XK0-006 Practice Exam 53 — 20 Questions

Question 1

An administrator manages a server with several systemd services. A service named reportgen.service must not start until another service named dbengine.service is fully active, and reportgen should be stopped automatically if dbengine stops. Which directive combination in the reportgen.service unit file achieves this ordering and dependency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

After=dbengine.service and Requires=dbengine.service. Ordering and dependency are separate concerns in systemd. After= controls sequence, ensuring reportgen starts once dbengine is active, while Requires= creates a hard dependency so reportgen stops if dbengine stops. Using After= with Requires= satisfies both requirements. Wants= is too weak to force the stop behavior, and Before= would invert the required startup order.

Answer

After=dbengine.service and Wants=dbengine.service

Answer

Before=dbengine.service and Wants=dbengine.service

Answer

Requires=dbengine.service and Before=dbengine.service

Question 2

A Linux administrator needs to schedule a backup script to run every day at 2:30 AM. The script is located at `/usr/local/bin/backup.sh` and must run as the user `backupuser`. Which entry in the crontab for `backupuser` will accomplish this?

Accepted Answer

30 2 * * * /usr/local/bin/backup.sh. The correct cron syntax for 2:30 AM daily is `30 2 * * *`. The minute field is 30, hour is 2, and the remaining fields are wildcards to indicate every day. The other options either have invalid time values or restrict execution to specific days, failing the daily requirement.

Answer

30 2 * * 1 /usr/local/bin/backup.sh

Answer

30 2 1 * * /usr/local/bin/backup.sh

Answer

2 30 * * * /usr/local/bin/backup.sh

Question 3

A Linux administrator is writing a Bash script to back up a directory. The script must continue running even if a particular command fails, but the administrator wants to log the error and take corrective action. Which of the following should be used to handle the error condition?

Accepted Answer

Check the exit status of the command using `$?` and conditionally execute recovery steps.. The requirement is to continue after a failure while logging and taking corrective action. Checking `$?` immediately after a command allows the script to branch based on success or failure, enabling custom error handling without terminating the script. This approach is flexible and standard for scenarios where fail-fast is not desired. Other methods either exit prematurely or fail to provide error handling.

Answer

Use `trap` to catch the ERR signal and exit the script.

Answer

Run the command in a subshell and ignore its exit status.

Answer

Use `set -e` at the beginning of the script.

Question 4

A Linux administrator needs to run a recurring backup script located at /usr/local/bin/backup.sh every day at 02:30. The system uses systemd and the administrator wants the job scheduled through a systemd timer rather than cron. Which combination of unit files must be created and enabled?

Accepted Answer

A .timer unit with OnCalendar=*-*-* 02:30:00 and a matching .service unit, then enable and start the .timer unit.. A systemd timer requires two cooperating units: a .timer unit that defines the schedule via OnCalendar= and a same-named .service unit that defines what to execute. To activate the schedule you enable and start the .timer unit, not the service. At each matching calendar point systemd triggers the associated service, which runs the ExecStart= command pointing at the backup script.

Answer

A single .service unit containing OnCalendar=*-*-* 02:30:00 in its [Service] section, then enable and start that unit.

Answer

A .timer unit with OnCalendar=*-*-* 02:30:00 and a matching .service unit, then enable and start the .service unit.

Answer

A .timer unit with OnBootSec=02:30 and a matching .service unit, then enable and start the .timer unit.

Question 5

A Linux administrator needs a scheduled job on a production server to run the backup script /usr/local/bin/backup.sh every day at 02:30, and the job must run as the root user regardless of who is logged in. Which single entry in /etc/crontab accomplishes this?

Accepted Answer

30 2 * * * root /usr/local/bin/backup.sh. System-wide cron entries in /etc/crontab carry an extra user field between the five time/date fields and the command, which is what allows a job to run as root without a login. The schedule fields must be ordered minute, hour, day-of-month, month, day-of-week, so 30 2 * * * is 02:30 and root names the executing account.

Answer

@daily root /usr/local/bin/backup.sh

Answer

2 30 * * * root /usr/local/bin/backup.sh

Answer

30 2 * * * /usr/local/bin/backup.sh root

Question 6

A Linux administrator needs to view the kernel ring buffer messages to diagnose a hardware issue. Which command should the administrator use?

Accepted Answer

dmesg. dmesg is the direct command to view the kernel ring buffer, which contains hardware and driver messages. It is always available and does not depend on system logging services. While journalctl -k can show kernel messages on systemd systems, dmesg is the standard tool for this specific task.

Answer

cat /var/log/messages

Answer

tail -f /var/log/syslog

Answer

journalctl -k

Question 7

A Linux administrator is troubleshooting a service that fails to start. The service unit file is present and enabled, but systemctl status shows 'failed' with exit code 203. Which command should the administrator run to view the most recent log messages specific to this service?

Accepted Answer

journalctl -u servicename.service -n 50. The administrator should use journalctl -u servicename.service -n 50 to view the most recent log entries for that unit. This command queries the systemd journal, which captures stdout/stderr from the service and systemd's own messages about start failures. It is the most direct way to diagnose why the service failed with exit code 203.

Answer

dmesg | grep servicename

Answer

tail -f /var/log/messages

Answer

systemctl cat servicename.service

Question 8

A Linux administrator is configuring a server to use a centralized authentication service. The security policy requires that user credentials are never sent in clear text and that the authentication traffic is encrypted. The administrator decides to use LDAP with TLS. Which command should be used to verify that the LDAP server's certificate is valid and that the TLS handshake succeeds?

Accepted Answer

openssl s_client -connect ldap.example.com:636 -showcerts. The openssl s_client command is designed to test TLS connections, making it ideal for verifying the LDAP server's certificate and handshake on the LDAPS port. It displays the certificate chain and any errors, ensuring that the encryption is correctly configured. Other commands either connect without encryption, check only for listening sockets, or do not validate the certificate in the LDAP context.

Answer

ss -tlnp | grep 636

Answer

nmap --script ssl-enum-ciphers -p 389 ldap.example.com

Answer

ldapsearch -H ldap://ldap.example.com -x -b '' -s base

Question 9

A junior administrator is asked to verify that the integrity of a downloaded package file has not been altered in transit. The vendor publishes a SHA-256 checksum file alongside the package. Which command should the administrator run to compare the computed hash of the downloaded file against the published value?

Accepted Answer

sha256sum package.rpm. The sha256sum utility computes the SHA-256 digest of a file, allowing a direct comparison with the vendor's published checksum to confirm the download was not altered. The other commands either use a different algorithm, require signature artifacts not provided, or verify RPM signatures rather than a standalone hash file.

Answer

rpm --checksig package.rpm

Answer

md5sum package.rpm

Answer

gpg --verify package.rpm

Question 10

A Linux server is configured to use systemd. The administrator wants to ensure that a custom service named 'app.service' starts automatically at boot, even if it has been manually stopped. Which command should be used?

Accepted Answer

systemctl enable app.service. The correct answer is the command that creates the necessary symbolic links for the service to start automatically at boot. This is done with systemctl enable. The other commands either start the service now, reset enablement, or apply presets, none of which ensure persistent automatic startup.

Answer

systemctl start app.service

Answer

systemctl preset app.service

Answer

systemctl reenable app.service

Question 11

A Linux administrator is troubleshooting a service that fails to start. The service unit file contains 'User=appuser' and 'Group=appgroup'. The administrator runs 'systemctl start app.service' and sees the error 'Failed to determine user credentials: No such process'. Which of the following is the most likely cause?

Accepted Answer

The user appuser does not exist on the system.. systemd resolves User= and Group= before launching the process. If the specified account cannot be found in the user database, systemd aborts with a credential resolution error. The fix is to create the missing user or correct the unit file to reference an existing account, then reload systemd and restart the service.

Answer

The service unit file has a syntax error in the [Service] section.

Answer

The service binary does not have the execute permission for appuser.

Answer

The appgroup group exists but appuser is not a member of it.

Question 12

A Linux administrator is troubleshooting a systemd service named 'webapp.service' that fails to start. The administrator runs 'systemctl status webapp.service' and sees that the service is in a failed state. Which TWO commands will provide additional diagnostic information about why the service failed? (Choose two.)

Accepted Answer

journalctl -u webapp.service. To diagnose why a systemd service failed, administrators need access to logs and error messages. journalctl -u webapp.service filters the journal for that unit, showing its output and systemd's messages. journalctl -xe shows recent system-wide errors with explanations, which often include the service failure. Commands like systemctl cat, show, and list-dependencies are for configuration and dependency inspection, not runtime diagnostics.

Answer

systemctl show webapp.service

Answer

systemctl cat webapp.service

Answer

systemctl list-dependencies webapp.service

Question 13

A Linux administrator uses Ansible to configure a fleet of web servers. A playbook task must copy a template file and then restart the nginx service only when the template content actually changes, avoiding needless restarts on every run. Which task construct enforces that behavior?

Accepted Answer

A template task with notify pointing to a handler that restarts nginx. Ansible handlers are triggered only when a task reports a changed result, and the template module reports changed precisely when the rendered output differs from the file on the managed host. Wiring notify to a handler that restarts nginx therefore produces a restart only on genuine configuration changes, keeping repeated playbook runs idempotent and quiet.

Answer

A copy task with force: no followed by a shell task that runs systemctl restart nginx

Answer

A template task with a when clause that checks whether the nginx process is running

Answer

A template task followed by a service task with state: restarted and no conditional

Question 14

A Linux administrator is troubleshooting a system that fails to mount the root filesystem during boot, dropping to an emergency shell. The administrator suspects that a recently added entry in /etc/fstab is incorrect. Which of the following commands should be used to verify the syntax and mountability of all entries in /etc/fstab without actually mounting them?

Accepted Answer

findmnt --verify. The findmnt --verify command is designed to validate the syntax and mountability of entries in /etc/fstab and related files without mounting them. It checks for common errors such as invalid device names, duplicate mount points, and unsupported options. This allows the administrator to identify problematic entries before attempting a reboot, avoiding a boot failure. Other commands either mount the filesystems or perform unrelated checks.

Answer

fsck -A

Answer

mount -a

Answer

blkid

Question 15

An administrator notices that a critical application server has become extremely slow, and load average has climbed above 40 on a 4-core system. The administrator wants to identify whether the bottleneck is CPU contention or processes stuck in uninterruptible sleep. (Choose two.)

Accepted Answer

Run vmstat 1 and observe the r and b columns.. Load average counts both runnable and uninterruptible-sleep tasks, so a high value alone does not reveal the cause. top exposes per-process state letters alongside load averages, and vmstat's r and b columns quantify runnable versus blocked tasks over time. Memory, CPU topology, and filesystem checks do not separate the two candidate bottlenecks.

Answer

Run df -h and check whether any filesystem is at 100 percent utilization.

Answer

Run lscpu and verify the number of logical CPUs and their current frequency.

Answer

Run free -m and compare the total and used memory values.

Question 16

A user reports that a shell script fails with a 'Permission denied' error when executed, even though the file has the execute bit set for the owner. The administrator runs `ls -l script.sh` and sees `-rwxr-xr-x`. Which command should the administrator use to determine whether the filesystem is mounted with the `noexec` option?

Accepted Answer

mount | grep noexec. A filesystem mounted with `noexec` prohibits execution of binaries and scripts regardless of file permissions. Checking the mount options with `mount | grep noexec` directly confirms whether this is the cause. Other commands inspect file attributes, ACLs, or metadata, none of which can reveal a filesystem-level execution restriction.

Answer

lsattr script.sh

Answer

getfacl script.sh

Answer

stat script.sh

Question 17

A Linux administrator needs to automate the deployment of a configuration file to fifty servers. The administrator wants to run a single command from a control node that copies the file to all servers in parallel and reports any failures. Which of the following tools is designed specifically for this task?

Accepted Answer

Ansible with an ad-hoc command using the copy module and a hosts inventory.. Ansible is purpose-built for agentless automation across many hosts. With an inventory and the copy module, a single ad-hoc command pushes the configuration file to all servers in parallel and returns per-host success or failure, which precisely matches the administrator's need for one command with consolidated reporting.

Answer

A for loop in a Bash script that calls scp for each hostname in a list.

Answer

A cron job on each target server that pulls the configuration file from a central web server every hour.

Answer

rsync run from the control node with a comma-separated list of remote hosts in a single invocation.

Question 18

A user reports that the 'backup.sh' script runs correctly when launched manually but silently does nothing when executed by cron at 02:00. The script relies on 'tar', which is found at /usr/bin/tar. Which action most directly resolves the failure?

Accepted Answer

Set an explicit PATH variable inside the crontab or use absolute paths for commands in the script.. Cron jobs run in a minimal environment where PATH typically contains only /usr/bin:/bin, and shell startup files are not sourced. A script that works interactively can fail under cron because commands are resolved against a different PATH or depend on variables set in a profile. Defining PATH explicitly in the crontab, or referencing binaries by absolute path, restores the resolution the script needs. Capturing stderr to a log also helps reveal such failures.

Answer

Move the script into /etc/cron.daily so it inherits the system environment.

Answer

Add 'SHELL=/bin/bash' to the crontab to force an interactive login shell.

Answer

Change the script's permissions to 777 so cron can execute it.

Question 19

A configuration-management playbook run by an administrator must install the nginx package only on hosts whose inventory group is webservers, and must restart the nginx service whenever the package installation changes the system. The administrator is using Ansible. Which pair of task attributes achieves both the conditional execution and the conditional restart?

Accepted Answer

Use when: "'webservers' in group_names" on the install task and a notify: directive referencing a handler that restarts nginx.. Ansible conditionals evaluate Jinja2 expressions against host facts and magic variables. group_names is a list of the inventory groups containing the current host, so testing membership restricts the install to webservers hosts. The notify: attribute links a task to a handler; handlers are deferred and fire only when the notifying task returns changed, which is exactly the behavior needed to restart nginx solely after a real package change.

Answer

Use when: "inventory_hostname == 'webservers'" on the install task and a notify: directive referencing a handler that restarts nginx.

Answer

Use tags: webservers on the install task and a notify: directive referencing a handler that restarts nginx.

Answer

Use when: "'webservers' in group_names" on the install task and a changed_when: true attribute that restarts nginx.

Question 20

A production web server intermittently stops responding for about 30 seconds at a time. The administrator runs 'vmstat 1' during an incident and observes the 'wa' column consistently above 80 while 'us' and 'sy' remain low. Which conclusion best describes the bottleneck?

Accepted Answer

Processes are blocked waiting on I/O, indicating a storage subsystem bottleneck rather than CPU saturation.. In vmstat output the wa column reports the percentage of CPU time spent idle while outstanding I/O requests exist. When wa is very high while us and sy stay low, the processors are not the limiting factor; the storage path is. The intermittent multi-second stalls are consistent with a storage device or array struggling to service requests, so the administrator should investigate disk health, queue depth, and I/O load.

Answer

The kernel is spending excessive time in system calls, indicating a runaway kernel thread.

Answer

User-space applications are consuming all available CPU cycles, indicating a runaway process.

Answer

The system is swapping heavily because physical memory is exhausted, indicating a memory shortfall.