XK0-006 Practice Exam 62 — 20 Questions

Question 1

A junior administrator needs to monitor system resource usage on a production server. Which TWO commands should the administrator use to check CPU and memory utilization in real-time? (Choose two.)

Accepted Answer

top. The `top` command provides a real-time, dynamic view of system processes, displaying CPU usage per process, memory utilization, and overall system load. It continuously updates, making it ideal for monitoring resource usage on a production server.

Answer

df

Answer

uptime

Answer

lsof

Question 2

You are a DevOps engineer managing a Git repository for a large development team. Your CI/CD pipeline runs automated tests on every push. Recently, developers have been pushing commits that break the build. You need to enforce that all commits pass the tests before being pushed to the remote repository. Which Git hook should you implement on the client side?

Accepted Answer

pre-push. The pre-push hook (option D) runs after a `git push` command is issued but before the data is actually sent to the remote repository. This allows you to run tests locally and abort the push if they fail, enforcing that only commits that pass tests are pushed. It is the correct client-side hook for this requirement.

Answer

pre-receive

Answer

pre-commit

Answer

post-commit

Question 3

A Linux engineer needs to harden SSH access. Which TWO of the following settings should be configured in /etc/ssh/sshd_config to enhance security? (Select TWO.)

Accepted Answer

PasswordAuthentication no. Disabling password authentication forces the use of SSH keys, which are resistant to brute-force attacks and credential stuffing. This setting eliminates the risk of weak or reused passwords being exploited, a fundamental hardening step for SSH access.

Answer

MaxAuthTries 6

Answer

Protocol 1

Answer

PermitRootLogin yes

Question 4

A system administrator wants to ensure that the /tmp directory is mounted with noexec to prevent code execution from temporary files. Which file should be modified to persist this across reboots?

Accepted Answer

/etc/fstab. The /etc/fstab file is the system configuration file that defines how disk partitions, block devices, and remote filesystems are mounted at boot time. Adding the noexec mount option to the /tmp entry in /etc/fstab ensures that the /tmp directory is mounted with the noexec flag persistently across reboots, preventing execution of binaries from temporary files.

Answer

/etc/mtab

Answer

/etc/sysconfig/network

Answer

/etc/security/limits.conf

Question 5

A user reports that a Linux workstation fails to boot and displays 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

The root filesystem device is incorrectly specified in the kernel command line.. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate the root filesystem device. The most likely cause is that the root filesystem device is incorrectly specified in the kernel command line (e.g., via a bootloader parameter like root=), preventing the kernel from finding the correct block device to mount as root.

Answer

A filesystem listed in /etc/fstab has errors.

Answer

A memory module is faulty.

Answer

The boot loader is missing or corrupted.

Question 6

A user reports that they cannot reach a remote server by hostname but can reach it by IP address. Which file should be checked first for possible misconfiguration?

Accepted Answer

/etc/resolv.conf. The /etc/resolv.conf file configures the system's DNS resolver, specifying the nameservers to query for hostname-to-IP resolution. Since the user can reach the remote server by IP but not by hostname, the issue is likely with DNS resolution, and /etc/resolv.conf is the first file to check for misconfigured or missing nameserver entries.

Answer

/etc/nsswitch.conf

Answer

/etc/hosts

Answer

/etc/sysconfig/network

Question 7

A custom application service 'myapp.service' fails to start on a RHEL 8 system with the error: "Failed at step EXEC spawning /usr/local/bin/myapp: Permission denied". The service runs as user 'myapp'. The binary /usr/local/bin/myapp has permissions 755 and is owned by root:root. The user myapp is not in the sudoers. The administrator checks SELinux and finds the binary has the context 'unconfined_u:object_r:usr_t:s0'. The service unit file does not specify any SELinux context. What is the most likely cause of the failure?

Accepted Answer

The SELinux context of the binary is incorrect; it should be bin_t.. The error occurs because SELinux is enforcing and the binary has the type 'usr_t', which is not allowed to be executed by the service's domain (probably init_t or custom domain). The correct type for executables in /usr/local/bin is 'bin_t'. The solution is to restore the SELinux context to the default for binaries using `restorecon -v /usr/local/bin/myapp` or changing it to bin_t. Option A is incorrect because permissions allow execution. Option C is unlikely because /usr/local/bin is in PATH. Option D is incorrect as user has execute permission.

Answer

The user myapp does not have read access to the binary.

Answer

The binary is located in a directory that is not in the systemd safe path.

Answer

The binary is not executable by myapp due to file permissions.

Question 8

A system administrator needs to configure a daily backup that creates hard links to unchanged files to save space. Which tool and option combination is most appropriate?

Accepted Answer

rsync -a --link-dest=/previous/backup /source /current/backup. `rsync -a --link-dest=/previous/backup /source /current/backup` creates a new backup directory (`/current/backup`) where files unchanged since the previous backup are represented as hard links to the corresponding files in `/previous/backup`, while changed or new files are copied normally. This saves disk space by avoiding duplicate storage of identical file content, which is the exact requirement for a daily backup with hard links to unchanged files.

Answer

dd if=/source of=/destination conv=sync

Answer

cp -al /source /destination

Answer

tar --hard-link --create /source > /destination/backup.tar

Question 9

A system is experiencing boot failures. The administrator wants to view kernel messages from the current boot to diagnose the issue. Which two commands can be used to see these messages? (Choose two.)

Accepted Answer

journalctl -k. `journalctl -k` displays kernel messages from the current boot by querying the systemd journal, which logs kernel ring buffer messages persistently. `dmesg` reads the kernel ring buffer directly and shows messages from the current boot cycle. Both commands provide the kernel diagnostic output needed to troubleshoot boot failures.

Answer

cat /proc/kmsg

Answer

tail -f /var/log/boot.log

Answer

vmstat -f

Question 10

An administrator needs to audit all write operations to the /etc/shadow file. Which audit rule should be added to /etc/audit/rules.d/audit.rules?

Accepted Answer

-w /etc/shadow -p wa. The audit rule `-w /etc/shadow -p wa` uses the `-w` (watch) flag to monitor the file for write (`w`) and attribute change (`a`) permissions, which captures all write operations to `/etc/shadow`. This is the standard syntax for auditing file writes in Linux auditd, and it directly meets the requirement to audit write operations without unnecessary syscall filtering.

Answer

-w /etc/shadow -k identity

Answer

-w /etc/shadow -p rwxa

Answer

-a always,exit -S open -F path=/etc/shadow

Question 11

A DevOps engineer is writing a Dockerfile for a Python web application. The base image is python:3.9-slim. The application code is in the current directory, and the container should expose port 8080. Which Dockerfile instructions correctly build the image and run the application using python app.py?

Accepted Answer

FROM python:3.9-slim
COPY . /app
WORKDIR /app
EXPOSE 8080
CMD ['python', 'app.py']. It uses the exec form of CMD (CMD ['python', 'app.py']), which directly executes the command without a shell, providing proper signal handling and is the recommended format. Option A uses shell form (CMD python app.py), which runs the command as a subprocess of /bin/sh and may not handle signals correctly, making it less ideal. Additionally, the Dockerfile must include WORKDIR to set the working directory and COPY to add code; all options have these but only B uses the correct CMD syntax.

Answer

FROM python:3.9-slim
COPY . /app
WORKDIR /app
EXPOSE 8080
CMD python app.py

Answer

FROM python:3.9-slim
COPY . /app
EXPOSE 8080
ENTRYPOINT python app.py

Answer

FROM python:3.9-slim
WORKDIR /app
COPY . .
EXPOSE 8080
RUN python app.py

Question 12

An administrator configures Docker as shown in the exhibit. After starting a container, the warning about the 'user' directive appears. What is the most likely cause?

Accepted Answer

The cgroup driver configured in daemon.json does not match the actual driver in use.. The warning about the 'user' directive indicates a mismatch between the cgroup driver configured in Docker's daemon.json and the cgroup driver actually in use by the system (e.g., systemd vs. cgroupfs). Docker expects the configured driver to match the system's init system; when they differ, Docker emits warnings because cgroup management may behave inconsistently, affecting resource limits and container isolation.

Answer

The storage driver overlay2 is not compatible with the systemd cgroup driver.

Answer

The container is running with reduced privileges, and nginx cannot use the 'user' directive.

Answer

The log driver configuration is causing nginx to log warnings.

Question 13

Refer to the exhibit. The development team is using Git to manage their project. A release candidate needs to include only the changes from the `feature/update` branch, but NOT the 'Add new module' commit. Which Git command sequence should be used to create a new release branch that contains only the feature branch?

Accepted Answer

git checkout -b release 1m2n3o4 && git cherry-pick 4d5e6f7 8f9g0h1. It creates a new release branch starting from the commit before the 'Add new module' commit (1m2n3o4), then cherry-picks only the two commits from the `feature/update` branch (4d5e6f7 and 8f9g0h1) that represent the desired changes. This ensures the release branch contains exactly the feature branch changes without including the unwanted 'Add new module' commit.

Answer

git checkout feature/update && git rebase 1m2n3o4

Answer

git checkout -b release master && git revert 2j3k4l5

Answer

git checkout -b release feature/update && git merge --no-ff master

Question 14

An administrator needs to generate a self-signed certificate and private key for an internal web server. Which OpenSSL command creates both in one step?

Accepted Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. The `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA private key and a self-signed X.509 certificate in a single step. The `-x509` flag outputs a self-signed certificate instead of a CSR, `-newkey` creates the key pair, and `-nodes` prevents encryption of the private key, which is typical for an internal web server that must start without manual passphrase entry.

Answer

openssl ca -in req.pem -out cert.pem

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365

Answer

openssl x509 -req -in req.pem -signkey key.pem -out cert.pem

Question 15

After writing a script, the administrator cannot execute it with './script.sh'. The permissions are '-rw-rw-r--'. Which command makes the script executable?

Accepted Answer

chmod u+x script.sh. The current permissions (`-rw-rw-r--`) show that the owner lacks execute permission. The command `chmod u+x script.sh` adds execute permission for the user (owner) only, which is the minimal and most secure way to make the script executable by the administrator who owns it. This directly addresses the requirement without granting unnecessary permissions to the group or others.

Answer

chmod +x script.sh

Answer

chmod g-x script.sh

Answer

chmod a+rwx script.sh

Question 16

An administrator wants to audit all attempts to access the file /etc/shadow. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/shadow -p rwxa -k shadow. `auditctl -w /etc/shadow -p rwxa -k shadow` sets a watch on the file for all access types: read (r), write (w), execute (x), and attribute change (a). This captures all attempts to access the file, including reads, which matches the requirement. Option C uses `-F perm=wa`, which only logs write and attribute changes, excluding reads. Option A has invalid syntax (`-A` instead of `-a`). Option D uses `ausearch`, which is for searching audit logs, not setting rules.

Answer

auditctl -A exit,always -F path=/etc/shadow -k shadow

Answer

auditctl -a always,exit -F path=/etc/shadow -F perm=wa -k shadow

Answer

ausearch -w /etc/shadow

Question 17

A user reports that the /data directory is inaccessible. The Linux administrator runs the commands shown in the exhibit. Which of the following is the most likely cause of the issue?

Accepted Answer

The filesystem is full and has become corrupted.. The 'Input/output error' when accessing /data, combined with the 'Structure needs cleaning' message from dmesg, indicates filesystem corruption on /dev/sdb1. This is a classic symptom of a full filesystem that has become corrupted, not a simple permission or mount issue. The administrator's inability to read or write to the directory, despite the mount appearing normal, points to underlying filesystem damage.

Answer

The user does not have read permissions on /data.

Answer

The device /dev/sdb1 is not present.

Answer

The filesystem is mounted as read-only.

Question 18

You are a systems administrator for a small company. The company uses a Linux server running Ubuntu 22.04 LTS that hosts a web application and a PostgreSQL database. The server has two network interfaces: eth0 (public IP) and eth1 (private IP). The web application listens on port 443 (HTTPS) on eth0, and the PostgreSQL database listens on port 5432 on eth1. The company security policy requires that only the web application should be accessible from the internet; all other ports must be blocked on the public interface. Additionally, SSH access should be allowed only from the internal network (192.168.1.0/24). The current iptables rules are as follows:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

There are no other rules. You need to implement the security policy using iptables. Which of the following sets of commands will achieve the required security policy?

Accepted Answer

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT. Option A correctly implements the security policy. It sets the default policy to DROP, allows established and related connections, permits HTTPS (port 443) on the public interface eth0, restricts SSH (port 22) to the internal network 192.168.1.0/24 on the private interface eth1, and allows all other traffic on eth1, which is necessary for internal services like PostgreSQL. The order of rules is irrelevant because each matches distinct conditions. Option B is incorrect because it omits the allow-all rule for eth1, causing internal traffic (including PostgreSQL) to be blocked by the default DROP policy. Option C is incorrect because it allows SSH on the public interface eth0 instead of the private eth1, violating the policy that SSH should be accessible only from the internal network. Option D is incorrect because it permits SSH from any source, not just the internal network.

Answer

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT

Question 19

Which THREE steps should be taken when diagnosing a network connectivity issue where a host cannot reach the internet but can ping the local gateway? (Select three.)

Accepted Answer

Examine the routing table with route -n. The `route -n` command displays the kernel routing table without resolving hostnames, allowing you to verify whether a default gateway route (0.0.0.0/0) exists. If the host can ping the local gateway but not the internet, a missing or incorrect default route is a common cause, as traffic to external networks would have no path to forward.

Answer

Check ARP cache for the gateway

Answer

Run traceroute to a known external IP

Question 20

In a bash script, an administrator wants to check if a file exists and is readable. Which of the following test expressions accomplishes this?

Accepted Answer

[ -f file -a -r file ]. The test expression `[ -f file -a -r file ]` uses the `-f` flag to check that the file exists and is a regular file, and the `-a` logical AND operator combined with the `-r` flag verifies that the file is readable by the current user. This matches the administrator's requirement exactly.

Answer

[ -e file -a -w file ]

Answer

test -d file -o -r file

Answer

[[ -f file && -x file ]]