XK0-006 Practice Exam 59 — 20 Questions

Question 1

An administrator wants to gather information about disk usage for a specific directory and its subdirectories. Which TWO commands can be used for this purpose? (Choose two.)

Accepted Answer

du -sh /path. du -sh /path gives a summary of total disk usage. du -h /path shows disk usage for each subdirectory in human-readable format. df shows filesystem-level usage, not directory-level.

Answer

df -h /path

Answer

ls -lh /path

Answer

stat /path

Question 2

A system administrator wants to enforce a password policy requiring a minimum length of 12 characters, at least one uppercase letter, and one digit. Which PAM module should be configured?

Accepted Answer

pam_pwquality. pam_pwquality is the correct PAM module because it is specifically designed to enforce password complexity requirements, such as minimum length, uppercase letters, and digits, through configurable parameters like minlen, ucredit, and dcredit. It replaces the older pam_cracklib and is the standard module for password quality checks on modern Linux systems.

Answer

pam_unix

Answer

pam_faillock

Answer

pam_tally2

Question 3

An administrator is tasked with setting up a new server that will run a time-sensitive application. The system must have accurate time synchronization. The administrator configures chronyd and adds four NTP servers. After verifying, the administrator notices that the system time drifts significantly. Which configuration parameter in /etc/chrony.conf is most likely causing the drift despite multiple servers?

Accepted Answer

local stratum 10. The `local stratum 10` directive tells chronyd to treat the local clock as a time source with stratum 10 even when it is not synchronized to any external NTP server. This effectively disables the client's ability to discipline the system clock using the configured NTP servers, because chronyd will consider the local clock as a valid reference and not apply corrections from the remote servers, leading to significant time drift.

Answer

pollinterval 2

Answer

minsources 2

Answer

makestep 100 -1

Answer

maxslewrate 1000

Question 4

A sysadmin runs the command and sees the exhibit output. What is the most likely cause of the db pod's status?

Accepted Answer

The application inside the container is repeatedly crashing.. The pod's status shows a high restart count (e.g., 5+ restarts) in the output of `kubectl get pods`, which is the classic indicator of a CrashLoopBackOff state. This occurs when the container's entrypoint process exits repeatedly, causing the container to crash and be restarted by the kubelet, until the back-off delay increases. The most likely cause is that the application inside the container is repeatedly crashing, not a resource or node issue.

Answer

The container is out of memory.

Answer

The node running the pod is unreachable.

Answer

The pod does not have enough CPU resources.

Question 5

A system administrator needs to run a script every 15 minutes. Which systemd unit type is used to schedule this?

Accepted Answer

systemd timer. Systemd timers are the native systemd unit type for scheduling tasks at specified intervals, such as every 15 minutes. They replace traditional cron jobs in systemd-based Linux distributions and are defined with a .timer unit file that triggers a corresponding .service unit. This makes option A correct because the question explicitly asks for the systemd unit type used for scheduling.

Answer

at job

Answer

anacron

Answer

cron job

Question 6

A technician suspects that a DNS resolution issue is causing connectivity problems. Which command can be used to query the DNS server for an A record for 'example.com'?

Accepted Answer

dig example.com A. The `dig` command is a flexible DNS lookup utility that can query specific record types. Using `dig example.com A` directly queries the DNS server for the IPv4 address (A record) of 'example.com', making it the correct choice for diagnosing DNS resolution issues.

Answer

traceroute example.com

Answer

ping example.com

Answer

nslookup example.com A

Question 7

A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)

Accepted Answer

nft list ruleset. `nft list ruleset` is the standard command to display the entire current nftables ruleset in a human-readable format, which is essential for troubleshooting complex firewall configurations. Option C is correct because `nft add rule inet filter input tcp dport 443 accept` is the proper syntax to append a new rule to the specified chain (here, the 'input' chain of the 'filter' table in the 'inet' family) that accepts TCP traffic on port 443.

Answer

nft insert rule

Answer

nft show ruleset

Answer

nft -a list ruleset

Question 8

A server running RHEL 8 has intermittent network connectivity. The administrator wants to view the current DNS resolver configuration. Which file should be examined?

Accepted Answer

/etc/resolv.conf. /etc/resolv.conf contains nameserver entries. /etc/nsswitch.conf defines order, /etc/hosts for static mapping, and /etc/sysconfig/network-scripts/ifcfg-* for interface config.

Answer

/etc/sysconfig/network-scripts/ifcfg-eth0

Answer

/etc/nsswitch.conf

Answer

/etc/hosts

Question 9

A Linux administrator needs to configure auditing to monitor changes to the /etc/passwd file. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/passwd -p wa -k passwd_changes. The correct command is option B. It uses the -w watch syntax to monitor /etc/passwd for write (w) and attribute change (a) permissions, which is the standard and simplest method for auditing changes. Option D is a valid syscall-based alternative but is more complex and not the best answer for this question. Option A includes read permission, which is unnecessary. Option C monitors unlink and rename syscalls, not direct file modifications.

Answer

auditctl -w /etc/passwd -p rwxa -k passwd_changes

Answer

auditctl -a exit,always -S unlink -S rename -F path=/etc/passwd

Answer

auditctl -a always,exit -F path=/etc/passwd -F perm=wa -k passwd_changes

Question 10

A user cannot write to a directory that has permissions 755. The user is not the owner but belongs to the group. Which command would allow the user to write?

Accepted Answer

chmod 770 /directory. The directory currently has permissions 755, meaning the owner has rwx (7), the group has r-x (5), and others have r-x (5). Since the user belongs to the group but is not the owner, they need group write permission. The chmod 770 command sets the group permission to rwx (7), granting the user write access while preserving owner and group ownership semantics.

Answer

chmod 755 /directory

Answer

chmod 777 /directory

Answer

chmod 700 /directory

Question 11

A systems administrator is troubleshooting a server that fails to boot and displays the error: 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which TWO of the following are most likely causes? (Choose two.)

Accepted Answer

Missing or misconfigured root filesystem in /etc/fstab. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or mount the root filesystem. A missing or misconfigured root filesystem entry in /etc/fstab (e.g., wrong device name, wrong UUID, or missing entry) prevents the kernel from mounting the root partition, leading to a kernel panic. The 'unknown-block(0,0)' specifically means the kernel cannot resolve the block device for the root filesystem.

Answer

Faulty RAM

Answer

Overwritten MBR

Answer

Incorrect boot loader configuration pointing to wrong kernel

Question 12

The output of df -h shows the root filesystem at 100% capacity. Which of the following commands should the administrator run NEXT to identify the cause?

Accepted Answer

du -sh /*. The `du -sh /*` command calculates and displays the disk usage of each top-level directory in the root filesystem. When `df -h` shows 100% capacity, the next logical step is to identify which directories are consuming the most space, so the administrator can drill down further. This command is the standard tool for pinpointing space hogs before taking corrective action.

Answer

fdisk -l /dev/sda

Answer

fsck /dev/sda1

Answer

ls -la /

Question 13

Refer to the exhibit. An administrator creates this systemd unit file for a backup script. When the administrator runs `systemctl start backup.service`, the script runs but the service shows 'inactive (dead)' immediately. What change should be made to keep the service active until the script finishes?

Accepted Answer

Add 'RemainAfterExit=yes' to the [Service] section. Adding 'RemainAfterExit=yes' to the [Service] section tells systemd to consider the service as active even after the main process (the backup script) exits. Without this directive, systemd sees the process terminate and immediately marks the service as 'inactive (dead)', even though the script may still be running or its effects are ongoing. This is the standard way to keep a service unit in an 'active' state after the main command completes.

Answer

Change the service type to 'forking'

Answer

Add 'ExecStop' to the service definition

Answer

Change the service type to 'simple'

Question 14

A network administrator needs to diagnose connectivity issues from a Linux server to a remote host. Which of the following tools can provide information about the path and latency? (Choose three.)

Accepted Answer

mtr. C (mtr) is correct because it combines the functionality of traceroute and ping into a single diagnostic tool, continuously probing each hop along the path to a remote host and reporting both the route and real-time latency statistics. This makes it ideal for identifying where packet loss or high latency occurs along the network path.

Answer

iproute

Answer

netstat

Question 15

A system administrator is troubleshooting a service that fails to start. They want to see the recent logs for that specific service unit. Which journalctl command should be used?

Accepted Answer

journalctl -u service_name. The `-u` option in `journalctl` filters logs by the systemd unit name, allowing you to view recent logs specifically for a service. This is the correct approach when troubleshooting a service that fails to start, as it isolates the relevant log entries without noise from other system messages.

Answer

journalctl -k

Answer

tail -f /var/log/syslog

Answer

journalctl -p err

Question 16

Which TWO container networking modes allow a container to have its own IP address on the host network? (Choose TWO.)

Accepted Answer

Macvlan. Macvlan mode assigns each container a unique MAC address and IP address from the host's physical network, making the container appear as a separate device on the same subnet. Bridge mode creates a virtual bridge (typically docker0) and assigns containers IPs from a private subnet, allowing them to communicate with the host network via NAT. Both modes give the container its own IP address on the host network, though bridge uses a private range while macvlan uses the host's subnet directly.

Answer

Host

Answer

None

Answer

Overlay

Question 17

What does the output in the exhibit indicate about the /etc/shadow file?

Accepted Answer

The file has an SELinux context.. The output in the exhibit shows the SELinux context for the /etc/shadow file, which is indicated by the string 'system_u:object_r:shadow_t:s0' appended to the file's permissions. This is the SELinux security context, consisting of user, role, type, and sensitivity level. The `ls -Z` command displays this context, confirming that the file has an SELinux label applied.

Answer

The file is encrypted.

Answer

The file has an ACL applied.

Answer

The file is compressed.

Question 18

A user attempts to run a command using sudo but receives 'user is not in the sudoers file. This incident will be reported.' Which file should be edited to grant the user sudo access?

Accepted Answer

Use visudo to edit /etc/sudoers. The sudoers file, typically located at /etc/sudoers, controls which users and groups are permitted to run commands with sudo. The visudo command must be used to edit this file safely, as it performs syntax checking to prevent lockouts due to misconfiguration. Directly editing /etc/sudoers with a regular text editor can lead to syntax errors that break sudo functionality.

Answer

Edit /etc/passwd directly

Answer

Edit /etc/group to add user to the wheel group

Answer

Edit /etc/shadow

Question 19

A Linux administrator is troubleshooting a DNS resolution issue. They need to query the MX record for example.com using a specific DNS server at 8.8.8.8. Which command should they use?

Accepted Answer

dig MX example.com @8.8.8.8. dig @server type name queries a specific DNS server for the specified record type.

Answer

host -t MX example.com 8.8.8.8

Answer

nslookup -type=MX example.com 8.8.8.8

Answer

ping -c 1 example.com

Question 20

A system administrator notices that the httpd service fails to start. Which command should be used to view the most recent log entries for that specific service?

Accepted Answer

journalctl -u httpd. C is correct because `journalctl -u httpd` queries the systemd journal for log entries specifically associated with the httpd service unit. This command shows the most recent log messages for that service, including startup failures, error codes, and dependency issues, making it the direct and precise tool for troubleshooting a service that fails to start.

Answer

systemctl status httpd

Answer

dmesg | grep httpd

Answer

tail -f /var/log/messages