XK0-006 Practice Test 9 — 10 Questions

Question 1

A developer reports that a Docker container on a CentOS 7 host cannot connect to the internet. The host itself can access the internet. The container is started with default bridge network. The administrator checks iptables and sees the FORWARD policy is DROP. What is the most likely cause and solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add iptables rules to allow forwarding and enable masquerading.. The default Docker bridge network relies on iptables NAT (masquerading) and FORWARD rules to allow containers to reach external networks. When the FORWARD policy is set to DROP, the host drops all forwarded packets from the container, blocking outbound internet access. Adding iptables rules to allow forwarding (e.g., `-A FORWARD -i docker0 -j ACCEPT`) and enabling masquerading (e.g., `-t nat -A POSTROUTING -s 172.17.0.0/16 -o eth0 -j MASQUERADE`) restores connectivity.

Answer

The container needs to be run with --network host.

Answer

The container's DNS configuration is incorrect.

Answer

AppArmor is blocking outbound connections.

Question 2

A security policy requires that SSH root login be disabled, but key-based authentication for users should remain enabled. Which configuration line should be added to /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin prohibit-password. The directive `PermitRootLogin prohibit-password` in `/etc/ssh/sshd_config` disables password-based authentication for the root user while still allowing key-based authentication (e.g., SSH public key or GSSAPI). This satisfies the security policy requirement to disable root login via passwords but retain the ability for users (including root) to authenticate using SSH keys.

Answer

PermitEmptyPasswords no

Answer

PermitRootLogin no

Answer

PasswordAuthentication yes

Question 3

An administrator wants to change the runlevel/target to a state where only a minimal set of processes is running, and network services are disabled. Which two systemd targets achieve this? (Choose two.)

Accepted Answer

rescue.target. (rescue.target) is correct because it boots the system into a single-user mode with a minimal set of processes and no network services, allowing administrative tasks like filesystem repairs. Option E (emergency.target) is correct because it starts an even more minimal environment with only a root shell on the console, also disabling network services. Both targets satisfy the requirement of minimal processes and disabled networking.

Answer

graphical.target

Answer

poweroff.target

Answer

multi-user.target

Question 4

A system administrator is hardening SSH and needs to disable root login and password authentication. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and PasswordAuthentication no. Disabling root login and password authentication are two separate directives in sshd_config. PermitRootLogin no prevents direct SSH access for the root user, and PasswordAuthentication no disables password-based logins, forcing the use of key-based authentication. Both directives are required to meet the hardening goal.

Answer

PermitRootLogin no and ChallengeResponseAuthentication no

Answer

DenyUsers root and PasswordAuthentication no

Answer

PermitRootLogin prohibit-password and PasswordAuthentication yes

Question 5

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Accepted Answer

Set PermitRootLogin no in /etc/ssh/sshd_config. Setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct root login via SSH, forcing administrators to log in as a regular user and then use `su` or `sudo` for privilege escalation. This reduces the attack surface by eliminating the ability to brute-force the root password directly over SSH.

Answer

Set PermitRootLogin yes

Answer

Set PasswordAuthentication yes

Answer

Disable the SSH service

Question 6

A Docker container needs to persistently store data that should survive container removal and be accessible by other containers. Which storage method should be used?

Accepted Answer

Volume. Volumes are managed by Docker and persist independently of containers. Bind mounts depend on host filesystem structure. tmpfs is temporary and stored in memory. The question asks for persistent storage that can be shared, so volumes are best.

Answer

Bind mount

Answer

Container layer

Answer

tmpfs mount

Question 7

A Linux administrator needs to implement a cron job that runs a script every day at 2:30 PM. Which TWO cron schedule expressions are equivalent?

Accepted Answer

30 14 * * *. In cron syntax, the first field is minute (0-59), the second is hour (0-23) in 24-hour format. 2:30 PM corresponds to hour 14 in 24-hour time. Therefore, '30 14 * * *' correctly specifies the job runs at minute 30 of hour 14 every day. Option A and E are identical and both use the correct 24-hour representation.

Answer

30 2 * * * PM

Answer

30 2 * * *

Answer

30 2 * * *

Question 8

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

Accepted Answer

strace -p <PID>. strace can attach to a running process with -p PID and display all system calls made by the process.

Answer

tcpdump -i any

Answer

ltrace -p <PID>

Answer

lsof -p <PID>

Question 9

A technician needs to troubleshoot a network connectivity issue on a Linux server. The server can ping its own IP address but cannot ping the default gateway. Which of the following is the most likely cause?

Accepted Answer

The Ethernet cable is disconnected or the switch port is down.. The server can ping its own IP address (loopback or local interface), confirming that the network stack is functioning and the interface is up. However, the inability to ping the default gateway indicates a Layer 1 or Layer 2 issue, such as a disconnected Ethernet cable or a switch port that is administratively down, which prevents any traffic from leaving the local subnet.

Answer

The default gateway is misconfigured in the routing table.

Answer

The DNS resolver is not configured correctly.

Answer

The iptables firewall is blocking outgoing ICMP traffic.

Question 10

An administrator needs to find all files in /var/log that have been modified within the last 2 days. Which find command should be used?

Accepted Answer

find /var/log -mtime -2. -mtime -2 means modified less than 2 days ago (i.e., within the last 48 hours).

Answer

find /var/log -mtime +2

Answer

find /var/log -atime -2

Answer

find /var/log -ctime 2