XK0-006 Practice Exam 55 — 20 Questions

Question 1

Which TWO commands display disk usage information for filesystems? (Select 2.)

Accepted Answer

du. The `df` command (disk free) reports the amount of available and used disk space on all mounted filesystems, while `du` (disk usage) estimates file and directory space usage. Both commands are standard tools for displaying disk usage information for filesystems in Linux.

Answer

ls

Answer

parted

Answer

fdisk

Question 2

During boot, a Linux system displays a kernel panic indicating 'not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Missing or corrupt initramfs. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate or access the root filesystem. This is most commonly caused by a missing or corrupt initramfs (initial RAM filesystem), which contains the necessary drivers and modules to mount the root filesystem. Without a valid initramfs, the kernel has no way to load storage drivers (e.g., for SATA, NVMe, or LVM) and thus fails to mount the root device.

Answer

Network configuration error

Answer

A failed filesystem check due to dirty file system

Answer

Incorrect GRUB timeout value

Question 3

A system administrator needs to capture network traffic on interface eth0, filtering for packets to or from host 10.0.0.1, and save the output to a file for later analysis. Which command accomplishes this?

Accepted Answer

tcpdump -i eth0 host 10.0.0.1 -w capture.pcap. Both tcpdump -i eth0 host 10.0.0.1 -w capture.pcap (A) and tcpdump -i eth0 -w capture.pcap host 10.0.0.1 (D) are valid commands to capture packets to/from host 10.0.0.1 on interface eth0 and write them to a file. In tcpdump, the -w option can be placed before or after the filter expression, as long as -w is followed by the filename. Options B and C are incorrect because they use wrong syntax or options.

Answer

tcpdump -n port 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 -host 10.0.0.1 > capture.pcap

Question 4

A systems administrator wants to build a custom Docker image from a Dockerfile located in the current directory. Which command should be used?

Accepted Answer

docker build .. The `docker build .` command reads the Dockerfile from the current directory and builds a custom Docker image from its instructions. This is the standard command for building an image from a Dockerfile, where the dot represents the build context (the current directory).

Answer

docker create .

Answer

docker commit .

Answer

docker image build .

Question 5

A security audit identified that the /tmp directory is world-writable. Which THREE steps should be taken to secure /tmp on a Linux system? (Select THREE.)

Accepted Answer

Set the sticky bit on /tmp. Setting the sticky bit on /tmp prevents users from deleting or renaming files owned by other users, even though the directory is world-writable. This is a standard security hardening measure for shared temporary directories.

Answer

Remove world-writable permission from /tmp

Answer

Mount /tmp with the exec option

Question 6

After modifying a PAM configuration file for sshd, a user reports they cannot log in. Which command can be used to verify the syntax of the PAM configuration without affecting running services?

Accepted Answer

pam-auth-update --package [wrong]. The `pam-auth-update --package` command is used to verify the syntax of PAM configuration files without affecting running services. It checks the configuration and reports any errors. This is the correct tool for syntax checking, whereas `pam_unix -t` does not validate syntax—it tests authentication against the pam_unix module. `pam_tally2` and `pam_faillock` are for account lockout management.

Answer

pam_unix -t [CORRECT]

Answer

pam_tally2 --check [wrong]

Answer

pam_faillock --test [wrong]

Question 7

A Linux administrator is configuring secure remote access to a server. Which three of the following are recommended best practices for securing SSH? (Choose three.)

Accepted Answer

Enable public key authentication.. Public key authentication (Option A) is a recommended best practice because it uses asymmetric cryptography (RSA, ECDSA, or Ed25519) to authenticate users without transmitting passwords over the network. This eliminates the risk of password interception via man-in-the-middle attacks or brute-force attempts, as the private key never leaves the client and the server verifies only the corresponding public key.

Answer

Use password authentication only.

Answer

Change the default SSH port to a non-standard port.

Question 8

A user wants to change the permissions of a file to give the owner full control, the group read and execute, and others no access. Which of the following chmod commands will achieve this?

Accepted Answer

chmod 750 file. 750 in octal gives rwx (7) to owner, r-x (5) to group, --- (0) to others. Option A is correct. Option B is 700 (rwx------) giving group no access. Option C is 770 (rwxrwx---) giving group write. Option D is 755 (rwxr-xr-x) giving others read/execute.

Answer

chmod 700 file

Answer

chmod 770 file

Answer

chmod 755 file

Question 9

Your organization uses Ansible for configuration management across 500 servers. The management server is a Linux workstation. You have written a playbook to deploy a new monitoring agent. The playbook works on all test machines but fails on production machines at the 'Gather Facts' stage with the error: 'fatal: [server1]: FAILED! => {"msg": "Timed out waiting for privilege escalation prompt: become method 'sudo' requires a password" }'. All production servers have the same sudoers configuration. You have confirmed that the user 'ansible' has passwordless sudo configured correctly. What is the most likely cause?

Accepted Answer

The ansible_become_password is not set in the inventory. The error indicates that Ansible's privilege escalation (sudo) is prompting for a password, even though the 'ansible' user has passwordless sudo configured. This typically occurs when the 'ansible_become_password' variable is not set or is empty in the inventory, causing Ansible to wait for a password prompt that never comes. Since the playbook works on test machines, the difference is likely that the inventory for production lacks the required 'ansible_become_password' or 'ansible_become' settings, or the variable is not being passed correctly.

Answer

The production servers have a different SSH key

Answer

The SSH timeout is too low

Answer

The become_user is set incorrectly

Question 10

A Linux system is running slowly with high I/O wait as shown by vmstat. To investigate the I/O activity of a specific process that is suspected of causing the bottleneck, which of the following commands would be used to trace its system calls related to I/O?

Accepted Answer

strace -p . The 'wa' in vmstat indicates CPU time spent waiting for I/O. To examine what I/O operations a particular process is performing, strace can be used to trace system calls such as read, write, and ioctl. By attaching to the process with strace -p , the administrator can see the I/O calls being made in real time. iostat provides aggregated per-device statistics, not per-process details. dmesg shows kernel messages, which may contain I/O errors but not process-level I/O patterns. free displays memory usage and is unrelated to I/O tracing.

Answer

iostat -x 1

Answer

dmesg | tail

Answer

free -h

Question 11

An administrator needs to restrict SSH access to the server so that only a specific IP range (192.168.1.0/24) can connect, and password authentication is disabled. Which THREE steps must be taken?

Accepted Answer

Add a firewall rule: iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP. It uses iptables to create a firewall rule that accepts SSH traffic (TCP port 22) only from the 192.168.1.0/24 subnet, followed by a catch-all rule that drops all other SSH traffic. This enforces network-level access control. Option D is correct because 'AllowUsers *@192.168.1.*' in sshd_config restricts SSH logins to users connecting from IP addresses matching that pattern, providing application-level filtering. Option E is correct because 'PasswordAuthentication no' disables password-based authentication, forcing the use of key-based or other non-password methods.

Answer

Set 'UsePAM yes' in sshd_config

Answer

Set 'PermitRootLogin without-password' in sshd_config

Question 12

An administrator needs to prevent a specific user 'bob' from logging in via SSH while allowing other users. Which configuration directive should be added to /etc/ssh/sshd_config?

Accepted Answer

DenyUsers bob. The DenyUsers directive in /etc/ssh/sshd_config explicitly blocks specific usernames from logging in via SSH. By specifying 'DenyUsers bob', only user bob is denied, while all other users remain allowed. This matches the requirement to prevent bob without affecting others. AllowUsers with a whitelist would also block bob but would require listing every other user, which is impractical and not the intended solution.

Answer

AllowUsers alice charlie

Answer

PermitRootLogin no

Answer

AllowUsers bob

Question 13

Which TWO characteristics apply to Docker containers compared to virtual machines? (Choose two.)

Accepted Answer

Containers share the host kernel. Docker containers share the host kernel, unlike virtual machines which each run their own kernel. This is because containers are implemented as isolated user-space instances (using namespaces and cgroups) that all run on top of the same host OS kernel. This shared kernel architecture eliminates the need for a separate guest OS per container, making containers lightweight and fast to start.

Answer

Containers provide stronger isolation

Answer

Containers include a full guest operating system

Answer

Containers require a hypervisor

Question 14

A Linux administrator needs to display the amount of disk space used by each mounted filesystem. Which two commands can be used? (Choose two.)

Accepted Answer

du -h /. The question asks for two commands that display the amount of disk space used by each mounted filesystem. Both df -h (option E) and du -h / (option A) serve this purpose. df -h shows disk space usage for all mounted filesystems in human-readable format. du -h / shows disk usage for the root directory, which is a mounted filesystem; while du is typically used for directory-level usage, the root directory corresponds to the root filesystem, so it effectively displays the disk space used by that filesystem. mount | column -t (option B) lists mount points and options, not space usage. lsblk (option C) lists block devices, not filesystem space. fdisk -l (option D) displays partition tables, not filesystem usage. Therefore, options A and E are correct.

Answer

mount | column -t

Answer

lsblk

Answer

fdisk -l

Question 15

A DevOps engineer needs to ensure that a containerized web application always restarts automatically if the container exits unexpectedly. Which Docker run option should be used?

Accepted Answer

--restart=always. The `--restart=always` policy ensures that the container restarts regardless of the exit code or reason for termination, including unexpected crashes. This is the correct choice for a containerized web application that must maintain high availability by automatically recovering from any unexpected exit.

Answer

--restart=on-failure

Answer

--restart=unless-stopped

Answer

--restart=no

Question 16

A system is experiencing high disk I/O wait. Which command can provide disk I/O statistics such as requests per second and average wait time?

Accepted Answer

iostat -x 1. iostat reports disk I/O statistics including r/s, w/s, await, %util. vmstat shows memory and CPU stats, free shows memory, sar can show I/O but iostat is I/O-specific.

Answer

sar -u 1 5

Answer

free -h

Answer

vmstat 1 5

Question 17

A developer wants to run a container with a specific command that overrides the default entrypoint. Which Docker command should be used?

Accepted Answer

docker run --entrypoint /bin/bash myimage. The `--entrypoint` flag in `docker run` allows you to override the default entrypoint defined in the Docker image. By specifying `--entrypoint /bin/bash`, the container will start with `/bin/bash` as its entrypoint, ignoring any `ENTRYPOINT` or `CMD` instructions in the Dockerfile. This is the standard Docker syntax for replacing the entrypoint at runtime.

Answer

docker run myimage /bin/bash

Answer

docker exec myimage /bin/bash

Answer

docker start myimage /bin/bash

Question 18

An administrator needs to give a user read and write access to a file without changing the file's group or adding the user to any group. Which method should be used?

Accepted Answer

setfacl -m u:username:rw file. Access Control Lists (ACLs) allow setting permissions for specific users beyond the traditional owner/group/others model, without changing group membership.

Answer

chown user: file

Answer

chmod u+rw file

Answer

chgrp to user's primary group

Question 19

Which THREE are valid SELinux modes?

Accepted Answer

Permissive. SELinux has three modes: enforcing (policy enforced), permissive (only logs violations), and disabled (SELinux turned off).

Answer

Strict

Answer

Audit

Question 20

Which command displays the current umask value in symbolic mode?

Accepted Answer

umask -S. umask -S displays the umask in symbolic (rwx) format. The plain umask shows octal.

Answer

umask

Answer

umask --symbolic

Answer

umask -s