XK0-006 Practice Exam 56 — 20 Questions

Question 1

A system administrator is investigating why a particular process is not responding. They run strace on the process but get no output. What could be the most likely reason?

Accepted Answer

The administrator does not have permission to trace that process.. The most likely reason strace produces no output is that the administrator lacks the necessary permissions to trace the process. By default, strace uses the ptrace system call, which requires either root privileges or the same user ID as the target process, and the process must not have the `dumpable` attribute set to 0 (e.g., via prctl(PR_SET_DUMPABLE, 0)). Without proper permissions, strace fails silently or returns an error like 'Operation not permitted' depending on the output configuration.

Answer

The process is already being traced by another strace instance.

Answer

The process is a kernel thread.

Answer

The process is a zombie process.

Question 2

A user has a file with permissions set to 644. Which of the following commands will add the setuid permission to the file? (Choose two.)

Accepted Answer

chmod u+s file. chmod u+s file adds setuid via symbolic. chmod 4644 file sets permissions to rwsr--r-- (setuid). The other options: chmod 2644 sets SGID; chmod 1644 sets sticky bit; chmod g+s sets SGID.

Answer

chmod g+s file

Answer

chmod 1644 file

Answer

chmod 2644 file

Question 3

An Ansible playbook includes the following task: 'ansible.builtin.service: name=nginx state=restarted'. However, the playbook fails with 'module not found'. What is the most likely cause?

Accepted Answer

The control node does not have Python installed.. The error 'module not found' indicates that Ansible cannot locate the module file or its dependencies on the control node. The module 'ansible.builtin.service' is a valid and standard module, so the error is not due to the module name. If the control node does not have Python installed, Ansible cannot execute any Python-based modules, resulting in a 'module not found' error because the module interpreter is missing. This is a fundamental requirement for Ansible operation.

Answer

The playbook is not in the correct directory.

Answer

The module name uses the wrong FQCN. The correct module is 'ansible.builtin.systemd_service'.

Answer

The target host does not have nginx installed.

Question 4

An administrator needs to capture network traffic on interface eth0 for packets destined to port 443 from host 10.0.0.1, while also writing the capture to a file for later analysis. Which three tcpdump options should be used together? (Choose three.)

Accepted Answer

-i eth0. To capture network traffic on interface eth0 for packets destined to port 443 from host 10.0.0.1, the tcpdump options needed are -i to specify the interface, port to filter by destination port, and host to specify the source host. These three options (A, B, D) together filter the desired traffic. To write the capture to a file, the -w option is additionally required, but it is not among the answer choices. Thus, the correct selections from the given list are A, B, and D.

Answer

-c 100

Answer

-n

Question 5

An administrator needs to deploy a containerized web application on a Linux server. The application requires port 8080 to be mapped to host port 80. Which command will run the container in detached mode with this port mapping?

Accepted Answer

docker run -d -p 80:8080 webapp. The `-d` flag runs the container in detached mode, and `-p 80:8080` maps host port 80 to container port 8080, matching the requirement. Option D achieves this. Option A is missing the `-d` flag, so it would run in the foreground. Option B uses `-p 8080:80`, which maps host port 8080 to container port 80—the reverse of what is needed. Option C uses `-p 80:80`, which does not expose the container's port 8080. The correct syntax is `-p host_port:container_port`.

Answer

docker run -p 80:8080 webapp

Answer

docker run -d -p 8080:80 webapp

Answer

docker run -d -p 80:80 webapp

Question 6

An administrator is investigating a security incident and needs to list all open network connections on a server, including listening and established connections, with process information. Which of the following commands can provide this information? (Choose all that apply.)

Accepted Answer

lsof -i -P -n. All three commands (lsof -i -P -n, netstat -tulpn, and ss -tulpn) can display open network connections with process information. lsof lists open files, and the -i flag filters for network connections; netstat and ss with the -tulpn flags show TCP/UDP listening and established connections along with the associated process ID.

Answer

tcpdump -i any

Answer

nmap -sT localhost

Question 7

A Linux administrator is troubleshooting login issues. Users can log in using SSH but not through the local console or graphical display manager. The /etc/pam.d/system-auth file was recently modified. Which PAM module is likely misconfigured?

Accepted Answer

pam_securetty.so. The pam_securetty.so module restricts root login to terminals listed in /etc/securetty. If this file was misconfigured or the module is incorrectly set to 'required' for all users, local console and graphical display manager logins (which use virtual terminals like tty1) would be denied, while SSH (which uses pseudo-terminals like pts/0) would still succeed because pam_securetty.so typically does not apply to SSH sessions.

Answer

pam_limits.so

Answer

pam_deny.so

Answer

pam_unix.so

Question 8

Which THREE of the following are valid ways to define environment variables in a Docker container? (Choose three.)

Accepted Answer

Passing with docker run -e VAR=value. Options A, B, and D are valid ways to define environment variables in a Docker container. Option A (`docker run -e VAR=value`) sets a variable at runtime. Option B (specifying environment variables under `services:` in `docker-compose.yml`) defines them for Compose-based deployments. Option D (the `ENV` instruction in a Dockerfile) sets variables that persist in the image and at runtime. Option C (`ARG` in a Dockerfile) is incorrect because ARG defines build-time variables that do not persist in the running container. Option E (`docker run --env-file`) is not a direct definition method; it loads variables from a file, which is a different mechanism.

Answer

Using the ARG instruction in Dockerfile

Answer

Using --env-file option with docker run

Question 9

A Linux technician is configuring a firewall with firewalld. The organization requires that SSH services be available only on the internal network zone (10.0.0.0/8). Which command should be used to add this rule permanently?

Accepted Answer

firewall-cmd --zone=internal --add-service=ssh --add-source=10.0.0.0/8 --permanent. Option D is correct because it uses --add-service=ssh to allow the SSH service and --add-source to restrict the source to 10.0.0.0/8, making the rule permanent. This follows best practices by leveraging service definitions. Option A opens port 22 directly, which works but is less precise and not service-aware. Option C uses a rich rule, which is overly complex for this straightforward requirement. Option B targets the public zone, which is incorrect.

Answer

firewall-cmd --zone=internal --add-port=22/tcp --add-source=10.0.0.0/8 --permanent

Answer

firewall-cmd --zone=public --add-service=ssh --add-source=10.0.0.0/8 --permanent

Answer

firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 service name=ssh accept' --permanent

Question 10

A Podman user wants to run a container that automatically removes itself after it stops, runs in detached mode, and maps host port 80 to container port 8080. Which command is correct?

Accepted Answer

podman run --rm -d -p 80:8080 nginx. The correct command is podman run --rm -d -p 80:8080 nginx. Option B correctly uses --rm to automatically remove the container after it stops, -d for detached mode, and -p 80:8080 to map host port 80 to container port 8080. Option A uses an invalid flag -rm and maps ports incorrectly (8080:80). Option C uses an invalid flag --remove. Option D maps ports incorrectly (8080:80).

Answer

podman run -rm -d -p 8080:80 nginx

Answer

podman run --remove -d -p 80:8080 nginx

Answer

podman run --rm -d -p 8080:80 nginx

Question 11

A system administrator is working with compressed files. Which THREE commands can be used to view their contents? (Select THREE).

Accepted Answer

zgrep. The commands zgrep, zcat, and zless are used to search, concatenate, and view compressed files respectively. They are analogous to grep, cat, and less but work on compressed files. The other options, cat and less, do not handle compressed files directly.

Answer

cat

Answer

less

Question 12

A system administrator needs to install a package from a local RPM file without resolving dependencies automatically. Which command should be used?

Accepted Answer

rpm -i package.rpm. The `rpm -i package.rpm` command installs the specified RPM package without automatically resolving dependencies. The `-i` flag stands for 'install' and, unlike `-U` (upgrade) or higher-level tools like `yum` or `dnf`, it does not attempt to fetch or satisfy missing dependencies from configured repositories. This is the correct choice when the requirement is to install a local RPM file while explicitly avoiding automatic dependency resolution.

Answer

rpm -U package.rpm

Answer

yum localinstall package.rpm

Answer

dnf install ./package.rpm

Question 13

An administrator needs to capture network traffic on interface eth0 to a file for later analysis. Which tcpdump command is correct?

Accepted Answer

tcpdump -w capture.pcap -i eth0. Both A and C are valid tcpdump commands. tcpdump accepts options in any order, so '-w capture.pcap -i eth0' (A) and '-i eth0 -w capture.pcap' (C) are functionally equivalent. Option B uses '-f' which is for filter expression, not output file. Option D is invalid because '-w' expects a filename, not an interface.

Answer

tcpdump -i eth0 -f capture.pcap

Answer

tcpdump -w eth0 capture.pcap

Question 14

A newly configured DNS server is unable to resolve any queries from clients. The server is running and network connectivity is verified. What should the administrator check first?

Accepted Answer

Check if the DNS service is listening on UDP port 53. The most common reason a DNS server fails to resolve queries despite being running and having network connectivity is that the DNS service is not listening on UDP port 53, which is the default port for DNS queries per RFC 1035. Checking this with a command like `ss -ulpn | grep :53` or `netstat -uan | grep :53` directly verifies whether the service is actually accepting incoming queries. This is the first logical step before investigating client-side configurations or rebooting.

Answer

Check /etc/resolv.conf on clients

Answer

Check if DNS service is bound to the loopback address

Answer

Reboot the DNS server

Question 15

A security analyst needs to see a list of failed login attempts on a Linux system. Which command displays this information from the /var/log/btmp log?

Accepted Answer

lastb. lastb shows failed login attempts by reading the /var/log/btmp file. last reads /var/log/wtmp for successful logins, lastlog shows last login per user from /var/log/lastlog, and faillog is an older command that reads from /var/log/faillog.

Answer

lastlog

Answer

last

Answer

faillog

Question 16

A technician needs to find out which port the SSH daemon is listening on. Which command will show this information?

Accepted Answer

ss -tlnp. The `ss -tlnp` command displays listening TCP sockets with numeric addresses and the associated process information. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` prevents DNS resolution, and `-p` reveals the PID and program name. Since SSH daemon (sshd) listens on TCP port 22 by default, this command will show the listening port and the sshd process.

Answer

lsof -i :22

Answer

nmap -p 22 localhost

Answer

netstat -i

Question 17

A system administrator is troubleshooting a server that is experiencing periodic slowdowns. The administrator runs the 'ps aux' command and notices a process named 'cpu_burn' that is consistently using over 90% CPU. The administrator wants to identify which user is running the process and then terminate it. The server runs Red Hat Enterprise Linux 8. Which command should the administrator use to determine the owner of the 'cpu_burn' process?

Accepted Answer

ps -eo pid,user,comm | grep [c]pu_burn. 'ps -eo pid,user,comm | grep [c]pu_burn'. This command uses 'ps -e' to list all processes, '-o pid,user,comm' to output only the PID, user, and command name, and then 'grep [c]pu_burn' to filter for the 'cpu_burn' process while avoiding matching the grep command itself (a common trick using a character class). The output shows the user owning the process in the second column. Option A, 'ps -u cpu_burn', attempts to show processes owned by a user named 'cpu_burn', not processes with that name. Option B, 'ps -ef | grep cpu_burn', includes the grep process in the output and does not make the owner column stand out. Option C, 'top -bn1 | grep cpu_burn', is interactive and less efficient for scripting. Therefore, D is the most precise and scriptable method to identify the owner.

Answer

ps -u cpu_burn

Answer

ps -ef | grep cpu_burn

Answer

top -bn1 | grep cpu_burn

Question 18

A user wants to look up the mail exchange (MX) records for a domain. Which command should be used?

Accepted Answer

dig domain.com MX. The `dig` command is a flexible DNS lookup utility that can query any record type by specifying it after the domain name. `dig domain.com MX` directly queries the DNS for mail exchange records, which specify the mail servers responsible for receiving email for the domain. This is the most straightforward and commonly used command for this purpose in Linux.

Answer

ping domain.com

Answer

host -t mx domain.com

Answer

nslookup -type=mx domain.com

Question 19

A developer needs to grant a colleague read and write access to a directory /project, but the colleague should not have permission to delete any files created by the developer. The developer wants to set the directory so that all new files created in it automatically belong to the group 'project' and are writable by group. Which combination of configuration should be used?

Accepted Answer

chmod g+s /project && setfacl -m default:g:project:rw /project. It combines the setgid bit (`chmod g+s`) on the directory, which ensures new files inherit the group 'project', with a default ACL (`setfacl -m default:g:project:rw`) that grants read and write permissions to the group on newly created files. This setup gives the colleague (who is a member of the 'project' group) read/write access without delete permission on files owned by the developer, as the colleague cannot delete files they do not own unless the directory's sticky bit is set (which is not configured here).

Answer

chmod 1770 /project && usermod -aG project colleague

Answer

chmod g+s /project && setfacl -m g:project:rwx /project

Answer

chown .project /project && chmod 2775 /project

Question 20

Refer to the exhibit. A systemd service is failing to start and is in a restart loop. What is the most likely cause?

Accepted Answer

The service attempts to bind to a port that is already in use by another process.. The log shows 'bind: address already in use', indicating that the port required by the service is already occupied by another process. This causes the service to exit immediately, and systemd repeatedly restarts it, resulting in a restart loop. Therefore, Option A is correct. Option B is incorrect because there is no indication of a missing config file; the error is explicitly about port binding. Option C is incorrect because an OOM kill would produce an 'Out of memory' message in the kernel log, not a bind error. Option D is incorrect because a missing executable would cause a different error, such as 'Executable not found' in the service status.

Answer

The application is crashing due to a missing configuration file.

Answer

The service is using too much memory and is being killed by the OOM killer.

Answer

The service executable is not found on the system.