XK0-006 Practice Exam 52 — 20 Questions

Question 1

A security administrator is hardening a Linux web server and wants to reduce the attack surface of the SSH service. Which TWO actions should be taken in /etc/ssh/sshd_config to restrict access and authentication? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set PermitRootLogin to no. Disabling root login and password authentication are two widely recommended SSH hardening measures. They force administrators to use named accounts and key-based authentication, reducing the effectiveness of brute-force and credential-stuffing attacks. The other listed changes either increase exposure or weaken authentication controls, so they do not support the goal of reducing the SSH attack surface.

Answer

Set MaxAuthTries to 10

Answer

Set UsePAM to no

Answer

Set X11Forwarding to yes

Question 2

A Linux administrator needs to permanently set the system-wide umask to 027 for all users on a production server. The administrator edits /etc/profile and adds the line 'umask 027'. After rebooting, a user logs in and runs 'umask', which returns 0022. Which of the following is the most likely reason the setting did not take effect?

Accepted Answer

The user's shell configuration file, such as ~/.bashrc or ~/.profile, overrides the umask set in /etc/profile.. The umask is set per process and inherited. System-wide defaults in /etc/profile apply to login shells, but user-specific files like ~/.bashrc or ~/.profile are sourced later and can override the umask. Since the user's umask returned 0022, it indicates a user-level configuration is taking precedence. To enforce a system-wide umask, administrators must ensure user files do not override it or use mechanisms like pam_umask.

Answer

The umask command must be run with sudo to affect all users.

Answer

The umask value must be set in /etc/login.defs to apply system-wide.

Answer

The system needs to be rebooted for changes to /etc/profile to take effect.

Question 3

A Linux administrator notices that a server's clock is drifting and NTP synchronization is failing. The administrator runs 'chronyc sources' and sees that all sources are marked with a '?' character. Which command should be run next to diagnose why chronyd cannot reach the NTP servers?

Accepted Answer

chronyc ntpdata. The '?' character in chronyc sources means the source is unreachable or has not provided a valid packet. To diagnose why, chronyc ntpdata shows per-source packet details, including whether NTP requests are being sent and responses received. This helps identify network blocks, incorrect server addresses, or firewall rules. Other chronyc subcommands like tracking, activity, and sourcestats do not provide the packet-level view needed for this specific failure.

Answer

chronyc tracking

Answer

chronyc activity

Answer

chronyc sourcestats

Question 4

A Linux server hosts a payroll database. The security policy states that the file /srv/payroll/ledger.db must be readable and writable only by members of the group payroll, and that no other user on the system may read it, even root. Which approach satisfies the requirement that even root cannot read the file contents?

Accepted Answer

Encrypt the file with a tool such as gpg or openssl enc using a key that is never stored on the server.. Traditional Unix permissions, including restrictive modes and special attributes, are enforced by the kernel, and root is deliberately exempt from those checks. The only way to guarantee that even root cannot read a file's contents is to encrypt it and keep the decryption key off the server, shifting enforcement from the permission model to cryptography that root cannot bypass.

Answer

Set the file mode to 0660 and change its group owner to payroll.

Answer

Place the file on a filesystem mounted with the noexec and nodev options.

Answer

Apply the immutable attribute to the file with chattr +i /srv/payroll/ledger.db.

Question 5

A Linux administrator needs to create a new user account 'analyst' with a home directory at /home/analyst and the default shell set to /bin/bash. The user should also be added to the existing supplementary group 'research'. Which command will accomplish this in a single step?

Accepted Answer

useradd -m -s /bin/bash -G research analyst. The useradd command with -m creates the home directory, -s specifies the shell, and -G adds the user to supplementary groups. This single command meets all specified conditions without extra steps, making it the correct solution.

Answer

groupadd research && useradd -m -s /bin/bash -g research analyst

Answer

usermod -m -s /bin/bash -G research analyst

Answer

adduser analyst -m -s /bin/bash -g research

Question 6

A Linux administrator is writing a Bash script that must safely process a list of filenames, some of which may contain spaces or special characters. The script reads each line from a file into a variable and then iterates over the entries. Which TWO practices should the administrator follow to avoid word-splitting and globbing issues? (Choose two.)

Accepted Answer

Quote the variable expansion, for example "$filename", whenever it is used in commands.. To safely handle filenames with spaces or special characters, the script should quote variable expansions so the shell treats each value as a single argument, and read lines with IFS= read -r to preserve whitespace and backslashes. These two practices together prevent word splitting and globbing from corrupting the data during iteration.

Answer

Disable globbing by running set -f at the start of the script and never re-enable it.

Answer

Set the IFS variable to a newline character globally at the top of the script before any commands run.

Answer

Use the eval command to expand the variable so that spaces are handled automatically.

Question 7

A Linux administrator is reviewing an Ansible playbook that manages a fleet of servers. The playbook must run a task only on hosts in the group webservers and must notify a handler when a configuration file changes. Which TWO of the following are valid Ansible constructs that the administrator should use? (Choose two.)

Accepted Answer

notify: restart nginx. The hosts directive scopes the play to the webservers inventory group, and the notify keyword on a task causes a named handler to run when that task changes state. Together they ensure the play runs only on the intended hosts and that a service restart handler fires only when the configuration file is modified.

Answer

serial: 1

Answer

when: ansible_os_family == "Debian"

Answer

become: yes

Question 8

Users report that a web application on a Linux server is unreachable from external clients. From the server itself, curl http://localhost works fine. The administrator wants to confirm whether the service is bound only to the loopback interface. Which command should the administrator run?

Accepted Answer

ss -tlnp. The symptom pattern, local success plus remote failure, often means the daemon is bound to 127.0.0.1 rather than all interfaces. ss -tlnp displays each listening TCP socket's local address and process, making the bind scope explicit. Routing, loopback scanning, and loopback capture all miss the actual socket configuration.

Answer

nmap -p 80 localhost

Answer

ip route show

Answer

tcpdump -i lo port 80

Question 9

A Linux administrator needs to inspect the capabilities assigned to the /usr/bin/ping binary to verify it can open raw sockets without being setuid root. Which command should be used?

Accepted Answer

getcap /usr/bin/ping. File capabilities allow a binary to perform privileged operations without being setuid root. The getcap command reads the security.capability extended attribute and reports capabilities such as cap_net_raw. Inspecting /usr/bin/ping with getcap confirms whether it can open raw sockets under least privilege, which is the goal of the administrator's verification.

Answer

chacl -l /usr/bin/ping

Answer

getfacl /usr/bin/ping

Answer

lsattr /usr/bin/ping

Question 10

A Linux server is experiencing intermittent network connectivity issues. The administrator suspects that the network interface is dropping packets due to a duplex mismatch. Which command should be used to check the duplex setting and link status of the interface?

Accepted Answer

ethtool eth0. The ethtool command is the standard tool for querying and modifying Ethernet device settings, including duplex and speed. It directly reports the negotiated duplex mode, allowing the administrator to verify if the interface is operating at half duplex when it should be full duplex. Other commands like ifconfig or ip link do not expose duplex information, and netstat only shows statistics, not configuration.

Answer

ifconfig eth0

Answer

ip link show eth0

Answer

netstat -i

Question 11

A Linux administrator is debugging a Bash script that uses a function to set a global counter. The function increments the variable, but after the function returns, the counter retains its original value. The script does not use subshells or pipelines around the function call. Which of the following is the MOST likely cause?

Accepted Answer

The variable was declared with the local keyword inside the function, creating a function-scoped copy that shadows the global variable.. The local keyword inside a function creates a function-scoped variable that shadows any global variable of the same name. Assignments inside the function affect only the local copy, which disappears when the function returns, so the global counter appears unchanged. Removing the local declaration allows the function to modify the global variable directly.

Answer

The counter variable was exported with export, which makes it read-only inside functions.

Answer

The function was defined with the function keyword instead of the POSIX name() syntax, which isolates its variables.

Answer

The script lacks a shebang line, so Bash runs it in POSIX mode where functions cannot modify global variables.

Question 12

An administrator is writing a Bash script that must run a cleanup function when the script exits, whether it finishes normally or is interrupted. Which construct guarantees the function runs in both cases?

Accepted Answer

trap 'cleanup' EXIT. The trap facility lets a script associate a handler with a signal or with the EXIT pseudo-signal, which the shell raises on every termination path. Using trap 'cleanup' EXIT ensures the teardown function executes after normal completion and after interrupts, unlike aliases, backgrounding, or plain sequential execution, which have no exit semantics.

Answer

cleanup &

Answer

set -e; cleanup

Answer

alias cleanup='rm -rf /tmp/work'

Question 13

A Linux administrator is writing a Bash automation script that must continue processing the remaining entries in a loop even when an individual command returns a non-zero exit status. The script currently starts with `#!/bin/bash` and uses `set -e` for safety elsewhere. Which construct should the administrator use to run a command whose failure must be tolerated inside the loop?

Accepted Answer

Append `|| true` to the command so its non-zero exit status is masked.. With `set -e` active, any simple command returning non-zero aborts the script unless its status is part of a condition or OR list. Appending `|| true` makes the overall list succeed, so the loop advances while errexit remains enabled for everything else. This preserves the safety net for unforeseen failures while deliberately tolerating the one command expected to fail.

Answer

Run the loop body inside a subshell wrapped with `set +e` before and after the command.

Answer

Prefix the command with `env -i` to isolate its environment and prevent exit propagation.

Answer

Redirect the command's stderr to `/dev/null` to prevent the shell from seeing the failure.

Question 14

After adding a new static route to a server, an administrator notices that traffic to 10.20.0.0/16 still leaves through the default gateway. The route appears in 'ip route' output but is not used. The administrator confirms the interface is up. Which command should be run to verify that the kernel is selecting the intended route for that destination?

Accepted Answer

ip route get 10.20.5.10. The kernel consults the routing table using longest-prefix match, so a more specific static route should normally beat the default gateway. When behavior disagrees with the table, the fastest way to see the actual decision is a route lookup for a representative address with ip route get. It reports the chosen interface, gateway, and preferred source, exposing whether a conflicting or less-specific entry is winning.

Answer

ip neigh show

Answer

ip addr show

Answer

ss -rn

Question 15

A junior administrator needs to add a persistent mount entry for a new XFS filesystem on /dev/sdb1 at the /data directory so it is mounted automatically at every boot. The administrator opens /etc/fstab and must identify the correct field order for the entry. Which field order should be used in the /etc/fstab line?

Accepted Answer

device, mount point, filesystem type, mount options, dump, fsck pass. The /etc/fstab format is strictly positional: source device, mount point, filesystem type, options, dump flag, and fsck pass. For an XFS volume on /dev/sdb1 mounted at /data, the entry must follow that order so systemd and mount can resolve the device and target correctly and apply options such as defaults or noatime. Misordering any field prevents the persistent mount from working at boot.

Answer

mount point, device, filesystem type, dump, mount options, fsck pass

Answer

UUID, filesystem type, mount options, mount point, dump, fsck pass

Answer

device, filesystem type, mount point, fsck pass, dump, mount options

Question 16

A Linux administrator is writing a Bash script that must read a file line by line and preserve leading whitespace in each line. The script currently uses `for line in $(cat file.txt)`. Which construct should replace the current loop to preserve whitespace and avoid word splitting?

Accepted Answer

while IFS= read -r line; do ... done < file.txt. Reading a file line by line while preserving whitespace requires disabling field splitting with IFS= and preventing backslash processing with read -r, and the input must be redirected into the loop rather than piped so the loop runs in the current shell. The quoted command substitution approach collapses the file into one value, and the default read behavior strips leading whitespace.

Answer

cat file.txt | while read -r line; do ... done

Answer

for line in "$(cat file.txt)"; do ... done

Answer

while read line; do ... done < <(cat file.txt)

Question 17

A Linux administrator needs to configure the system so that all users must use a minimum password length of 12 characters. The administrator edits /etc/security/pwquality.conf. Which line should be added or modified to enforce this requirement?

Accepted Answer

minlen = 12. The pwquality.conf file uses the minlen directive to set the minimum password length. Adding minlen = 12 ensures that the pam_pwquality module enforces a 12-character minimum for new passwords, provided the module is enabled in the PAM configuration.

Answer

password requisite pam_pwquality.so minlen=12

Answer

min_password_length = 12

Answer

PASS_MIN_LEN 12

Question 18

A Linux administrator needs to schedule a script at /opt/scripts/report.sh to run every Monday at 02:30 for the user svcacct, without editing the system-wide /etc/crontab. Which cron entry correctly accomplishes this when placed in svcacct's crontab via crontab -e?

Accepted Answer

30 2 * * 1 /opt/scripts/report.sh. Cron's five fields are minute, hour, day of month, month, and day of week, in that order. The requirement of Monday at 02:30 maps to minute 30, hour 2, wildcard day of month, wildcard month, and day-of-week 1 for Monday. Placing the entry in svcacct's own crontab via crontab -e means it executes as that user without needing a username field or touching /etc/crontab.

Answer

2 30 * * 1 /opt/scripts/report.sh

Answer

30 2 * * 0 /opt/scripts/report.sh

Answer

30 2 1 * * /opt/scripts/report.sh

Question 19

A user reports that they cannot run the command `sudo` to perform administrative tasks. The administrator checks and finds that the user is not listed in the `/etc/sudoers` file. Which command should the administrator use to safely edit the sudoers file and add the user?

Accepted Answer

visudo. Using `visudo` is the correct approach because it provides a safe editing environment with syntax validation and file locking. Directly editing the sudoers file or appending to it can introduce errors that break sudo. Adding a user to a group like sudo is an alternative but does not address the specific need to edit the sudoers file safely.

Answer

echo 'username ALL=(ALL) ALL' >> /etc/sudoers

Answer

usermod -aG sudo username

Answer

nano /etc/sudoers

Question 20

A Linux server intermittently loses its default route after several hours of uptime, and users cannot reach external networks until the route is manually restored. The administrator suspects that a second default route is being installed and removed by a network management daemon. Which command should the administrator use to monitor route changes in real time?

Accepted Answer

ip monitor route. Intermittent route loss requires observing events as they happen rather than sampling the table. ip monitor route taps the kernel's routing netlink multicast group and prints each add, delete, and change with details, so the flapping default route and its timing become visible. A one-time table dump, interface counters, and indirect daemon logs cannot provide that event stream.

Answer

ip route show table main

Answer

ip -s link show

Answer

journalctl -u NetworkManager --since "1 hour ago"