XK0-006 Practice Exam 53 — 20 Questions

Question 1

A Linux administrator needs to locate all files in the /var directory that have been modified within the last 30 minutes and are larger than 10MB. Which command accomplishes this task?

Accepted Answer

find /var -mmin -30 -size +10M. The find command with -mmin and -size options can locate files based on modification time and size. -mmin -30 finds files modified less than 30 minutes ago, and -size +10M finds files larger than 10MB.

Answer

find /var -mmin 30 -size +10M

Answer

locate /var -mmin -30 -size +10M

Answer

find /var -mtime -30 -size +10M

Question 2

Which three directories are required by the FHS to be present on a Linux system? (Select THREE.)

Accepted Answer

/bin. /bin, /etc, and /dev are essential FHS directories. /opt is optional, /proc is a virtual filesystem, /mnt is for temporary mounts but not always present.

Answer

/proc

Answer

/opt

Question 3

A Linux administrator is troubleshooting a DNS resolution issue. The system uses /etc/resolv.conf. Which two of the following directives are commonly found in this file? (Choose two.)

Accepted Answer

nameserver 8.8.8.8. /etc/resolv.conf typically contains nameserver entries and optionally search and domain directives.

Answer

domain localdomain

Answer

options timeout:2

Answer

hosts: files dns

Question 4

A server is secured with SELinux in enforcing mode. A custom web application needs to write logs to /var/log/webapp. The SELinux type for httpd is httpd_t. Which command sets the correct context for the log directory?

Accepted Answer

semanage fcontext -a -t httpd_log_t "/var/log/webapp(/.*)?" && restorecon -Rv /var/log/webapp. It uses `semanage fcontext` to add a persistent file context rule that assigns the `httpd_log_t` type to the `/var/log/webapp` directory and its contents, then applies it with `restorecon`. The `httpd_log_t` type is specifically designed for log files written by the httpd process, allowing Apache (running as `httpd_t`) to write logs while maintaining SELinux enforcement.

Answer

chcon -t httpd_sys_content_t /var/log/webapp

Answer

setsebool -P httpd_enable_homedirs on

Answer

chcon -t httpd_t /var/log/webapp

Question 5

A Linux administrator needs to locate all files in the /var directory that have been modified within the last 30 minutes and are larger than 10MB. Which command accomplishes this task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

find /etc -mtime 0 -not -user root. find with -mtime 0 finds files modified in the last 24 hours; -not -user root excludes root-owned files. The -exec option executes ls -l to list details.

Answer

find /etc -ctime 0 -not -group root

Answer

find /etc -mtime 0 -uid 0

Answer

find /etc -atime 0 -not -user root

Question 6

An administrator adds a new disk /dev/sdc1 and wants it mounted at /mnt/backup at every boot. Based on the exhibit, which line should be added to /etc/fstab?

Accepted Answer

UUID=xyz789 /mnt/backup ext4 defaults 0 0. /etc/fstab entries should use UUIDs for persistent device identification, and the mount point must exactly match the intended directory /mnt/backup. The 'defaults' option and '0 0' (no dump, no fsck) are appropriate for a non-root filesystem that does not require boot-time checking.

Answer

UUID=xyz789 /backup ext4 defaults 0 0

Answer

UUID=xyz789 /mnt/backup ext4 nofail 0 0

Answer

/dev/sdc1 /mnt/backup ext4 defaults 0 2

Answer

/dev/sdc1 /mnt/backup ext4 defaults 0 0

Question 7

A Bash script uses getopts to parse command-line options. The options are -a (requires an argument) and -b (flag). Which code correctly implements this and stores the argument for -a in $optarg?

Accepted Answer

while getopts 'a:b' opt; do
  case $opt in
    a) arg=$OPTARG ;;
    b) flag=true ;;
  esac
done. getopts uses the option string 'a:b' where 'a:' indicates -a requires an argument. The argument is stored in the variable $OPTARG (not $optarg).

Answer

while getopts 'ab:' opt; do
  case $opt in
    a) arg=$OPTARG ;;
    b) flag=true ;;
  esac
done

Answer

while getopts 'a:b' opt; do
  case $opt in
    a) arg=$optarg ;;
    b) flag=true ;;
  esac
done

Answer

while getopts ':a:b' opt; do
  case $opt in
    a) arg=$OPTARG ;;
    b) flag=true ;;
  esac
done

Question 8

In the exhibit, what does 'Tasks: 11 (limit: 512)' indicate?

Accepted Answer

The cgroup pids controller is limiting the number of processes/threads.. The output shown is from the `systemd-cgls` command, which displays cgroup (control group) information. The line `Tasks: 11 (limit: 512)` indicates that the cgroup's pids controller is currently tracking 11 processes/threads within that cgroup and has a configured limit of 512. This limit restricts the total number of processes and threads that can be created in that cgroup, preventing fork bombs or resource exhaustion.

Answer

The process is using 512 MB of memory.

Answer

The service has been running for 512 seconds.

Answer

The number of threads is limited to 512.

Question 9

The company password policy requires minimum length, complexity, and that passwords cannot be based on dictionary words. Which file should be edited to configure these settings via pam_pwquality?

Accepted Answer

/etc/security/pwquality.conf. The pam_pwquality module enforces password quality rules such as minimum length, complexity, and dictionary checks. Its configuration file is /etc/security/pwquality.conf, where parameters like minlen, dcredit, ucredit, lcredit, ocredit, and dictcheck are set. Editing this file directly controls the PAM module's behavior without modifying PAM service files.

Answer

/etc/login.defs

Answer

/etc/pam.d/system-auth

Answer

/etc/pam.d/password-auth

Question 10

Which TWO are standard methods to boot into rescue mode in a systemd-based Linux distribution?

Accepted Answer

Run systemctl rescue. `systemctl rescue` directly activates the `rescue.target`, which is the standard systemd mechanism to boot into a single-user, minimal rescue environment. This target mounts essential filesystems and starts basic services, providing a shell for troubleshooting without a full multi-user boot.

Answer

Add 'emergency' to kernel command line

Answer

Append init=/bin/bash to kernel command line

Answer

Run grub2-mkconfig

Question 11

Which command displays real-time information about running processes, including CPU and memory usage, and updates the display dynamically?

Accepted Answer

top. top displays a dynamic real-time view of running processes and system resource usage.

Answer

htop

Answer

ps aux

Answer

jobs

Question 12

An administrator uses Podman containers and wants them to start automatically when the host boots. Which method should be used?

Accepted Answer

podman generate systemd --new --files, then systemctl enable container-name. Podman does not have a built-in auto-start mechanism; instead, it integrates with systemd by generating a systemd service unit file using `podman generate systemd --new --files`. This creates a service that manages the container as a transient unit, and then `systemctl enable` makes it start automatically at boot. This approach leverages systemd's dependency-based boot sequencing and ensures the container is restarted if it fails.

Answer

podman auto-start on

Answer

podman register-service container-name

Answer

Add a command to /etc/rc.local to start the container

Question 13

A process is running with a nice value of 5. The system administrator wants to increase its priority (lower the nice value) to -5 but is not the owner of the process. What must the administrator do first to achieve this?

Accepted Answer

Use renice with root privileges via sudo. Only root can increase priority (lower nice value) of another user's process. The administrator must use sudo or become root to run renice. Option A is incorrect because renice -n +10 would increase the nice value (reduce priority), not decrease it. Option B is incorrect because the nice command starts a new process with a specified nice value; it cannot change the priority of an existing process. Option D is incorrect because stopping and restarting the process would change its PID and is unnecessary; the correct approach is to use renice with sudo.

Answer

Use renice -n +10

Answer

Use the nice command with -n -5

Answer

Use kill -SIGSTOP to stop the process then restart

Question 14

A Linux administrator needs to configure a service to start automatically after a network connection is established. The service should only run when the network is up, and should stop when the network goes down. Which two systemd unit options should be used? (Choose two.)

Accepted Answer

BindsTo=network.target. (BindsTo=network.target) is correct because it creates a stronger dependency than Requires: if the network target stops, systemd will stop the service as well, ensuring the service only runs when the network is up. Option E (After=network.target) is correct because it orders the service to start only after the network target has been reached, preventing the service from attempting to start before the network is available.

Answer

Requires=network.target

Answer

PartOf=network.service

Answer

Wants=network.target

Question 15

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and AllowGroups sshusers. The directive `PermitRootLogin no` explicitly disallows root login via SSH, and `AllowGroups sshusers` restricts SSH access to only members of the 'sshusers' group. This combination meets both requirements: disabling root login and limiting access to a specific group. The `AllowGroups` directive is group-based, unlike `AllowUsers`, which is user-based.

Answer

DenyRootLogin yes and AllowGroups sshusers

Answer

PermitRootLogin prohibit-password and AllowGroups sshusers

Answer

PermitRootLogin no and AllowUsers sshusers

Question 16

A user is trying to log in to a Linux server via SSH but receives 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic)'. The user's public key is in ~/.ssh/authorized_keys with proper permissions (600) and owned by the user. The server's sshd_config has 'PubkeyAuthentication yes' and 'PasswordAuthentication no'. What is the most likely additional cause?

Accepted Answer

The user's home directory has incorrect permissions (e.g., group-writable).. SSH server's `StrictModes` (enabled by default) checks that the user's home directory is not group-writable or world-writable. If the home directory has group-write permission (e.g., 775), SSH refuses to trust `~/.ssh/authorized_keys` even if the file itself has 600 permissions. This is a security measure to prevent other group members from modifying the authorized_keys file indirectly.

Answer

The server's firewall is blocking port 22.

Answer

SELinux is blocking the key authentication.

Answer

The SSH server is not running.

Question 17

A user reports that they receive 'Permission denied' when trying to run a script located in their home directory. The script has permissions -rw-rw-r-- and is owned by the user. Which command should the user run to resolve the issue?

Accepted Answer

chmod u+x script.sh. The script has permissions -rw-rw-r--, meaning the owner (user) has read and write but not execute permission. To run it as a script, the execute bit must be set for the owner. The command chmod u+x script.sh adds execute permission for the user, allowing them to run the script directly.

Answer

chmod g-w script.sh

Answer

sudo chown user:user script.sh

Answer

chmod a+x script.sh

Question 18

A system administrator wants to schedule a script to run every Monday at 3 AM. Which cron entry is correct?

Accepted Answer

0 3 * * 1 /path/to/script.sh. The cron syntax for 'at 3 AM every Monday' is minute 0, hour 3, day-of-month *, month *, and day-of-week 1 (where 0 and 7 both represent Sunday, and 1 represents Monday). This matches the required schedule exactly.

Answer

0 3 1 * * /path/to/script.sh

Answer

3 0 * * 1 /path/to/script.sh

Answer

0 3 * * 2 /path/to/script.sh

Question 19

A company's security policy requires that all user passwords must expire every 90 days. The administrator runs 'chage -M 90 jdoe' for user jdoe. Which additional step ensures that the password expiration policy is enforced for all new users?

Accepted Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs. /etc/login.defs contains default values used by useradd and other tools when creating new users. Setting PASS_MAX_DAYS 90 in this file ensures that every new user account created will automatically have a 90-day password expiration, enforcing the policy globally without manual intervention.

Answer

Add 'password required pam_unix.so remember=5' to /etc/pam.d/system-auth

Answer

Set EXPIRE=90 in /etc/default/useradd

Answer

Modify /etc/shadow to set max days for each user

Question 20

A system administrator notices that an unauthorized user gained access to a server via SSH using a compromised user account. Which security measure should be implemented to prevent such attacks in the future?

Accepted Answer

Configure SSH to use key-based authentication only. Configuring SSH to use key-based authentication only eliminates the risk of password-based attacks, such as brute-force or credential theft. Since the compromised user account was accessed via SSH using a password, disabling password authentication and requiring a private key ensures that an attacker cannot log in even if they obtain the user's password hash. This aligns with the principle of least privilege and strong authentication, as SSH keys are cryptographically bound to the client and are not transmitted over the network.

Answer

Disable SSH and use Telnet

Answer

Enforce a complex password policy

Answer

Allow all users to use sudo without passwords