XK0-006 Practice Exam 54 — 20 Questions

Question 1

A Linux administrator is troubleshooting a server that randomly drops SSH connections. The administrator suspects a network interface is experiencing errors or discards. Which command should be used to display detailed error and discard statistics for a specific network interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip -s link show eth0. The administrator needs error and discard statistics for a specific interface. ip -s link show eth0 provides a standardized, detailed view of RX/TX errors, dropped packets, and overruns. While other tools may show some statistics, ip is the modern, reliable choice and directly meets the requirement.

Answer

netstat -i

Answer

ifconfig eth0

Answer

ethtool -S eth0

Question 2

A Linux administrator is automating user account creation. The script reads a list of usernames from a file and creates each account. The administrator wants the script to continue processing remaining users even if one useradd command fails due to a duplicate username. Which Bash construct should be used to run useradd and handle the failure without aborting the script?

Accepted Answer

useradd "$user" || echo "Failed to add $user" >&2. The || control operator provides a concise way to execute a fallback command only when the preceding command fails. By pairing useradd with a failure branch, the script can report the duplicate username and proceed to the next iteration, satisfying the requirement to continue processing the remaining users.

Answer

set -e; useradd "$user"

Answer

useradd "$user" && echo "Failed to add $user" >&2

Answer

useradd "$user" | echo "Failed to add $user" >&2

Question 3

A Linux server's root filesystem was accidentally filled to 100% capacity by runaway application logs. After the administrator deletes several large log files with rm, df -h still reports the filesystem at 100% usage. Which command should the administrator use to identify the process that is holding these deleted files open?

Accepted Answer

lsof +L1. The correct tool is lsof +L1, which specifically lists open files with a link count less than one, indicating deleted files still held open by a process. In this scenario, the deleted log files are still consuming disk space because a process has them open. Identifying and restarting that process will release the space, resolving the 100% usage.

Answer

df -i

Answer

fuser -m /

Answer

du -sh /var/log

Question 4

A Linux server has a single disk /dev/sda with LVM. The root logical volume is nearly full and the administrator adds a new disk /dev/sdb to extend it. After creating a physical volume on /dev/sdb and adding it to the volume group, which command should be used to extend the root logical volume and its filesystem in one step?

Accepted Answer

lvextend -r -l +100%FREE /dev/vg0/root. Extending an LVM logical volume and its filesystem in one step is done with lvextend -r (or --resizefs). The -r flag automatically calls the appropriate filesystem resize tool (resize2fs for ext4, xfs_growfs for XFS) after growing the LV. Using -l +100%FREE allocates all remaining extents in the volume group. This avoids a separate manual resize step and works for both ext4 and XFS, making it the most reliable choice.

Answer

vgextend vg0 /dev/sdb && lvcreate -l +100%FREE -n root vg0

Answer

lvresize -L +10G /dev/vg0/root && resize2fs /dev/vg0/root

Answer

pvresize /dev/sdb && lvextend -L +10G /dev/vg0/root

Question 5

A Linux administrator needs a service to be started automatically at boot and then started immediately without rebooting. The service unit file is located at /etc/systemd/system/myapp.service. Which command should the administrator run to accomplish both tasks?

Accepted Answer

systemctl enable --now myapp.service. The correct command is systemctl enable --now myapp.service. The enable subcommand sets up the unit to start at boot, and --now starts it immediately. This single command satisfies both requirements without requiring a reboot or separate commands. Other options either omit enabling, omit starting, or use commands that do not achieve both goals.

Answer

systemctl start myapp.service && systemctl daemon-reload

Answer

systemctl link /etc/systemd/system/myapp.service

Answer

systemctl enable myapp.service && systemctl restart myapp.service

Question 6

A Linux administrator is troubleshooting a server that randomly drops SSH connections. The administrator suspects a network interface is experiencing errors or discards. Which command should be used to display detailed error and discard statistics for a specific network interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

systemctl daemon-reload. After editing a unit file, the administrator must run systemctl daemon-reload to make systemd aware of the changes. Then, systemctl restart myapp.service stops and starts the service with the new configuration. The other commands either do not reload the manager configuration, are invalid, or serve a different purpose such as enabling at boot.

Answer

systemctl reload myapp.service

Answer

systemctl enable myapp.service

Answer

systemctl reexec myapp.service

Question 7

A Linux administrator notices that a production server's root filesystem is 100% full, but du reports only 40 GB used on a 100 GB partition. Which command should the administrator use to identify deleted files still held open by running processes?

Accepted Answer

lsof +L1. The discrepancy between df and du indicates deleted files still held open by processes. lsof +L1 specifically lists open files with a link count of zero, which are deleted files still consuming disk space. This allows the administrator to identify the process holding the file and restart it to release the space.

Answer

fuser -mv /

Answer

df -i

Answer

find / -size +1G -exec ls -l {} \;

Question 8

A security administrator is hardening a Linux server that uses firewalld. The server hosts a web application that must be accessible only from the internal network 192.168.1.0/24 on port 443. The administrator wants to implement this using a rich rule in the public zone and ensure it persists across reboots. Which sequence of commands should the administrator use?

Accepted Answer

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="443" protocol="tcp" accept' && firewall-cmd --reload. Using a rich rule with --permanent allows granular control, specifying source address, port, and protocol in one rule. The subsequent reload applies the permanent configuration to the runtime environment. This meets the requirement of restricting access to the internal subnet on port 443 and ensuring persistence.

Answer

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="443" protocol="tcp" accept' && firewall-cmd --runtime-to-permanent

Answer

firewall-cmd --permanent --zone=public --add-service=https && firewall-cmd --reload

Answer

firewall-cmd --permanent --zone=public --add-source=192.168.1.0/24 --add-port=443/tcp && firewall-cmd --reload

Question 9

A Linux server's /var/log partition is 100% full and rsyslogd has stopped writing logs. The administrator needs to find which directories under /var/log consume the most space without deleting anything. Which command should the administrator run?

Accepted Answer

du -sh /var/log/* | sort -rh | head -n 10. To find what is filling a filesystem, aggregate usage per directory and sort by size. du -sh with a glob gives one line per item under /var/log, and sort -rh orders them largest first, so the top offenders are immediately visible. df only shows the filesystem total, find -delete destroys data, and recursive ls provides no aggregation.

Answer

ls -laR /var/log | less

Answer

df -h /var/log

Answer

find /var/log -type f -size +100M -delete

Question 10

A Linux administrator needs to configure a system to use a central authentication service. The service requires that user credentials are sent over the network in an encrypted format and that the client validates the server's certificate. Which of the following should the administrator configure?

Accepted Answer

Configure LDAP with TLS using the ldaps:// URI and set TLS_REQCERT to demand in /etc/ldap/ldap.conf.. LDAP with TLS (LDAPS) encrypts authentication traffic, and setting TLS_REQCERT to demand ensures the client validates the server's certificate. This combination meets both the encryption and validation requirements. The other options either lack certificate validation or use insecure protocols.

Answer

Configure Kerberos with a keytab file and set the default realm in /etc/krb5.conf.

Answer

Configure NIS with a secured map and use ypbind with a password.

Answer

Configure SSSD with ldap_id_use_start_tls = true and ldap_tls_reqcert = never.

Question 11

A Linux administrator needs to grant temporary, time-limited administrative access to a contractor on a production server. The contractor must be able to run only `/usr/bin/systemctl restart nginx` as root without a password, and all actions must be logged. The administrator plans to use sudo. Which two steps are required to meet these requirements? (Choose two.)

Accepted Answer

Create a file in /etc/sudoers.d/ with a rule like `contractor ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx` and validate it with visudo -c.. Satisfying the requirement needs both a narrowly scoped sudo rule and audit logging. A drop-in file in /etc/sudoers.d with a command-specific NOPASSWD rule authorizes exactly the restart operation, while validating with visudo -c protects sudo integrity. Enabling log_output and ensuring the log destination is writable provides the session logging demanded for all actions. Together these implement least privilege and accountability without granting broad root access.

Answer

Add the contractor to the wheel group and rely on the default `%wheel ALL=(ALL) ALL` rule.

Answer

Set the contractor account's shell to /sbin/nologin to limit interactive access.

Answer

Add `contractor ALL=(ALL) NOPASSWD: ALL` to /etc/sudoers to simplify future administration.

Question 12

A Linux administrator needs to grant a user named 'bob' the ability to run the /usr/bin/systemctl command as root without being prompted for a password. Which entry should be added to the sudoers file to accomplish this?

Accepted Answer

bob ALL=(ALL) NOPASSWD: /usr/bin/systemctl. The sudoers entry must specify the user, hosts, target user, the NOPASSWD tag, and the full path to the command. The line 'bob ALL=(ALL) NOPASSWD: /usr/bin/systemctl' grants exactly the intended permission without a password, while other options either require a password, lack the full path, or grant excessive privileges. Always use visudo to edit sudoers to avoid syntax errors.

Answer

bob ALL=(ALL) NOPASSWD: ALL

Answer

bob ALL=(root) NOPASSWD: systemctl

Answer

bob ALL=(ALL) PASSWD: /usr/bin/systemctl

Question 13

A Linux administrator needs to configure a system so that the service `httpd` starts automatically when the system boots into the default target. Which command should the administrator use?

Accepted Answer

systemctl enable httpd. Enabling a service with `systemctl enable httpd` sets up the proper symlinks so that systemd starts the service when the default target is reached during boot. Starting the service only affects the current runtime, while enabling ensures persistence across reboots. Other commands like `chkconfig` are for older init systems and `daemon-reload` only refreshes unit definitions.

Answer

systemctl daemon-reload

Answer

systemctl start httpd

Answer

chkconfig httpd on

Question 14

A Linux administrator is troubleshooting a server that randomly drops SSH connections. The administrator suspects a network interface is experiencing errors or discards. Which command should be used to display detailed error and discard statistics for a specific network interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

mpstat -P ALL 1. The mpstat command with -P ALL and an interval argument produces recurring snapshots showing each processor core's utilization, which reveals whether load is spread evenly or concentrated on one core. This per-core visibility is critical when a single-threaded process saturates one CPU while others remain idle, a common cause of apparent unresponsiveness under load. Other tools lack this combination of per-core detail and live refresh.

Answer

iostat -x 1

Answer

top -b -n 1

Answer

free -m

Question 15

A Linux administrator needs to create a new user account 'jdoe' with a home directory /home/jdoe and the default shell /bin/bash. Which command will accomplish this?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command with -m creates the home directory and -s sets the shell. This is the standard non-interactive method to create a user with specific home and shell. The other commands either modify existing users, create groups, or are distribution-specific interactive tools that may not accept the given options.

Answer

groupadd -m -s /bin/bash jdoe

Answer

adduser jdoe --home /home/jdoe --shell /bin/bash

Answer

usermod -d /home/jdoe -s /bin/bash jdoe

Question 16

A Linux administrator is diagnosing a system that occasionally hangs during boot. The administrator suspects a hardware issue. Which command will display kernel ring buffer messages, including hardware detection and driver errors, from the current boot?

Accepted Answer

dmesg. The dmesg command displays the kernel ring buffer, which contains low-level messages about hardware, drivers, and kernel events. These messages are generated during boot and can reveal hardware detection failures, driver errors, or other kernel issues that cause hangs. It is the most direct tool for this purpose.

Answer

journalctl -b -p err

Answer

lsmod

Answer

cat /var/log/boot.log

Question 17

A Linux administrator notices that the /home filesystem is full. They want to identify which top-level directories under /home are consuming the most disk space. Which command should they run?

Accepted Answer

du -sh /home/*. To find which directories under /home are using the most space, the administrator needs aggregated per-directory sizes. The du command with -s and -h summarizes each top-level directory in human-readable units, directly identifying the largest consumers. Filesystem-level tools like df only confirm fullness, while recursive file listings require manual aggregation and partition tools are unrelated to in-filesystem usage.

Answer

ls -lR /home

Answer

df -h /home

Answer

fdisk -l /dev/sda

Question 18

A Linux server's clock drifts by several minutes each day. The administrator runs `timedatectl` and sees that NTP synchronization is enabled but the system clock is not synchronized. The server can reach the internet, and `chronyd` is running. Which command should the administrator use to verify which NTP sources are currently reachable and their stratum levels?

Accepted Answer

chronyc sources -v. With chronyd running, the correct tool to inspect configured time sources, their reachability, and stratum is `chronyc sources -v`. It queries the daemon directly and provides verbose per-source details, enabling the administrator to identify unreachable or high-stratum servers. Other commands target different NTP implementations or only report service status without source-level diagnostics.

Answer

systemctl status chronyd

Answer

timedatectl show-timesync

Answer

ntpq -p

Question 19

A Linux administrator needs to change the hostname of a system to 'webserver01' permanently. The system uses systemd. Which command should the administrator use?

Accepted Answer

hostnamectl set-hostname webserver01. On systemd-based systems, hostnamectl set-hostname is the correct command to permanently change the hostname. It updates the static hostname in /etc/hostname and applies the change immediately. Other methods either change only the runtime hostname or modify unrelated configuration files.

Answer

hostname webserver01

Answer

sysctl kernel.hostname=webserver01

Answer

echo webserver01 > /etc/hosts

Question 20

A Linux administrator receives reports that a database server becomes unresponsive every day around 02:00. Reviewing logs, the administrator notices repeated messages about 'blocked for more than 120 seconds' and high I/O wait. Which command should be used to identify which process is generating the most disk I/O during this period?

Accepted Answer

iotop -o -d 5. The administrator must attribute heavy disk I/O to a specific process. iotop is designed for per-process I/O monitoring and the -o flag filters out idle processes, making it ideal for identifying the culprit during the nightly issue. Other tools show device-level or system-wide I/O but cannot tie activity to a process.

Answer

iostat -x 5

Answer

vmstat 5

Answer

sar -d 5 3