XK0-006 Practice Exam 61 — 20 Questions

Question 1

A cron job runs a script that uses a command only available in a custom directory. The script fails from cron but works in the user's shell. Which of the following is the most common cause?

Accepted Answer

The cron job does not source the user's .bashrc. The most common cause is that cron jobs run in a minimal environment and do not source the user's shell initialization files like .bashrc. This means the custom directory containing the command is not in the PATH variable when the script executes under cron, even though it works in the user's interactive shell where .bashrc is sourced.

Answer

The script is not executable

Answer

The script has incorrect line endings

Answer

The cron job runs as root but command is in user's PATH

Question 2

A junior administrator writes a bash script to check disk usage and send an email alert. The script runs manually but does not execute from cron. Which of the following is the most likely cause?

Accepted Answer

Absolute path not specified in crontab. When a script runs manually from the command line but fails from cron, the most common cause is that cron does not inherit the user's PATH environment. Without an absolute path to the script in the crontab entry, cron cannot locate the script. Option D directly addresses this: specifying the full path (e.g., /home/user/script.sh) ensures cron can find and execute it.

Answer

Script not marked executable

Answer

Incorrect file permissions on cron job

Answer

Missing shebang line

Question 3

A DevOps engineer wants to run a Docker container with a bind mount to make a host directory /data available at /mnt/data inside the container. Which command is correct?

Accepted Answer

docker run --mount type=bind,source=/data,target=/mnt/data ubuntu. The `--mount` flag with `type=bind` explicitly creates a bind mount, mapping the host directory `/data` to the container path `/mnt/data`. This syntax is more explicit and less error-prone than the older `-v` flag, especially when dealing with bind mounts on directories that do not exist yet or when additional mount options are needed.

Answer

docker run -v /data:/mnt/data:bind ubuntu

Answer

docker run -v /data:/mnt/data ubuntu

Answer

docker run --mount type=volume,source=/data,target=/mnt/data ubuntu

Question 4

A technician needs to replace all occurrences of '192.168.1.' with '10.0.0.' in the file /etc/network/interfaces and save the changes. Which command accomplishes this?

Accepted Answer

sed -i 's/192\.168\.1/10.0.0/g' /etc/network/interfaces. Uses `sed -i 's/192\.168\.1/10.0.0/g' /etc/network/interfaces`. The backslashes escape the dots, matching literal periods. The `-i` flag edits the file in-place. This replaces '192.168.1' (without the trailing dot) with '10.0.0', leaving the trailing dot intact, resulting in '10.0.0.' as required. Options A and C have unescaped dots, which match any character, making them imprecise. Option D also has unescaped dots and would incorrectly replace any character in place of the dots. Additionally, option C redirects to the same file, which can truncate it before reading completes.

Answer

awk '{gsub(/192.168.1./,"10.0.0.");print}' /etc/network/interfaces > tmp && mv tmp /etc/network/interfaces

Answer

sed 's/192.168.1./10.0.0./g' /etc/network/interfaces > /etc/network/interfaces

Answer

sed -i 's/192.168.1./10.0.0./g' /etc/network/interfaces

Question 5

Based on the exhibit, the service has failed. Which of the following is the most appropriate first step to diagnose the cause of the failure?

Accepted Answer

Check the script /usr/local/bin/myservice.sh for errors and run it manually. The exhibit indicates the service has failed, and the most appropriate first step is to check the script referenced in the unit file for errors and run it manually. This directly tests the executable that systemd is trying to run, isolating whether the failure is due to a script bug, missing dependencies, or permission issues, rather than assuming the service configuration or logs are the problem.

Answer

Check if the service is a timer and was triggered

Answer

Run systemctl daemon-reload to reload unit files

Answer

Restart the service using systemctl restart myservice.service

Answer

Run journalctl -u myservice.service to view logs

Question 6

A Linux administrator is configuring a firewall using iptables to allow incoming HTTP and HTTPS traffic but block all other incoming traffic. Which set of rules should be applied?

Accepted Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT. It sets the default policy for the INPUT chain to DROP, which blocks all incoming traffic by default, and then explicitly adds rules to ACCEPT TCP traffic on ports 80 (HTTP) and 443 (HTTPS). This implements a whitelist approach: only the specified services are allowed, and all other incoming packets are dropped by the default policy. The order is critical — the ACCEPT rules must be evaluated before the default DROP policy takes effect for unmatched traffic.

Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp -j ACCEPT

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -j DROP

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Question 7

An administrator needs to run a backup script every day at 2:00 AM. The script is located at /usr/local/bin/backup.sh and is executable. The administrator considers several methods to schedule this task. Which method should the administrator use to ensure the script runs at exactly 2:00 AM every day without additional configuration overhead?

Accepted Answer

Add the following line to the crontab for root: `0 2 * * * /usr/local/bin/backup.sh`. The correct method is to add a cron job via crontab because cron is the standard Unix/Linux utility for scheduling tasks at specific times. The syntax `0 2 * * *` precisely defines execution at 2:00 AM daily (minute 0, hour 2, every day, every month, every day of week), and the script path is fully qualified. This approach requires no additional configuration overhead beyond a single crontab entry.

Answer

Append the script path to /etc/rc.local file.

Answer

Place the script in /etc/cron.daily/ directory.

Answer

Create a systemd timer unit that triggers the script daily at 2:00 AM.

Question 8

A Linux administrator suspects a memory leak in a process. Which TWO commands can be used to monitor memory usage over time for a specific process? (Choose two.)

Accepted Answer

top. (top) is correct because it provides a real-time, interactive view of system processes, including memory usage (RES, VIRT, %MEM) that updates by default every 3 seconds. You can filter by PID to monitor a specific process over time, making it ideal for detecting memory growth patterns indicative of a leak.

Answer

vmstat

Answer

iostat

Answer

free

Question 9

A company policy requires all systems to have a specific set of security patches applied. The administrator needs to generate a report listing all installed packages that contain security updates available. Which command sequence should be used on Red Hat-based systems?

Accepted Answer

yum list-security. `yum list-security` is the specific command on Red Hat-based systems that lists all installed packages for which security updates are available. This directly satisfies the requirement to generate a report of installed packages with available security patches, as mandated by company policy.

Answer

yum check-update

Answer

yum updateinfo list security

Answer

yum info-sec

Answer

yum list updates

Question 10

An administrator needs to capture network traffic on interface eth0, filter for packets to/from host 10.0.0.1, and save the output to a file for later analysis. Which command should be used?

Accepted Answer

tcpdump -i eth0 host 10.0.0.1 -w capture.pcap. The `tcpdump` command with the `host` filter captures all traffic (both source and destination) to or from the specified IP address, which matches the requirement to filter for packets to/from host 10.0.0.1. The `-i eth0` specifies the interface, and `-w capture.pcap` writes the output to a file for later analysis.

Answer

tcpdump -i eth0 src 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 dst 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 -n host 10.0.0.1 -w capture.pcap

Question 11

You are a Linux administrator at a company that runs a web application in Docker containers on a single host. The application consists of a front-end container (nginx) and a back-end container (node.js). Recently, after a system update, the front-end container fails to start with the error: 'Error response from daemon: driver failed programming external connectivity on endpoint frontend: (iptables failed: iptables --wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.17.0.2 --dport 80 -j ACCEPT: iptables: No chain/target/match by that name)'. Which action should you take to resolve the issue?

Accepted Answer

Restart the Docker daemon with systemctl restart docker. The error indicates that the Docker daemon's iptables rules are corrupted or missing, often caused by a system update that restarted or modified the iptables service. Restarting the Docker daemon with `systemctl restart docker` forces Docker to reinitialize its iptables chains (e.g., DOCKER, DOCKER-USER) and reapply the necessary rules, resolving the connectivity failure.

Answer

Reinstall iptables

Answer

Change the network driver to macvlan

Answer

Update the kernel to the latest version

Question 12

An administrator needs to check the kernel ring buffer for hardware error messages after a system crash. Which command should be used?

Accepted Answer

dmesg. dmesg shows kernel ring buffer messages including hardware errors. journalctl -k shows kernel messages from systemd journal, but dmesg is the direct command for the ring buffer.

Answer

journalctl -k

Answer

tail -f /var/log/messages

Answer

strace -e trace=open

Question 13

An administrator is configuring a custom kernel module to be loaded automatically at boot for a specialized hardware device. The module is named 'custom_hw'. Which file should be created to ensure the module is loaded at boot?

Accepted Answer

/etc/modules-load.d/custom_hw.conf with the line 'custom_hw'. On modern Linux distributions using systemd, the /etc/modules-load.d/ directory contains .conf files listing kernel modules to load automatically at boot. Each file should contain one module name per line. Option B refers to /etc/sysconfig/modules/, which is used by older distributions but is not the standard for systemd-based systems. Option C is for setting module parameters, not for loading modules. Option D is for blacklisting modules, preventing them from loading.

Answer

/etc/sysconfig/modules/custom_hw.modules with modprobe commands

Answer

/etc/modprobe.d/custom_hw.conf with 'options custom_hw param=value'

Answer

/etc/modprobe.d/blacklist.conf with 'blacklist custom_hw'

Question 14

A system administrator installs a new application that is failing to write to its configuration file in /etc. SELinux is enforcing. Which command would show the relevant SELinux denials?

Accepted Answer

ausearch -m avc -ts recent. The `ausearch -m avc -ts recent` command queries the audit log for AVC (Access Vector Cache) denial messages, which are the specific SELinux denials logged when a process is blocked from accessing a resource. This is the direct way to view recent SELinux denials in an enforcing mode environment, as it filters audit records by message type (AVC) and time range (recent).

Answer

sealert

Answer

getenforce

Answer

audit2why

Question 15

An administrator wants to change the priority of a running process with PID 1234 to a lower priority (nicer). The current nice value is 0. Which command will set the nice value to 10?

Accepted Answer

renice 10 -p 1234. The `renice` command is used to alter the scheduling priority of an already running process. By default, a process starts with a nice value of 0. Running `renice 10 -p 1234` sets the nice value to 10, which is a lower priority (more 'nice') because the kernel adds this value to the dynamic priority calculation, giving the process less CPU time.

Answer

nice -n 10 kill 1234

Answer

chrt -p 10 1234

Answer

kill -10 1234

Question 16

A Linux administrator wants to create a Docker image from a Dockerfile. Which TWO of the following commands are needed? (Select TWO).

Accepted Answer

docker tag. To create a Docker image from a Dockerfile, two commands are typically used: `docker build` to build the image from the Dockerfile, and `docker tag` to assign a meaningful name and tag to the newly created image. While `docker build` alone creates the image, tagging is necessary for easy identification and management, especially when preparing to push to a registry. Therefore, both commands are needed to fully create a usable Docker image.

Answer

docker run

Answer

docker push

Answer

docker commit

Question 17

Which TWO commands can be used to check the kernel version currently running on a system? (Choose two.)

Accepted Answer

cat /proc/version. The file /proc/version contains the kernel version string, including the version number and compiler information, as maintained by the kernel at boot time. Reading this file with cat displays the exact kernel version currently running on the system.

Answer

sysctl kernel.version

Answer

lsb_release -a

Answer

uptime

Question 18

A database administrator needs to schedule a one-time system backup to run at 2:00 AM tomorrow. Which command should be used?

Accepted Answer

at 2:00 AM tomorrow. The `at` command is specifically designed to schedule a one-time job at a specified time, making it the correct choice for a backup that runs exactly once at 2:00 AM tomorrow. It accepts natural language time specifications like '2:00 AM tomorrow' and executes the command at that moment without recurring.

Answer

systemd-run --on-calendar='*-*-* 02:00:00' /usr/bin/backup

Answer

echo '/usr/bin/backup' | atq

Answer

crontab -e

Question 19

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups sshusers. The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH login to users who are members of the specified group. By setting `AllowGroups sshusers`, only users belonging to the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This matches the administrator's requirement precisely.

Answer

AllowUsers sshusers

Answer

DenyUsers sshusers

Answer

PermitRootLogin no

Question 20

An administrator needs to find the line number of the first occurrence of the string 'ERROR' in a log file, ignoring case. Which command is most appropriate?

Accepted Answer

grep -in 'error' logfile. grep -in 'error' logfile will output the line numbers with matches, ignoring case. The first line will be shown first if no other sorting is applied.

Answer

grep -n 'ERROR' logfile

Answer

sed -n '/ERROR/=' logfile

Answer

awk '/ERROR/ {print NR}' logfile