XK0-006 Practice Exam 57 — 20 Questions

Question 1

A DevOps engineer needs to run a Docker container in the background with port mapping from host port 8080 to container port 80, and name the container 'webapp'. Which command accomplishes this?

Accepted Answer

docker run -d -p 8080:80 --name webapp nginx. The docker run command with -d (detach), -p (port mapping), and --name options is the correct way to run a container in the background with port mapping and a name.

Answer

docker start -d -p 8080:80 --name webapp nginx

Answer

docker create -d -p 8080:80 --name webapp nginx

Answer

docker compose up -d -p 8080:80 --name webapp nginx

Question 2

A script needs to iterate over all .txt files in a directory. Which loop structure correctly implements this?

Accepted Answer

for f in *.txt; do. The `for f in *.txt; do` loop is correct because it uses shell globbing to expand `*.txt` into a list of all .txt filenames in the current directory, then iterates over each filename. This is the standard and most efficient way to process a set of files matching a pattern in Bash and POSIX shell scripting.

Answer

while read line; do

Answer

select option; do

Answer

until condition; do

Question 3

A technician needs to create a new ext4 filesystem on /dev/sdb1 and mount it persistently at /mnt/data. Which set of commands accomplishes this?

Accepted Answer

mkfs -t ext4 /dev/sdb1; mount /dev/sdb1 /mnt/data; echo '/dev/sdb1 /mnt/data ext4 defaults 0 2' >> /etc/fstab. Only option A correctly creates the filesystem, mounts it immediately, and adds the entry to /etc/fstab for persistent mounting. Option B creates the filesystem and adds the fstab entry, but does not mount the filesystem, so it does not accomplish the task of having the filesystem mounted immediately.

Answer

mkfs.ext4 /dev/sdb1; echo '/dev/sdb1 /mnt/data ext4 defaults 0 2' >> /etc/fstab

Answer

mkfs.ext4 /dev/sdb1; mount /dev/sdb1 /mnt/data

Answer

echo '/dev/sdb1 /mnt/data ext4 defaults 0 2' >> /etc/fstab; mount -a

Answer

fdisk /dev/sdb1; mount /dev/sdb1 /mnt/data; echo '/dev/sdb1 /mnt/data ext4 defaults 0 2' >> /etc/fstab

Question 4

Which tool is used for encrypting files with public-key cryptography on Linux systems?

Accepted Answer

GnuPG. GnuPG (GNU Privacy Guard) is the correct tool because it implements the OpenPGP standard (RFC 4880) for encrypting and signing files using public-key cryptography. It allows users to generate a key pair, encrypt a file with the recipient's public key, and decrypt it with the corresponding private key, making it the standard Linux utility for asymmetric file encryption.

Answer

bcrypt

Answer

LUKS

Answer

OpenSSL

Question 5

An administrator wants to view the last 20 lines of a log file and continue to watch for new entries. Which command should be used?

Accepted Answer

tail -f. The command tail -f follows a file and continues to display new entries as they are appended. Although tail -f by default shows only the last 10 lines, it is the only listed option that meets the 'continue to watch' requirement. To view exactly the last 20 lines while following, the full command would be tail -n 20 -f (or tail -20f), but among the provided options, tail -f is the correct choice.

Answer

tail -20

Answer

head -20

Answer

less -N

Question 6

A containerized application uses a volume to persist data. The administrator needs to create a new volume named 'data-vol' and mount it to /app/data in the container. Which of the following commands accomplish this? (Select all that apply.)

Accepted Answer

docker run --mount type=volume,source=data-vol,target=/app/data myapp. Both options A and C are correct because they create the volume automatically if it doesn't exist and mount it to the container. The `--mount` flag (option A) uses a more explicit syntax compared to the `-v` flag (option C), but both achieve the same result. Option B is incorrect because the leading slash in `/data-vol` causes a bind mount from the host, not a named volume. Option D is incorrect because it uses two separate commands (`docker volume create` and `docker run`), while the question asks for a single command that both creates and mounts the volume.

Answer

docker run -v /data-vol:/app/data myapp

Answer

docker volume create data-vol && docker run -v data-vol:/app/data myapp

Question 7

Sarah is a Linux systems administrator for a company that runs a web application inside a Podman container. The container is launched using a systemd service file on a Red Hat Enterprise Linux 8 server. The service file is located at /etc/systemd/system/webapp.service and includes an ExecStart directive that runs `podman run -d --name webapp -p 80:80 nginx`. The server was recently rebooted for kernel updates. After the reboot, the web application is not responding. Sarah logs in and runs `systemctl status webapp.service`, which shows the service is 'disabled' and 'inactive'. She wants to ensure that the container starts automatically after every future reboot. What should Sarah do?

Accepted Answer

Run `systemctl enable webapp.service` and then start the service.. `systemctl enable webapp.service` creates the necessary symlinks to start the service automatically at boot, and `systemctl start webapp.service` immediately starts the container. Since the service is currently disabled and inactive, enabling it ensures the systemd unit is triggered on future reboots, which will execute the `ExecStart` command to run the Podman container.

Answer

Add the line `@reboot /usr/bin/podman start webapp` to root's crontab.

Answer

Modify the container image to include a restart policy of 'always'.

Answer

Run `podman generate systemd --new --name webapp` to create a new systemd unit.

Question 8

Which TWO commands can be used to display the current kernel version on a Linux system?

Accepted Answer

uname -r. The `uname -r` command displays the kernel release version, which is the standard way to quickly check the current kernel version. The `cat /proc/version` command reads the /proc/version file, which contains a string that includes the kernel version, compiler information, and build date, making it another reliable method to view the kernel version.

Answer

modinfo

Answer

lsmod

Answer

dmesg

Question 9

A Linux administrator is troubleshooting network connectivity. The server can ping its own IP address but cannot ping the default gateway. The output of 'ip route show' is: 'default via 10.0.0.1 dev eth0 proto static metric 100'. The output of 'ping -c 1 10.0.0.1' fails with 'Destination Host Unreachable'. Which of the following is the MOST likely cause?

Accepted Answer

The subnet mask on eth0 is incorrect, causing the gateway to be considered on a different network.. The server can ping its own IP address, confirming that the local network stack and the eth0 interface are operational. However, the 'Destination Host Unreachable' error when pinging the default gateway (10.0.0.1) indicates that the host does not have a valid route to that destination. Since the default route exists, the most likely cause is an incorrect subnet mask on eth0, which causes the kernel to treat the gateway as being on a different network, thus failing to send ARP requests or forward packets to it.

Answer

The eth0 interface is down.

Answer

The gateway is down or not responding.

Answer

The default gateway is not set.

Question 10

A technician needs to create a self-signed certificate and private key for a web server. Which OpenSSL command should be used?

Accepted Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. The `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA 2048-bit private key and immediately creates a self-signed X.509 certificate in a single step. The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a certificate signing request (CSR), and `-nodes` ensures the private key is not encrypted with a passphrase, which is typical for a web server that must start without manual intervention.

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -key key.pem -out cert.pem

Answer

openssl x509 -req -in req.pem -signkey key.pem -out cert.pem

Answer

openssl ca -in req.pem -out cert.pem

Question 11

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration directive should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups sshusers. The AllowGroups directive in sshd_config restricts SSH access to users who are members of the specified group(s).

Answer

AllowUsers sshusers

Answer

Match Group sshusers

Answer

DenyGroups all

Question 12

Which TWO commands can be used to view a list of all running processes with their PIDs? (Choose two.)

Accepted Answer

ps. The `ps` command (option A) is correct because it displays a snapshot of current processes, and when used without options it shows processes for the current shell; with options like `-e` or `aux` it lists all running processes along with their PIDs. The `top` command (option C) is correct because it provides a real-time, dynamic view of all running processes, including their PIDs, and is commonly used for monitoring system activity.

Answer

pidof

Answer

ls

Answer

pstree

Question 13

Which TWO statements about container security are correct when using Docker? (Choose two.)

Accepted Answer

Using --cap-drop=ALL removes all capabilities, making the container more secure.. Using `--cap-drop=ALL` removes all Linux capabilities from the container, which eliminates any privileged operations the container could perform. This forces the container to run with the absolute minimum privileges, significantly reducing the attack surface and making it more secure.

Answer

SELinux is automatically enabled inside containers.

Answer

Containers have their own kernel, isolated from the host.

Answer

Using --network=host increases container isolation.

Question 14

An administrator needs to ensure that a script runs once at system initialization, before any network services start. Which systemd target should the script be associated with?

Accepted Answer

sysinit.target. The sysinit.target is the correct target because it is designed for early system initialization tasks that must complete before any network or multi-user services start. Scripts associated with this target run during the boot process, after the basic system is initialized but before network services are brought up, ensuring the script executes once at system initialization.

Answer

multi-user.target

Answer

basic.target

Answer

network.target

Question 15

A custom udev rule for a new USB device is not being applied. The rule file is correctly placed in /etc/udev/rules.d/ with .rules extension. What is the most likely cause?

Accepted Answer

The rule uses a wrong attribute or value. The most likely cause is that the rule uses a wrong attribute or value. Udev rules are matched against device attributes (e.g., vendor ID, product ID, subsystem) exposed by the kernel via sysfs. If the rule specifies an incorrect attribute name, a typo in a value, or a mismatch with the actual device properties, the rule will not trigger. Since the file is correctly placed and named, the failure is almost always due to a mismatch in the matching criteria.

Answer

The rule file is not executable

Answer

The device is not recognized by the kernel

Answer

The rule file is in a subdirectory

Question 16

A system is experiencing high load average. The administrator runs 'vmstat 1 5' and sees a high 'wa' value. What does this indicate?

Accepted Answer

High disk I/O wait. The 'wa' column in vmstat output indicates the percentage of time the CPU is waiting for I/O operations to complete. A high 'wa' value means the CPU is idle because it is blocked waiting for disk I/O, which directly points to high disk I/O wait. This is a classic indicator of a storage bottleneck.

Answer

High memory swapping activity

Answer

High CPU usage by user processes

Answer

High network I/O

Question 17

Which two commands can be used to view the SELinux context of files or processes?

Accepted Answer

ps auxZ. `ps auxZ` displays the SELinux context for each running process, showing the user, role, type, and sensitivity level associated with the process. Option E is correct because `ls -Z` shows the SELinux context of files and directories, including the security label that defines access controls. Both commands are standard Linux utilities that expose the SELinux security context attribute.

Answer

chcon

Answer

getenforce

Answer

setenforce

Question 18

A technician needs to identify the network interface configuration and IP address of a system. Which command provides the most comprehensive output for this task?

Accepted Answer

ip addr show. The `ip addr show` command is the most comprehensive because it displays all network interfaces along with their IP addresses (IPv4 and IPv6), MAC addresses, MTU, state (UP/DOWN), and additional flags. It is part of the modern `iproute2` suite, which is the standard for Linux network configuration and supersedes older tools like `ifconfig`.

Answer

nmcli dev show

Answer

netstat -i

Answer

ifconfig

Answer

hostname -I

Question 19

Refer to the exhibit. A Linux administrator created a systemd service file for a custom script. When starting the service, it fails with 'Unit myservice.service entered failed state.' Which of the following is the most likely cause?

Accepted Answer

The ExecStart path is relative. The most likely cause is that the ExecStart path is relative. Systemd requires absolute paths for ExecStart directives; a relative path (e.g., `./script.sh` or just `script.sh`) will cause the unit to fail immediately because systemd cannot resolve the executable location. The error 'entered failed state' typically results from this path resolution failure.

Answer

The service type should be forking

Answer

The service file lacks an [Install] section

Answer

The Requires directive is missing

Question 20

A DevOps engineer needs to run a container that executes a batch job and then exits. The container image is stored in a private registry. Which Docker command should be used to run the container and automatically remove it after it exits?

Accepted Answer

docker run --rm private.registry.com/batch:latest. The `docker run --rm` command automatically removes the container after it exits, which is ideal for batch jobs that should not leave behind stopped containers. The image reference `private.registry.com/batch:latest` pulls from a private registry when not cached locally. This combination ensures the container runs once, completes its task, and is cleaned up without manual intervention.

Answer

docker start --rm private.registry.com/batch:latest

Answer

docker run -d private.registry.com/batch:latest

Answer

docker exec --rm private.registry.com/batch:latest