mount. Ordering dependencies in systemd are expressed with After= or Before=. After= ensures that the units listed are fully activated before the service starts. While Requires= or Wants= pull units into the transaction, they do not delay activation. For a oneshot service that must wait for network-online.target and data.mount, After= is the correct directive to add to the [Unit] section.

Answer

Wants=network-online.target data.mount

Answer

Requires=network-online.target data.mount

Answer

Before=network-online.target data.mount

Question 12

A Linux administrator writes a Bash script that processes a list of hostnames read from a file and must continue processing remaining hosts even if an SSH command to one host fails. The script currently uses set -e and exits on the first failure. Which change allows the loop to keep running while still exiting on other unhandled errors?

Accepted Answer

Append || true to the SSH command inside the loop.. Bash's errexit option does not trigger on commands whose failure is consumed by a logical construct. Because the shell checks the exit status of the entire AND-OR list, appending || true to the SSH invocation means the list returns zero even when SSH fails, so the loop continues. Other commands in the script remain protected by set -e, preserving the desired fail-fast behavior elsewhere.

Answer

Wrap the SSH command in a subshell with parentheses.

Answer

Replace set -e with set +e globally.

Answer

Redirect stderr to /dev/null on the SSH command.

Question 13

A Linux administrator is troubleshooting a system that is running out of disk space on the root filesystem. The administrator needs to identify which directories are consuming the most space. Which TWO commands can be used to find the largest directories? (Choose two.)

Accepted Answer

ncdu /. The commands du -sh /* | sort -rh | head -n 10 and ncdu / are both effective for identifying the largest directories. The du pipeline provides a quick text-based summary, while ncdu offers an interactive interface for exploration. Both directly address the need to find space-consuming directories.

Answer

ls -lR /

Answer

df -h

Answer

find / -type d -size +100M

Question 14

A Linux administrator needs to ensure that user passwords meet a minimum length requirement of 12 characters. The system uses PAM and the pam_pwquality module. Which file should the administrator edit to set the minlen parameter?

Accepted Answer

/etc/security/pwquality.conf. The pam_pwquality module's parameters, including minlen, are configured in /etc/security/pwquality.conf. This centralized file is read by the module whenever a password is set or changed, provided the PAM stack includes pam_pwquality. Other files like login.defs may contain password aging settings but do not control PAM-based quality checks.

Answer

/etc/pam.d/system-auth

Answer

/etc/security/limits.conf

Answer

/etc/login.defs

Question 15

A Linux administrator needs a scheduled task to run a backup script at 02:30 every day of the week. The system uses cron, and the administrator is editing the crontab for the `backup` user. Which crontab entry accomplishes this?

Accepted Answer

30 2 * * * /usr/local/bin/backup.sh. A standard crontab line places minute first, then hour, day-of-month, month, and day-of-week. The requested 02:30 daily schedule requires minute 30 and hour 2 with asterisks in the remaining fields. Transposing the time fields, restricting the day of month, or leaving the minute as a wildcard all produce schedules that do not run the backup once daily at the intended time.

Answer

2 30 * * * /usr/local/bin/backup.sh

Answer

30 2 1 * * /usr/local/bin/backup.sh

Answer

* 2 * * * /usr/local/bin/backup.sh

Question 16

A Linux administrator is troubleshooting a server that has lost network connectivity. The administrator runs `ip a` and sees that the interface `ens33` is in the DOWN state and has no IP address assigned. The administrator wants to bring the interface up and assign it an IP address of 192.168.1.50/24. Which command should the administrator use?

Accepted Answer

ip link set ens33 up && ip addr add 192.168.1.50/24 dev ens33. To restore connectivity, the administrator must both bring the interface up and assign an IP address. The `ip link set ens33 up` command changes the administrative state to UP, and `ip addr add` assigns the address. Combining them ensures the interface is operational with the correct IP, which is the most direct solution.

Answer

ip addr add 192.168.1.50/24 dev ens33

Answer

ifconfig ens33 192.168.1.50 netmask 255.255.255.0 up

Answer

ip route add 192.168.1.0/24 dev ens33

Question 17

A Linux administrator is implementing mandatory access control using AppArmor on an Ubuntu server. A custom web application profile is loaded in enforce mode, but the application is failing to write to /var/log/myapp/. The administrator wants to temporarily switch the profile to complain mode to diagnose the issue without disabling AppArmor entirely. Which command should be used?

Accepted Answer

aa-complain /etc/apparmor.d/usr.bin.myapp. Switching an AppArmor profile to complain mode is done with aa-complain, which changes the profile's mode so that policy violations are logged rather than denied. This allows the application to function while capturing the necessary audit data to refine the profile. The other commands either unload the profile, disable it permanently, or merely display status, none of which achieve temporary diagnostic logging.

Answer

aa-disable /etc/apparmor.d/usr.bin.myapp

Answer

aa-status --enforce /etc/apparmor.d/usr.bin.myapp

Answer

apparmor_parser -R /etc/apparmor.d/usr.bin.myapp

Question 18

A Linux administrator needs to allow members of the group 'developers' to run all commands as root without being prompted for a password, but only from the host 'build01'. The administrator adds the following line to /etc/sudoers: '%developers build01=(ALL) NOPASSWD: ALL'. After saving, users report that sudo still prompts for a password on build01. Which command should the administrator run to verify the syntax and placement of the rule?

Accepted Answer

visudo -c. The correct command is visudo -c, which parses the sudoers file and reports syntax errors. Because the rule was added manually, a syntax mistake or misplacement could cause sudo to ignore it or fail. Validating with visudo -c ensures the file is well-formed before investigating effective privileges with sudo -l.

Answer

grep developers /etc/sudoers

Answer

sudo -l -U developer1

Answer

sudo -V

Question 19

A Linux administrator needs to ensure that a new service, myapp.service, starts automatically at boot and is currently running. The administrator runs 'systemctl enable --now myapp.service' and receives no errors, but after a reboot the service is not running. Which of the following is the most likely cause?

Accepted Answer

The service unit file is missing the [Install] section with WantedBy=multi-user.target.. The [Install] section defines how a unit integrates with systemd's boot targets. WantedBy=multi-user.target is what allows enable to create the symlink that pulls the service into the boot transaction. Without it, enable --now starts the unit but does not configure it for automatic startup, so after reboot the service remains inactive.

Answer

The systemctl daemon-reload command was not run after creating the unit file.

Answer

The service is masked by another unit with the same name in /etc/systemd/system.

Answer

The service was started with systemctl start instead of systemctl enable --now.

Question 20

A Linux administrator is using Git to manage a configuration repository. They need to undo a commit that has already been pushed to a shared remote repository, without rewriting history. Which command should they use?

Accepted Answer

git revert <commit>. To undo a commit that has already been pushed without rewriting history, `git revert` is the correct choice. It creates a new commit that reverses the changes, preserving the original commit in the history. This is safe for collaboration because it does not require force pushing. Other commands like `reset`, `commit --amend`, or `rebase` rewrite history and should be avoided in shared repositories.

Answer

git rebase -i <commit>

Answer

git reset --hard <commit>

Answer

git commit --amend