XK0-006 Practice Test 8 — 10 Questions

Question 1

A Linux administrator wants to ensure a Bash script exits immediately if any command fails. Which directive should be included at the beginning of the script?

Accepted Answer

set -e. The `set -e` directive (equivalent to `set -o errexit`) causes the shell to exit immediately when any command returns a non-zero exit status, unless that command is part of a condition (if/while/until) or followed by `||`. This is the standard way to make a Bash script fail fast on the first error. Placing it near the top of the script ensures subsequent commands are not executed after a failure.

Answer

set -o pipefail

Answer

set -u

Answer

set -x

Question 2

A technician suspects a process is leaking file descriptors. Which command can be used to list open files associated with a specific PID?

Accepted Answer

lsof -p PID. The lsof (list open files) command with the -p flag filters output to show all open files associated with a specific process ID. Since Linux treats file descriptors as open files (including sockets, pipes, and regular files), lsof -p PID is the canonical tool for diagnosing file descriptor leaks by revealing exactly what a process has open.

Answer

top -p PID

Answer

strace -p PID

Answer

ltrace -p PID

Question 3

A user cannot start the Apache web service. The command 'systemctl start httpd' returns 'Failed to start httpd.service: Unit not found.' What is the most likely cause?

Accepted Answer

The httpd package is not installed. The error 'Failed to start httpd.service: Unit not found' indicates that systemd cannot locate a service unit file for httpd. This most commonly occurs when the httpd package (Apache HTTP Server) is not installed on the system. Without the package, no service unit file exists under /usr/lib/systemd/system/, so systemctl cannot start the service.

Answer

Network configuration is incorrect

Answer

Incorrect file permissions on /etc/httpd/

Answer

Disk space is full

Question 4

A Linux administrator is troubleshooting a service that fails to start. The audit.log shows an AVC denial related to the httpd_t domain. The administrator wants to see the full denial message and generate a policy to allow the access. Which two commands should be used in conjunction?

Accepted Answer

ausearch and audit2allow. `ausearch` retrieves the full AVC denial message from the audit log, and `audit2allow` generates a policy module to allow the denied access. Together, they enable the administrator to first identify the exact denial and then create a custom SELinux policy to permit the httpd_t domain's blocked action.

Answer

auditctl and ausearch

Answer

ausearch and restorecon

Answer

aureport and audit2why

Question 5

A server is unable to resolve hostnames via DNS. The /etc/resolv.conf file appears correct. Which command can be used to test DNS resolution and display the full query path?

Accepted Answer

dig +trace example.com. The `dig +trace example.com` command performs a full iterative DNS resolution from the root nameservers down to the authoritative nameservers for the queried domain, displaying each step of the query path. This is the correct choice because the question specifically asks to 'display the full query path,' which `+trace` provides by following referrals step by step, unlike simpler queries that only show the final answer.

Answer

nslookup example.com

Answer

host example.com

Answer

resolvectl query example.com

Question 6

An administrator needs to check the current routing table on a Linux system. Which command should be used?

Accepted Answer

ip route. The `ip route` command displays the kernel routing table, showing the paths that packets take to reach network destinations. This is the standard tool on modern Linux systems for viewing and manipulating routing entries, replacing the older `route -n` command.

Answer

dig -t A

Answer

ss -r

Answer

ip neigh

Question 7

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and AllowGroups sshusers. The directive `PermitRootLogin no` explicitly disallows root login via SSH, and `AllowGroups sshusers` restricts SSH access to only members of the 'sshusers' group. This combination meets both requirements: disabling root login and limiting access to a specific group. The `AllowGroups` directive is group-based, unlike `AllowUsers`, which is user-based.

Answer

DenyRootLogin yes and AllowGroups sshusers

Answer

PermitRootLogin prohibit-password and AllowGroups sshusers

Answer

PermitRootLogin no and AllowUsers sshusers

Question 8

A Linux server in a DMZ is experiencing intermittent SSH lockouts. The /var/log/secure shows repeated failed login attempts from multiple IP addresses, but then suddenly the administrator cannot SSH in even with correct credentials. The administrator suspects a brute-force protection mechanism. The server uses PAM with pam_tally2 for login counting. The administrator checks /etc/pam.d/sshd and sees: auth required pam_tally2.so deny=3 unlock_time=300 onerr=succeed file=/var/log/tallylog. What is the most likely reason the administrator is locked out even after 5 minutes?

Accepted Answer

The root account is not subject to pam_tally2 without the 'even_deny_root' option, so the lockout is from another mechanism. Pam_tally2 does not apply to the root account unless the 'even_deny_root' option is explicitly added to the pam_tally2 configuration line. Since the administrator is likely logging in as root (or the root account is being targeted), the lockout observed is not from pam_tally2 but from another mechanism such as sshd's own MaxAuthTries or a separate service like fail2ban. The configuration shown only denies regular users after 3 failures and unlocks after 300 seconds, but root remains unaffected by this rule.

Answer

The SSH server is not configured with UsePAM yes, so pam_tally2 is not applied

Answer

The tallylog file has incorrect permissions, preventing pam_tally2 from reading the count

Answer

The DenyHosts service is running and blocks IPs after too many failures

Question 9

Which shebang ensures maximum portability across systems for a Python script?

Accepted Answer

#!/usr/bin/env python3. `#!/usr/bin/env python3` uses the `env` utility to locate the `python3` interpreter in the user's `PATH`, making the script portable across different Unix-like systems where Python 3 may be installed in various directories (e.g., `/usr/bin/python3`, `/usr/local/bin/python3`). This shebang avoids hardcoding an absolute path, which is the key to maximum portability.

Answer

#!/bin/python

Answer

#!/usr/bin/python

Answer

#!/usr/local/bin/python3

Question 10

Which of the following directories is defined by the Filesystem Hierarchy Standard (FHS) as containing essential user command binaries that need to be available in single-user mode?

Accepted Answer

/bin. /bin contains essential command binaries required for booting and single-user mode.

Answer

/sbin

Answer

/opt/bin

Answer

/usr/bin