XK0-006 Practice Exam 52 — 20 Questions

Question 1

A technician notices that a user can execute a binary with elevated privileges even though the user is not in the sudoers file. The binary has the SUID bit set. Which command would remove the SUID bit from the binary?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

chmod u-s /path/to/binary. `chmod u-s /path/to/binary` is the direct command to remove the SUID bit from the file. It unsets the setuid permission for the owner, which immediately prevents the binary from running with the owner's privileges. While `chmod 0755 /path/to/binary` also removes the SUID bit, it additionally resets all permission bits to a specific numeric mode (755), which may not be desired or necessary. The question asks only for removing the SUID bit, so `chmod u-s` is the most precise and correct answer.

Answer

chmod g-s /path/to/binary

Answer

chmod o-s /path/to/binary

Answer

chmod 0755 /path/to/binary

Question 2

A Linux administrator is troubleshooting a service that fails to start. Which TWO commands can be used to view the last 20 lines of the systemd journal for the sshd unit?

Accepted Answer

journalctl -u sshd -n 20. journalctl -u sshd -n 20 shows last 20 lines for the unit. journalctl -u sshd | tail -20 also works. The others use wrong options or units.

Answer

journalctl -k -n 20

Answer

journalctl -u sshd -p err

Answer

journalctl -b -u sshd

Question 3

Match each Linux process signal to its typical action.

Accepted Answer

SIGTERM: Terminates process with cleanup. Common Linux signals include SIGTERM (graceful termination), SIGKILL (force kill), and SIGINT (interrupt via Ctrl+C). Confusions often arise between SIGTERM and SIGKILL, and between SIGINT and SIGKILL.

Answer

SIGTERM: Immediately terminates process without cleanup

Answer

SIGKILL: Interrupts process (Ctrl+C)

Question 4

Refer to the exhibit. A user wants to execute the script 'script.sh' but receives a 'Permission denied' error. Which action should be taken to allow execution?

Accepted Answer

Add execute permission with chmod +x script.sh. The 'Permission denied' error indicates the script lacks the execute permission for the user. The `chmod +x script.sh` command adds the execute permission bit to the file's mode, allowing the user to run it as a program. This is the direct and correct fix for the issue.

Answer

Change the owner to the user with chown

Answer

Change the group to the user's primary group

Answer

Set the permissions to 644 with chmod

Question 5

A Linux system fails to boot, displaying a 'kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' error. Which of the following is the most likely cause?

Accepted Answer

Corrupted initramfs. This error indicates the kernel cannot find the root filesystem, often due to a missing driver or incorrect root= parameter in the boot configuration.

Answer

Incorrect /etc/fstab entry

Answer

Full disk on /boot

Answer

Misconfigured GRUB timeout

Question 6

After editing the network configuration file /etc/sysconfig/network-scripts/ifcfg-ens33 on a CentOS system, the network service fails to restart with an error message. Which command should be used to display detailed error messages from the network service?

Accepted Answer

systemctl status network. The `systemctl status network` command is the correct tool to display detailed error messages from the network service because it shows the current status, recent log entries, and any failure messages from the systemd unit managing the network service. On CentOS, network services are controlled by systemd, and `systemctl status` directly queries the unit's state and journal for errors, making it the most straightforward diagnostic command after a restart failure.

Answer

ip link

Answer

journalctl -u network

Answer

ifconfig

Question 7

A Linux system fails to boot with the error 'No bootable device found'. Which two troubleshooting steps should be taken? (Select TWO).

Accepted Answer

Verify the GRUB configuration. The error 'No bootable device found' indicates that the system's BIOS/UEFI cannot locate a valid bootloader or operating system on any available storage device. Verifying the boot order in BIOS/UEFI (Option E) ensures that the correct disk is set as the first boot device, which is a common cause of this error. Checking the GRUB configuration (Option D) is also critical because if GRUB is missing, corrupted, or misconfigured, the system will not find a bootable kernel, even if the disk is correctly detected.

Answer

Check the SATA cable connections

Answer

Reinstall the kernel

Answer

Run fsck on the root filesystem

Question 8

An administrator needs to harden SSH access. Which TWO settings in /etc/ssh/sshd_config are recommended to improve security? (Choose two.)

Accepted Answer

PermitRootLogin no. Setting `PermitRootLogin no` disables direct root login via SSH, forcing administrators to log in as a regular user and then use `su` or `sudo` for privileged commands. This prevents attackers from targeting the root account directly and ensures all root-level actions are logged under the individual user's session. Option D is correct because setting `PasswordAuthentication no` disables password-based authentication, requiring the use of SSH key pairs, which are resistant to brute-force attacks and credential stuffing.

Answer

PermitRootLogin yes

Answer

Protocol 1

Answer

Port 22

Question 9

A service called 'myapp' fails to start automatically after a system reboot. The administrator wants to ensure the service starts at boot. Which systemctl command should be used?

Accepted Answer

systemctl enable myapp. The `systemctl enable myapp` command creates the necessary symlinks in the systemd unit configuration directories (typically `/etc/systemd/system/multi-user.target.wants/`) so that the `myapp` service is automatically started at boot. This is the correct approach because the question specifically asks to ensure the service starts after a reboot, not to start it immediately.

Answer

systemctl daemon-reload

Answer

systemctl start myapp

Answer

systemctl reenable myapp

Question 10

A developer wants to run a containerized application using Podman in a rootless environment. Which of the following is a key difference between Podman and Docker that the developer should be aware of?

Accepted Answer

Podman can run containers without a daemon. Podman supports rootless containers natively without requiring a daemon, unlike Docker which traditionally requires a daemon (dockerd) running as root.

Answer

Podman requires a daemon to manage containers

Answer

Podman only supports rootful containers

Answer

Podman uses a different CLI syntax than Docker

Question 11

A systems administrator needs to restrict SSH access to a Linux server so that only users in the 'sshusers' group can log in. Which configuration change should be made in /etc/ssh/sshd_config?

Accepted Answer

Add 'AllowGroups sshusers'. The 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH login to only users who are members of the specified group. By adding 'AllowGroups sshusers', only users in the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This is the standard OpenSSH mechanism for group-based access control.

Answer

Add 'AllowUsers sshusers'

Answer

Add 'DenyGroups all'

Answer

Add 'PermitRootLogin no' and add users to sshusers

Question 12

Which THREE conditions must be met for a Linux container to run with user namespaces enabled? (Choose three.)

Accepted Answer

The container runtime must be configured to use user namespaces.. User namespaces must be explicitly enabled in the container runtime configuration (e.g., `--userns=host` or `userns-remap` in Docker/Podman) to isolate the container's UID/GID mappings from the host. Without this configuration, the container will run in the default host namespace, negating the security benefits of user namespaces.

Answer

The container image must have a user with UID 0.

Answer

The container must be started with root privileges.

Question 13

A system administrator is troubleshooting a DNS resolution issue. The command `dig example.com` returns a response, but `ping example.com` fails with 'ping: example.com: Name or service not known'. Which of the following is the most likely cause?

Accepted Answer

The system resolver is using different DNS servers than dig. The `dig` command bypasses the system resolver and queries the DNS server directly, so it can resolve the name even if the resolver is misconfigured. `ping` uses the system resolver (glibc's `gethostbyname` or `getaddrinfo`), which may be configured to use different DNS servers (e.g., via NetworkManager, systemd-resolved, or a local caching resolver). This mismatch causes `ping` to fail while `dig` succeeds.

Answer

An incorrect entry in /etc/hosts

Answer

The Name Service Cache Daemon (nscd) is not running

Answer

The DNS server is not configured in /etc/resolv.conf

Answer

A firewall is blocking ICMP packets

Question 14

A developer writes a Dockerfile that installs multiple packages. To reduce the final image size, which of the following practices is most effective?

Accepted Answer

Combine multiple RUN commands into a single RUN instruction.. Combining multiple RUN commands into a single RUN instruction reduces the number of layers created in the Docker image. Each RUN instruction creates a new layer, and by merging them, you avoid storing intermediate files (e.g., package cache) across separate layers, which significantly shrinks the final image size. This is a direct and effective method for minimizing image footprint when installing multiple packages.

Answer

Use a multi-stage build.

Answer

Use apt-get clean after each installation.

Answer

Use a minimal base image like alpine.

Question 15

A Linux administrator is writing a bash script that accepts command-line options: -a for all, -f for file, and -o for output. Which of the following correctly uses getopts to parse these options?

Accepted Answer

while getopts "afo" opt; do case $opt in a) ...;; f) ...;; o) ...;; esac; done. getopts uses a string of option characters; a colon after an option indicates it requires an argument. The correct usage is 'a:f:o' where a and f require arguments, but the stem doesn't specify arguments. Assuming -a and -f don't require arguments, the string should be 'afo'.

Answer

while getopts "-a -f -o" opt; do ... done

Answer

while getopts "a:f:o" opt; do case $opt in a) ...;; f) ...;; o) ...;; esac; done

Answer

getopts "afo" opt; case $opt in a) ...;; f) ...;; o) ...;; esac

Question 16

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The pipeline should build a Docker image, run unit tests, and if successful, push the image to a private registry. Which tool is best suited for orchestrating this pipeline?

Accepted Answer

Jenkins. Jenkins is a widely adopted CI/CD automation server that excels at orchestrating complex pipelines, including building Docker images, running unit tests, and pushing images to a private registry. Its pipeline-as-code feature (Jenkinsfile) allows defining stages, triggers, and post-build actions, making it the best fit for this microservices CI/CD workflow.

Answer

Git

Answer

cron

Answer

Ansible

Question 17

A technician is troubleshooting a service that fails to start. The service file is located in /usr/lib/systemd/system. Which THREE commands can be used to investigate the service's status and logs? (Choose three.)

Accepted Answer

journalctl -u servicename. systemctl status shows service status; journalctl -u shows logs for the unit; journalctl -f follows new log entries. systemctl start attempts to start but not investigate; systemctl enable enables at boot.

Answer

systemctl enable servicename

Answer

systemctl start servicename

Question 18

Drag and drop the steps to set up a cron job that runs a script daily in the correct order.

Accepted Answer

Write the script, then make it executable, then add a crontab entry with daily schedule, then verify with crontab -l. Setting up a cron job correctly involves first writing the script that will be executed, then making it executable with chmod +x, then adding a crontab entry using crontab -e with the correct time specification (e.g., '0 0 * * *' for daily at midnight), and finally verifying the job is listed with crontab -l. This order ensures the script is ready and permissions are set before cron attempts to run it, and verification confirms the entry is valid.

Answer

Write the script, then add a crontab entry with daily schedule, then make it executable, then verify with crontab -l

Answer

Make the script executable, then write the script, then add a crontab entry, then verify with crontab -l

Answer

Add a crontab entry with daily schedule, then write the script, then make it executable, then verify with crontab -l

Question 19

A Linux administrator wants to view all listening TCP ports and the associated processes on a system. Which command should be used?

Accepted Answer

ss -tlnp. The `ss -tlnp` command is correct because it displays all TCP listening sockets (`-t` for TCP, `-l` for listening) with numeric addresses (`-n`) and shows the associated process information (`-p`). This is the modern replacement for `netstat` and is the recommended tool on current Linux distributions for socket statistics.

Answer

lsof -i TCP

Answer

netstat -tulpn

Answer

nmap -sT localhost

Question 20

A server is experiencing intermittent network connectivity issues. The administrator wants to run a continuous test that combines ping and traceroute to monitor the path and packet loss to a target host. Which command should be used?

Accepted Answer

mtr target. mtr combines ping and traceroute functionality, continuously showing each hop and packet loss statistics.

Answer

tcpdump -i any host target

Answer

ping -f target

Answer

traceroute -n target