XK0-006 Practice Exam 54 — 20 Questions

Question 1

A technician needs to apply an access control list (ACL) to a file to grant read and write permissions to a specific user. Which two commands are used to manage ACLs? (Choose two.)

Accepted Answer

setfacl. setfacl sets ACLs, getfacl retrieves them.

Answer

chmod

Answer

chown

Answer

umask

Question 2

A security policy requires that all SUID files be identified and reviewed. Which command can recursively find SUID files?

Accepted Answer

find / -perm /4000. 'find / -perm /4000' searches for files with the SUID bit set (the / before the permission mask indicates that any of the bits in 4000 must be set). Option A uses permission 0777, which finds world-writable files, not SUID. Option C uses 'ls -lR | grep' to locate files with an 's' in the owner execute position, which does identify SUID files, but parsing 'ls' output is fragile and not the recommended method; the question asks for a command, and while it can work, it is less reliable than 'find'. Option D uses '-perm -2000' which matches files with the SGID bit set, not SUID.

Answer

find / -type f -perm 0777

Answer

ls -lR | grep '^...s'

Answer

find / -perm -2000

Question 3

A system administrator is writing a Bash script that needs to iterate over a list of IP addresses stored in a file, one per line. Which loop construct should be used?

Accepted Answer

for i in $(cat ip_list.txt); do ... done. The for loop with command substitution ($(cat ip_list.txt)) iterates over each item in the file output, making it the appropriate construct for iterating over a list of IP addresses. Option B uses C-style syntax incorrectly and would not iterate over the file contents directly. Option C uses a while-read loop, which is intended for reading lines from input, not for iterating over a list of items from a file; therefore, it is not the loop construct asked for. Option D uses an until loop that requires a conditional expression, not suitable for direct list iteration from a file.

Answer

for ((i=0; i<$(wc -l < ip_list.txt); i++)); do ... done

Answer

while read line; do ... done < ip_list.txt

Answer

until IFS= read -r line; do ... done < ip_list.txt

Question 4

A system administrator needs to create a new user account with a home directory and the bash shell. Which command should be used?

Accepted Answer

useradd -m -s /bin/bash user. The `-m` flag tells `useradd` to create the user's home directory if it does not already exist, and `-s /bin/bash` sets the login shell to bash. This meets the requirement of creating a new user with a home directory and the bash shell.

Answer

useradd -r -s /bin/bash user

Answer

useradd -c -s /bin/bash user

Answer

useradd -d /home/user -s /bin/bash user

Question 5

Which file contains user password hashes and aging information on a Linux system?

Accepted Answer

/etc/shadow. The /etc/shadow file stores user password hashes along with password aging information, such as the last password change date, minimum and maximum password age, warning period, and inactivity lockout. This file is readable only by root (or privileged processes) to protect the hashed passwords from unauthorized access, unlike /etc/passwd which is world-readable.

Answer

/etc/group

Answer

/etc/passwd

Answer

/etc/gshadow

Question 6

Which TWO options are valid ways to pass environment variables to a Docker container?

Accepted Answer

--env-file file. The `--env-file` flag allows you to pass a file containing environment variables to a Docker container, where each line in the file is in `KEY=value` format. Option C is correct because the `-e` (or `--env`) flag directly sets an environment variable inside the container, e.g., `-e VAR=value`. Both are standard Docker CLI methods for injecting environment variables at container runtime.

Answer

--var VAR=value

Answer

--variable VAR=value

Answer

-v VAR=value

Question 7

A security policy requires that user passwords must be changed every 60 days, and users should be warned 7 days before expiration. Which two chage commands set these requirements for user 'jsmith'? (Choose TWO.)

Accepted Answer

chage -M 60 jsmith. chage -M 60 sets max days; chage -W 7 sets warning days.

Answer

chage -E 60 jsmith

Answer

chage -m 60 jsmith

Answer

chage -I 7 jsmith

Question 8

A system administrator needs to create a Dockerfile for a Python application. The application should be installed in the container, and when the container starts, it should run the command 'python app.py'. Which Dockerfile instruction should be used to specify the default command?

Accepted Answer

CMD python app.py. CMD specifies the default command to run when the container starts. ENTRYPOINT can also be used but is typically for executables that are not easily overridden.

Answer

ENTRYPOINT python app.py

Answer

RUN python app.py

Answer

STARTUP python app.py

Question 9

Match each Linux package manager to its distribution family.

Accepted Answer

apt: Debian-based distributions. Different Linux distributions use different package managers: apt is for Debian-based, yum/dnf for Red Hat-based, and pacman for Arch Linux. Common confusions include mixing apt with Red Hat or yum with Arch.

Answer

apt: Red Hat-based distributions

Answer

yum: Arch Linux

Question 10

A Linux engineer is troubleshooting a cron job that does not execute as expected. The crontab entry reads: '*/5 * * * * /usr/local/bin/backup.sh'. The script runs manually when executed as root. Which of the following is the most likely cause?

Accepted Answer

The script requires environment variables that are not set in cron's shell.. D is correct because cron jobs run in a minimal shell environment (typically /bin/sh) with a very limited set of environment variables. The script /usr/local/bin/backup.sh may rely on variables like PATH, HOME, or custom variables that are not set in cron's shell, causing it to fail even though it runs fine manually as root. This is a classic cron issue where the interactive shell's environment differs from cron's non-interactive environment.

Answer

The cron daemon is not running.

Answer

The script file does not have execute permissions.

Answer

The system clock is incorrect.

Question 11

An administrator runs the commands shown in the exhibit. The container is accessible via curl using the container IP. However, the administrator cannot access the web server using the host's IP address on port 80. What is the most likely cause?

Accepted Answer

The container's port 80 is not published to the host.. The administrator ran `docker run -d nginx` without the `-p` or `--publish` flag, which means port 80 inside the container is not mapped to any port on the host. The container is accessible via its own IP because Docker networking allows direct container-to-container communication, but the host's IP on port 80 remains unbound, so curl to the host IP fails. Publishing the port with `-p 80:80` would expose the container's port 80 on the host's interface.

Answer

The container's IP address is incorrect.

Answer

Nginx is configured to listen on a different port.

Answer

The container is not running.

Question 12

A storage administrator is troubleshooting high disk I/O latency. Which THREE tools can provide detailed block I/O statistics at the device level? (Choose three.)

Accepted Answer

iostat. B (iostat) is correct because it reports CPU utilization and device I/O statistics, including metrics like await, svctm, and %util, which are essential for diagnosing high disk I/O latency at the device level. It reads data from /proc/diskstats and provides per-device block I/O statistics.

Answer

dd

Answer

fstrim

Question 13

Which THREE of the following actions can help prevent unauthorized access to a Linux server via SSH?

Accepted Answer

Allow only specific users with AllowUsers.. The `AllowUsers` directive in `/etc/ssh/sshd_config` restricts SSH logins to only the specified user accounts, blocking all others even if they have valid credentials. This reduces the attack surface by explicitly whitelisting authorized users, making it an effective access control measure.

Answer

Set MaxAuthTries to 6.

Answer

Use protocol version 1.

Question 14

Which shebang ensures maximum portability across systems for a Python script?

Accepted Answer

#!/usr/bin/env python3. `#!/usr/bin/env python3` uses the `env` utility to locate the `python3` interpreter in the user's `PATH`, making the script portable across different Unix-like systems where Python 3 may be installed in various directories (e.g., `/usr/bin/python3`, `/usr/local/bin/python3`). This shebang avoids hardcoding an absolute path, which is the key to maximum portability.

Answer

#!/bin/python

Answer

#!/usr/bin/python

Answer

#!/usr/local/bin/python3

Question 15

An administrator needs to set a password expiration policy so that all users must change their password every 90 days. Which command and option accomplishes this for an existing user?

Accepted Answer

chage -M 90 . The `chage -M 90 ` command sets the maximum number of days a password is valid for an existing user. The `-M` option specifies the maximum password age in days, so after 90 days the user will be forced to change their password. This directly implements the required 90-day password expiration policy.

Answer

usermod -e 90 <username>

Answer

passwd -x 90 <username>

Answer

chage -W 90 <username>

Question 16

An administrator notices that a non-root user 'alice' can run commands as root without being in the sudoers file. Which group membership could allow this?

Accepted Answer

wheel. On many Linux distributions, membership in the 'wheel' group is a standard mechanism that allows non-root users to execute commands with root privileges via the 'su' command, even if they are not listed in the sudoers file. The 'wheel' group is traditionally used to control access to the 'su' utility, and by default, PAM (Pluggable Authentication Modules) configuration often permits members of the 'wheel' group to switch to the root user without additional sudo configuration.

Answer

admin

Answer

root

Answer

sudo

Question 17

A Linux administrator needs to configure sudo access for members of the 'wheel' group to run any command. Which two steps are required? (Choose TWO.)

Accepted Answer

Uncomment the line '%wheel ALL=(ALL) ALL' in /etc/sudoers using visudo. The line '%wheel ALL=(ALL) ALL' in /etc/sudoers grants all members of the 'wheel' group permission to execute any command as any user. This line must be uncommented using visudo, which locks the file to prevent concurrent edits and performs syntax validation before saving. Option D is correct because users must be added to the 'wheel' group using 'usermod -aG wheel username' for the sudoers rule to apply to them.

Answer

Set the setuid bit on /usr/bin/sudo

Answer

Run 'sudo visudo -c' to check syntax

Answer

Edit /etc/ssh/sshd_config to allow wheel group

Question 18

A Linux administrator needs to find all files in /var/log that have been modified within the last 7 days and are larger than 10 MB. Which find command accomplishes this?

Accepted Answer

find /var/log -mtime -7 -size +10M. Both commands correctly find files modified within the last 7 days and larger than 10 MB. Option A uses -mtime -7 (modified less than 7 days ago) and option D uses -mmin -10080 (modified less than 10080 minutes ago, which is equivalent to 7 days). Both use -size +10M for files larger than 10 MB.

Answer

find /var/log -atime -7 -size +10M

Answer

find /var/log -mtime +7 -size -10M

Question 19

A server running Ubuntu 22.04 has AppArmor enabled. After installing a new application, the application is denied access to certain files even though the permissions are correct. The administrator checks the AppArmor profile and finds it is in enforce mode. Which command can be used to temporarily set the profile to complain mode to generate log entries for needed accesses?

Accepted Answer

aa-complain /usr/bin/application. `aa-complain /usr/bin/application`, is correct because it sets the specified AppArmor profile to complain mode, which logs policy violations without blocking access. This allows the administrator to identify which accesses the application needs by reviewing the generated log entries, typically in `/var/log/syslog` or via `ausearch`, while the application continues to run.

Answer

systemctl restart apparmor

Answer

aa-enforce /usr/bin/application

Answer

apparmor_parser -r /etc/apparmor.d/usr.bin.application

Question 20

An administrator is troubleshooting a server that is experiencing intermittent high load. The administrator wants to identify processes that are using excessive CPU. Which two of the following commands can provide real-time CPU usage per process? (Choose two.)

Accepted Answer

htop. A is correct because `htop` is an interactive process viewer that displays real-time CPU usage per process, with a color-coded interface and the ability to sort by CPU consumption. B is correct because `top` is the standard real-time system monitor that shows a dynamic list of processes and their current CPU utilization, updating every few seconds by default.

Answer

iostat

Answer

ps -aux

Answer

vmstat