XK0-006 Practice Exam 60 — 20 Questions

Question 1

A user runs the ping command and receives the output shown in the exhibit. Which of the following is the MOST likely cause of the issue?

Accepted Answer

The TTL value in the ping packet is too low.. The output shows 'Request timed out' or similar, which can occur when the TTL (Time to Live) value in the ping packet expires before reaching the destination. A TTL that is too low causes routers to decrement the value to zero and drop the packet, sending an ICMP Time Exceeded message back to the sender, but if the sender does not receive a reply, it indicates the packet never reached the destination. This is the most likely cause because the ping command uses a default TTL (e.g., 128 on Windows, 64 on Linux), and if the path requires more hops, the packet is silently discarded.

Answer

The destination host is down.

Answer

The local system does not have a default gateway configured.

Answer

There is a routing loop causing packets to be dropped.

Question 2

Refer to the exhibit. Alice is the owner of file.txt. Bob is a member of the staff group. What permissions does Bob have on file.txt?

Accepted Answer

Read only. Bob has read-only access because the ACL (Access Control List) for file.txt includes an entry 'user:bob:r--', which grants Bob read permission. This ACL entry overrides any group permissions, so even though the group 'staff' may have different permissions, Bob's effective permissions are determined by the ACL entry specific to him.

Answer

Read and write

Answer

No access

Answer

Write only

Question 3

What is the effect of the firewall rules shown?

Accepted Answer

SSH and ICMP echo-request are allowed; all other traffic is dropped.. The firewall rules shown explicitly allow SSH (port 22) and ICMP echo-request (type 8) traffic while the final default rule drops all other traffic. This matches option D, as the rules do not permit any other protocols or services, including loopback traffic unless it is SSH or ICMP echo-request.

Answer

Only SSH traffic to 192.168.1.10 is allowed; all other traffic is dropped.

Answer

Only SSH and loopback traffic are allowed; all other traffic is dropped.

Answer

All traffic on eth0 is allowed; loopback is allowed.

Question 4

A company is implementing a security policy that requires all files created in a shared directory /data to be owned by the group 'engineers' and have group read/write permissions, regardless of the user's umask. Which approach should be used?

Accepted Answer

Set the setgid bit and configure ACL default permissions on /data. Setting the setgid bit on /data ensures that new files inherit the group ownership of the directory (engineers), but it does not override the user's umask for permissions. Configuring ACL default permissions on /data explicitly sets the group read/write permissions for new files, overriding the umask. Together, they guarantee both correct group ownership and group rw permissions regardless of the user's umask.

Answer

Set the setgid bit only on /data

Answer

Set the sticky bit on /data

Answer

Configure ACL default permissions only on /data

Question 5

Drag and drop the steps to create and apply a systemd service unit in the correct order.

Accepted Answer

1. Create the service unit file in /etc/systemd/system/. 2. Run systemctl daemon-reload. 3. Run systemctl enable myservice.service. 4. Run systemctl start myservice.service.. The correct sequence to create and apply a systemd service unit is: create the unit file in /etc/systemd/system/, then run systemctl daemon-reload to load the new unit, then run systemctl enable to set it to start on boot, and finally run systemctl start to start it immediately. Common mistakes include enabling before reloading, starting before enabling, or attempting to enable a non-existent unit.

Answer

1. Create the service unit file. 2. Run systemctl enable myservice.service. 3. Run systemctl daemon-reload. 4. Run systemctl start myservice.service.

Answer

1. Create the service unit file. 2. Run systemctl daemon-reload. 3. Run systemctl start myservice.service. 4. Run systemctl enable myservice.service.

Answer

1. Run systemctl enable myservice.service. 2. Create the service unit file. 3. Run systemctl daemon-reload. 4. Run systemctl start myservice.service.

Question 6

A DevOps engineer is responsible for deploying a containerized web application on a Linux server running Docker. The application consists of three services: a frontend (Nginx), a backend (Node.js), and a database (PostgreSQL). The engineer uses Docker Compose to manage the stack. The deployment works correctly on a test environment, but when deployed to production, the frontend service fails to connect to the backend. Both services are on the same custom bridge network. The engineer checks the logs of the frontend container and sees 'getaddrinfo EAI_AGAIN backend-service'. The backend service is running and healthy. The engineer suspects a DNS resolution issue within the Docker network. Which of the following is the most likely cause and correct solution?

Accepted Answer

The frontend container is trying to resolve 'backend-service' but the backend container's hostname is different because the container_name is set in the docker-compose.yml.. The frontend container is attempting to resolve 'backend-service' via Docker's embedded DNS, but the backend container's hostname may differ if the `container_name` directive is set in the docker-compose.yml. Docker Compose creates a default hostname equal to the service name unless overridden by `container_name`. If `container_name` is set to something like 'my-backend', the DNS entry for 'backend-service' will not exist, causing an `EAI_AGAIN` (temporary failure in name resolution) error. The solution is to either use the correct hostname (the service name) or set `container_name` to match the expected hostname.

Answer

The containers are not on the same network because the default network driver is 'host' instead of 'bridge'.

Answer

The backend service is listening on a different port than expected.

Answer

The Docker DNS resolver is caching an old IP address for the backend service.

Question 7

An administrator runs the command `ls -l /data/file.txt` and sees the output: `-rw-r-----+ 1 root project 1024 Mar 15 10:00 file.txt`. The administrator wants to view the current ACL entries on this file. Which command should be used?

Accepted Answer

getfacl /data/file.txt. The `+` at the end of the permission string (`-rw-r-----+`) indicates that the file has extended ACL (Access Control List) entries beyond the standard Unix permissions. The `getfacl` command is the standard Linux utility to display the current ACL entries for a file or directory, showing user, group, and mask entries along with any named user or group ACLs.

Answer

chacl /data/file.txt

Answer

lsacl /data/file.txt

Answer

aclshow /data/file.txt

Question 8

A user reports that they cannot write files to their home directory. The administrator runs `ls -ld /home/user` and sees 'drwxr-xr-x'. Which command will allow the user to write to the directory?

Accepted Answer

chown user:user /home/user. The directory /home/user has permissions drwxr-xr-x, meaning the owner has rwx, group has r-x, and others have r-x. Since the user is not the owner (the owner is likely root), they cannot write. Option B (chown user:user /home/user) changes ownership to the user, granting them write access via the owner's w permission.

Answer

chmod 644 /home/user

Answer

usermod -aG user /home/user

Answer

chmod 755 /home/user

Answer

setfacl -m u:user:rwx /home/user

Question 9

A server running Ubuntu 20.04 has a custom application that is started as a systemd service. The service often fails to start after a system reboot, although it can be started manually with 'systemctl start myapp' without errors. The administrator checks the service status after boot and sees 'Failed to start myapp.service: Unit is not loaded properly: Invalid argument'. Which of the following is the most likely cause of this issue?

Accepted Answer

The ExecStart line in the unit file contains an invalid parameter or malformed path.. The error 'Invalid argument' indicates a syntax error or invalid directive in the systemd unit file. The most common cause is an incorrect path or syntax in the ExecStart line, which results in a malformed unit file. Option B is correct. Option A (binary does not exist) would produce a 'not found' error, not 'Invalid argument'. Option C (Type=oneshot without RemainAfterExit=yes) would cause a different behavior or error like 'Service has more than one ExecStop=' but not 'Invalid argument'. Option D (missing [Install] section) would prevent the service from being enabled, but the error shown is about unit loading, not missing section.

Answer

The service binary does not exist at the specified path.

Answer

The service uses a Type=oneshot but no RemainAfterExit=yes is set.

Answer

The service file has a missing [Install] section.

Question 10

An administrator is managing a server using systemd and needs to control services and units. Which THREE of the following are valid systemd commands for service management? (Choose three.)

Accepted Answer

systemctl mask. B is correct because 'systemctl mask' creates a symlink to /dev/null, making a unit completely unavailable and preventing it from being started manually or by dependencies. This is a valid systemd command for service management.

Answer

service start

Answer

chkconfig on

Question 11

A Linux server is experiencing high I/O wait, as shown by the 'iostat -x' command: 'avg-cpu: %iowait=45' and '/dev/sda: await=120ms, %util=95%'. The server has 16 GB of RAM, and the administrator notices that the system is using a significant amount of swap: 'free -m' shows 4 GB of swap used out of 8 GB. The server runs a database application that performs many synchronous writes. The administrator wants to reduce I/O wait without adding physical memory. Which of the following kernel parameter changes is most likely to help by reducing the frequency of write operations to disk?

Accepted Answer

Increase vm.dirty_writeback_centisecs from 500 to 1000.. Increasing vm.dirty_writeback_centisecs from 500 to 1000 halves the frequency of writeback flushes, allowing dirty pages to accumulate longer. This reduces the number of write operations to disk over time, which can lower I/O wait, especially if merges make each write more efficient. While synchronous database writes (fsync) are not directly delayed by this parameter, reducing background flushes frees up I/O bandwidth for those writes, lowering their wait times. Option A (increasing vm.dirty_ratio) allows more dirty pages but does not reduce write frequency; it may even cause larger bursts. Option C (setting vm.swappiness to 0) would not directly affect write frequency or I/O wait from database writes. Option D (decreasing vm.dirty_background_ratio) would start writeback sooner, increasing write frequency and likely worsening I/O wait. Therefore, Option B is correct.

Answer

Increase vm.dirty_ratio from 20 to 40.

Answer

Set vm.swappiness to 0.

Answer

Decrease vm.dirty_background_ratio from 10 to 5.

Question 12

Which THREE files are commonly used to store local user account information? (Select 3.)

Accepted Answer

/etc/group. The /etc/passwd file stores basic user account information (username, UID, GID, home directory, shell) in a colon-separated format. /etc/shadow stores encrypted password hashes and password aging data, separated from the world-readable /etc/passwd for security. /etc/group stores group definitions, including group name, GID, and member list, which is essential for local user group membership.

Answer

/etc/gshadow

Answer

/etc/login.defs

Question 13

A system administrator is troubleshooting why a user cannot execute a script in their home directory. Which TWO conditions could prevent execution? (Choose two.)

Accepted Answer

The script does not have the execute permission set for the user. For a user to execute a script, the file must have the execute permission bit set for that user (or for the group or others, depending on the user's relationship to the file). Without the execute permission (e.g., `chmod +x`), the shell will refuse to run the script directly, returning a 'Permission denied' error. Option D is correct because if the filesystem is mounted with the noexec option, no files on that filesystem can be executed, regardless of permissions. Option E is incorrect because /etc/shells is only used to validate login shells; it does not affect script execution. The interpreter for a script is determined by the shebang line, and the system will attempt to run it regardless of whether it's listed in /etc/shells. Options A and B are incorrect: file ownership does not directly prevent execution as long as the user has appropriate permissions, and umask only affects default permissions of newly created files, not existing ones.

Answer

The script is owned by a different user

Answer

The user's umask is set to 022

Answer

The script is interpreted by a shell that is not listed in /etc/shells

Question 14

Based on the exhibit, which file has an incorrect SELinux context for serving web content via Apache?

Accepted Answer

index.html. (index.html) because the exhibit shows that index.html has the SELinux context type 'user_home_t', which is not accessible by Apache's httpd process. Apache requires files served via HTTP to have the 'httpd_sys_content_t' context type (or 'httpd_sys_rw_content_t' for writable content) to be readable by the httpd daemon. Without this context, SELinux will block Apache from serving the file, even if file permissions and ownership are correct.

Answer

Neither

Answer

style.css

Answer

Both

Question 15

An administrator is troubleshooting a slow system. Which two commands can be used to identify processes consuming excessive CPU or memory? (Choose two.)

Accepted Answer

ps aux --sort=-%mem. `ps aux --sort=-%mem` lists all processes with their memory usage, sorted by memory consumption in descending order, making it easy to identify processes consuming excessive memory. Option E is correct because `top` provides a real-time, dynamic view of system processes, including CPU and memory usage, and allows sorting by these metrics interactively.

Answer

free -m

Answer

iostat -x

Answer

df -h

Question 16

A system administrator needs to check the current runlevel on a system that uses systemd. Which command should the administrator use?

Accepted Answer

systemctl get-default. On a systemd-based Linux system, runlevels are replaced by targets. The command `systemctl get-default` displays the default target, which is the runlevel-equivalent target that the system boots into by default. While it does not directly show the currently active runlevel if it has been changed after boot, it is the command most closely associated with checking the system's runlevel configuration among the given choices. To view the currently active target, `systemctl list-units --type=target` would be more precise.

Answer

hostnamectl

Answer

getenforce

Answer

uname -r

Question 17

A system administrator notices that a cron job runs every 5 minutes but should run only on weekdays. The current crontab entry is: */5 * * * * /usr/local/bin/script.sh. Which change to the time fields will restrict execution to Monday through Friday?

Accepted Answer

*/5 * * * 1-5 /usr/local/bin/script.sh. The fifth field in a crontab entry specifies the day of the week, where 1 represents Monday and 5 represents Friday. By setting this field to `1-5`, the cron job will only execute on weekdays, while the `*/5` in the minute field ensures it still runs every 5 minutes. The other fields remain as `*` to allow execution at any hour and any day of the month.

Answer

*/5 9-17 * * 1-5 /usr/local/bin/script.sh

Answer

*/5 * * * 1-6 /usr/local/bin/script.sh

Answer

5 * * * 1-5 /usr/local/bin/script.sh

Question 18

An administrator is configuring a server to act as a router and needs to enable IP forwarding persistently across reboots. Which file should be modified?

Accepted Answer

/etc/sysctl.conf. /etc/sysctl.conf is the system-wide configuration file for kernel parameters managed by sysctl. Setting net.ipv4.ip_forward = 1 in this file ensures IP forwarding is enabled persistently across reboots, as sysctl applies these settings during boot.

Answer

/etc/network/interfaces

Answer

/etc/rc.local

Answer

/proc/sys/net/ipv4/ip_forward

Question 19

A sysadmin needs to set a default gateway for a network interface. Which command(s) accomplish this?

Accepted Answer

Both B and C. Both the legacy `route` command (route add default gw 192.168.1.1) and the modern `ip route` command (ip route add default via 192.168.1.1) can be used to set a default gateway. Therefore, the correct choice is D, which includes both valid commands. `netstat -rn` only displays routing information and cannot modify routes.

Answer

netstat -rn

Answer

route add default gw 192.168.1.1

Answer

ip route add default via 192.168.1.1

Question 20

An Apache web server hosted on a Linux system is unable to connect to a backend database server on port 3306. Based on the exhibit, which action should the administrator take to resolve the issue?

Accepted Answer

Set the httpd_can_network_connect boolean to on.. The Apache web server cannot connect to the backend database server on port 3306 because SELinux is blocking the outbound network connection. The boolean `httpd_can_network_connect` controls whether the httpd daemon is allowed to initiate outbound TCP connections to remote hosts. Setting this boolean to `on` permits Apache to connect to the database server, resolving the connectivity issue without disabling SELinux entirely.

Answer

Disable SELinux by setting SELINUX=disabled in /etc/selinux/config.

Answer

Enable the httpd_enable_home_dirs boolean.

Answer

Change the SELinux context of the index.html file to httpd_sys_content_t.