XK0-005 Practice Test 6 — 10 Questions

Question 1

An administrator needs to deploy a containerized web application on a Linux server. The application requires port 8080 to be mapped to host port 80. Which command will run the container in detached mode with this port mapping?

Accepted Answer

docker run -d -p 80:8080 webapp. Option D is correct because the `-d` flag runs the container in detached mode, and `-p 80:8080` maps host port 80 to container port 8080, which matches the requirement. The syntax is `-p host_port:container_port`, so `-p 80:8080` correctly exposes the application's container port 8080 on the host's port 80.

Answer

docker run -p 80:8080 webapp

Answer

docker run -d -p 8080:80 webapp

Answer

docker run -d -p 8080:80 webapp

Question 2

Refer to the exhibit. The system administrator runs the command 'auditctl -l' and sees the above rules. What is the purpose of these audit rules?

Accepted Answer

To log any changes (write or attribute) to the password, shadow, and group files. The audit rules use the `-w` flag to watch the files `/etc/passwd`, `/etc/shadow`, and `/etc/group` for `wa` (write and attribute change) syscalls. This logs any modification to these critical authentication and authorization files, such as user additions, password changes, or permission changes, which is essential for security monitoring.

Answer

To log all successful login attempts on the system

Answer

To log any modifications to the audit configuration itself

Answer

To log all read accesses to /etc/passwd, /etc/shadow, and /etc/group

Question 3

A Linux server is configured to allow SSH access for remote administration. The security team wants to limit SSH access to only users in the 'ssh-users' group. Which configuration should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups ssh-users. Option B is correct because the AllowGroups directive in /etc/ssh/sshd_config restricts SSH logins to only those users who are members of the specified group. By setting 'AllowGroups ssh-users', only users belonging to the 'ssh-users' group will be permitted to authenticate via SSH, directly fulfilling the security team's requirement.

Answer

AllowUsers ssh-users

Answer

DenyUsers root

Answer

PermitRootLogin yes

Question 4

An administrator runs the commands shown in the exhibit. The container is accessible via curl using the container IP. However, the administrator cannot access the web server using the host's IP address on port 80. What is the most likely cause?

Accepted Answer

The container's port 80 is not published to the host.. Option B is correct because the administrator ran `docker run -d nginx` without the `-p` or `--publish` flag, which means port 80 inside the container is not mapped to any port on the host. The container is accessible via its own IP because Docker networking allows direct container-to-container communication, but the host's IP on port 80 remains unbound, so curl to the host IP fails. Publishing the port with `-p 80:80` would expose the container's port 80 on the host's interface.

Answer

The container's IP address is incorrect.

Answer

Nginx is configured to listen on a different port.

Answer

The container is not running.

Question 5

A Linux administrator is writing a Bash script to automate the backup of a database. The script must run a pre-backup command, check its exit status, and if successful, proceed with the backup; otherwise, log an error and exit. Which code snippet correctly implements this logic?

Accepted Answer

pre_backup_cmd
if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi
backup_cmd. Option C correctly runs the pre-backup command, then checks its exit status with `$?`. If the exit status is not zero (indicating failure), it logs an error to stderr and exits with code 1. Only if the pre-backup command succeeds does the script proceed to the backup command. This matches the requirement exactly: check exit status, log error on failure, and exit.

Answer

set -e
pre_backup_cmd
backup_cmd

Answer

pre_backup_cmd && backup_cmd || echo 'Error' >&2

Answer

(pre_backup_cmd; if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi) && backup_cmd

Question 6

A container is running a database service that requires persistent storage. The administrator wants to ensure that data persists even if the container is removed. Which volume mount type should be used in the Docker run command?

Accepted Answer

--mount type=bind. Option B is correct because a bind mount directly maps a host directory into the container, ensuring that data written to that mount point persists on the host filesystem even after the container is removed. This is ideal for database services that require persistent storage independent of the container lifecycle.

Answer

--mount type=volume

Answer

COPY in Dockerfile

Answer

--mount type=tmpfs

Question 7

A Linux system experiences high CPU usage from a process that appears to be a fork bomb. The administrator wants to prevent such attacks in the future by limiting the number of processes a user can create. Which configuration file should be modified, and what parameter should be set?

Accepted Answer

Add 'username hard nproc 100' in /etc/security/limits.conf. Option C is correct because /etc/security/limits.conf is the PAM-based configuration file used to set per-user resource limits via the 'nproc' parameter. Adding 'username hard nproc 100' enforces a hard limit of 100 processes for that user, preventing a fork bomb from exhausting system resources.

Answer

Set 'kernel.pid_max=100' in /etc/sysctl.conf

Answer

Set 'DefaultLimitNPROC=100' in /etc/systemd/system.conf

Answer

Add 'ulimit -u 100' to /etc/profile

Question 8

A DevOps engineer needs to automate the deployment of a microservice using Ansible. The playbook should install the latest version of nginx on all web servers. Which Ansible module should be used in the playbook?

Accepted Answer

apt: name=nginx state=latest. Option C is correct because the `apt` module is the proper Ansible module for managing packages on Debian-based systems, and `state=latest` ensures the most recent version of nginx is installed. This aligns with the requirement to automate deployment using Ansible's declarative package management rather than imperative shell commands.

Answer

service: name=nginx state=started

Answer

command: apt install nginx

Answer

yum: name=nginx state=latest

Question 9

A system administrator notices that a cron job runs every 5 minutes but should run only on weekdays. The current crontab entry is: */5 * * * * /usr/local/bin/script.sh. Which change to the time fields will restrict execution to Monday through Friday?

Accepted Answer

*/5 * * * 1-5 /usr/local/bin/script.sh. Option C is correct because the fifth field in a crontab entry specifies the day of the week, where 1 represents Monday and 5 represents Friday. By setting this field to `1-5`, the cron job will only execute on weekdays, while the `*/5` in the minute field ensures it still runs every 5 minutes. The other fields remain as `*` to allow execution at any hour and any day of the month.

Answer

*/5 9-17 * * 1-5 /usr/local/bin/script.sh

Answer

*/5 * * * 1-6 /usr/local/bin/script.sh

Answer

5 * * * 1-5 /usr/local/bin/script.sh

Question 10

An administrator runs 'mount -a' and receives the error shown in the exhibit. The /home partition was recently removed and replaced with a new disk. Which of the following steps should the administrator take to resolve the issue?

Accepted Answer

Run 'blkid /dev/sda3' to find the new UUID and update /etc/fstab.. The error occurs because the /home partition was replaced with a new disk, so its UUID (or device identifier) in /etc/fstab no longer matches the actual disk. Running 'blkid /dev/sda3' retrieves the new UUID, which must then be updated in /etc/fstab so that 'mount -a' can mount the correct device automatically.

Answer

Run 'mount /dev/sda3 /home' to mount the partition manually.

Answer

Run 'fsck /dev/sda3' to check the filesystem.

Answer

Run 'mkfs.ext4 /dev/sda3' to create a new filesystem.