XK0-006 Hard Questions — 25 Difficult Questions

Question 1

A Linux system fails to boot and displays a kernel panic immediately after the GRUB menu. The administrator needs to boot into a rescue environment. Which GRUB boot parameter should the administrator add to the kernel line?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

systemd.unit=rescue.target. When a Linux system experiences a kernel panic immediately after GRUB, the administrator needs to boot into a minimal rescue environment that loads essential system services. The `systemd.unit=rescue.target` parameter tells systemd to start the rescue target, which mounts the root filesystem and starts only the most basic services, allowing the administrator to diagnose and repair the system. This is the proper GRUB kernel parameter for systemd-based distributions to enter a rescue shell without fully booting into the default multi-user or graphical target.

Answer

single

Answer

init=/bin/bash

Answer

quiet splash

Question 2

A Linux server experiences a kernel panic after a recent driver update. The system is still operational but unstable. Which command should be used to gather detailed information about the kernel modules currently loaded?

Accepted Answer

lsmod. B is correct because `lsmod` lists all currently loaded kernel modules by reading the `/proc/modules` file, showing their size, usage count, and dependencies. In a kernel panic scenario after a driver update, this command quickly reveals which modules are active, helping identify the problematic driver without further destabilizing the system.

Answer

modinfo

Answer

dmesg

Answer

modprobe -l

Question 3

A DevOps engineer wants to reduce the size of a Docker image by combining build stages. Which Dockerfile feature should be used?

Accepted Answer

Multi-stage builds (multiple FROM statements). Multi-stage builds, implemented by using multiple FROM statements in a single Dockerfile, allow a DevOps engineer to copy only the necessary artifacts from intermediate build stages into the final image. This eliminates build-time dependencies, tools, and intermediate layers from the final image, significantly reducing its size without sacrificing build functionality.

Answer

RUN --mount=type=cache

Answer

Layer caching

Answer

Using a smaller base image like Alpine

Question 4

During a security audit, a Linux administrator finds that an unauthorized service is listening on TCP port 4444. The service is not managed by systemd. Which of the following commands should the administrator use to identify the process and disable it?

Accepted Answer

Run 'ss -tlnp | grep :4444' to find the PID, then use 'kill' to terminate the process.. 'ss -tlnp' lists TCP listening sockets with numeric addresses and the associated process PID. Piping the output through 'grep :4444' isolates the unauthorized service, and the PID can then be used with 'kill' to terminate the process. Since the service is not managed by systemd, systemctl commands are irrelevant, making 'kill' the appropriate method to stop the process.

Answer

Run 'fuser 4444/tcp' to find the PID and then use 'systemctl stop' to stop the service.

Answer

Run 'lsof -i :4444' to find the PID, then use 'systemctl disable' to disable the service.

Answer

Run 'systemctl status' to find the service name, then use 'systemctl stop' to stop it.

Question 5

A Linux administrator is writing a Bash script to automate the backup of a database. The script must run a pre-backup command, check its exit status, and if successful, proceed with the backup; otherwise, log an error and exit. Which code snippet correctly implements this logic?

Accepted Answer

pre_backup_cmd
if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi
backup_cmd. Ly runs the pre-backup command, then checks its exit status with `$?`. If the exit status is not zero (indicating failure), it logs an error to stderr and exits with code 1. Only if the pre-backup command succeeds does the script proceed to the backup command. This matches the requirement exactly: check exit status, log error on failure, and exit.

Answer

set -e
pre_backup_cmd
backup_cmd

Answer

pre_backup_cmd && backup_cmd || echo 'Error' >&2

Answer

(pre_backup_cmd; if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi) && backup_cmd

Question 6

A system fails to boot with a kernel panic. The administrator suspects a corrupt initramfs or missing kernel module. Which three methods could be used to recover the system? (Choose three.)

Accepted Answer

Boot from a live CD/DVD, mount the root filesystem, and chroot. At the GRUB menu, editing boot parameters to add 'rd.break' drops into an emergency shell; adding 'single' boots into single-user mode; booting from a live CD allows chroot and repair.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Use 'systemctl rescue' from the boot prompt

Question 7

A system administrator is configuring firewalld on a Linux server. They want to allow incoming HTTPS traffic permanently for the public zone. Which command should be used?

Accepted Answer

firewall-cmd --add-service=https --zone=public --permanent. The `firewall-cmd --add-service=https --zone=public --permanent` command adds the HTTPS service (TCP port 443) to the public zone and makes the rule persistent across reboots. The `--permanent` flag ensures the change survives a firewall reload or system restart, and the `--zone=public` targets the correct network zone for incoming traffic.

Answer

firewall-cmd --zone=public --add-service=https

Answer

firewall-cmd --service=https --add --zone=public --permanent

Answer

firewall-cmd --add-port=443/tcp --zone=public --permanent

Question 8

During boot, the system stops at a shell with limited functionality. The administrator suspects the root filesystem is corrupted. Which target should the system be booted into to perform recovery?

Accepted Answer

emergency.target. emergency.target provides a minimal environment with a single-user shell, suitable for filesystem repairs without starting other services.

Answer

rescue.target

Answer

multi-user.target

Answer

graphical.target

Question 9

A Linux security administrator needs to generate a self-signed certificate for a web server. They want to create a private key and a certificate signing request (CSR) in one step. Which OpenSSL command should be used?

Accepted Answer

openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem. The 'req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem' command generates a new private key and CSR. The other options either generate a self-signed certificate directly or are incomplete.

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -key key.pem -out req.pem

Answer

openssl req -new -key key.pem -out req.pem

Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

Question 10

An administrator is troubleshooting a service that fails to start. They want to trace the system calls made by the service binary. Which command should they use?

Accepted Answer

strace. strace traces system calls and signals. It is used to debug what a program is doing at the kernel level.

Answer

ltrace

Answer

dmesg

Answer

lsof

Question 11

In a Bash script, the administrator wants to capture the output of a command into a variable. Which syntax should be used?

Accepted Answer

$(command). Command substitution can be done with $(command) or backticks `command`. The latter is deprecated. $(( )) is for arithmetic expansion. $VAR is for variable expansion.

Answer

$VAR

Answer

$((command))

Answer

`command`

Question 12

A Linux administrator wants to check the history of CPU usage for the past two days using the system activity reporter. Which sar option retrieves data from the daily history file for a specific date?

Accepted Answer

sar -f /var/log/sa/sa$(date +%d --date='2 days ago'). sar -f /var/log/sa/saDD reads from the history file for a specific day (DD is the day of month).

Answer

sar -r -b

Answer

sar -n DEV

Answer

sar -u -s 00:00:00 -e 23:59:59

Question 13

During boot, the system drops into an emergency target. Which command can be used to repair the root filesystem from this environment?

Accepted Answer

fsck /dev/sda1. In emergency mode, the root filesystem is often mounted read-only. fsck can check and repair filesystems, but requires the filesystem to be unmounted.

Answer

mount -o remount,rw / && fsck /

Answer

xfs_repair /dev/sda1

Answer

journalctl -xb

Question 14

A system administrator configures PAM to enforce account lockout after 3 failed login attempts. Which PAM module should be used?

Accepted Answer

pam_faillock. pam_faillock is the correct PAM module for enforcing account lockout after a specified number of failed login attempts. It tracks failed authentication attempts per user and can lock the account when the threshold (e.g., 3 attempts) is reached, typically by writing to a tally file like /var/log/faillock.

Answer

pam_pwquality

Answer

pam_securetty

Answer

pam_unix

Question 15

Given the journalctl output for the httpd service, which of the following is the most likely cause?

Accepted Answer

The /var/www directory is missing the execute (x) permission for the Apache user. The journalctl output for the httpd service likely shows 'Permission denied' errors when Apache tries to serve files from /var/www. The most common cause is that the /var/www directory lacks the execute (x) permission for the Apache user (typically 'apache' or 'www-data'). Without execute permission on the directory, Apache cannot traverse into it to access files, even if the files themselves have correct permissions. This is a standard Linux permission issue distinct from SELinux or file-level read permissions.

Answer

The file /var/www/html/index.html has incorrect SELinux context

Answer

The Apache service is running under the wrong user

Answer

The file /var/www/html/index.html is missing read permission for the Apache user

Question 16

A system administrator runs 'umask 027' in a Bash shell. What will be the default permissions for a new directory created in that shell? (Assume no other umask changes.)

Accepted Answer

rwxr-x--- (750). The umask value 027 subtracts permissions from the base 777 for directories. 777 minus 027 equals 750, which translates to rwxr-x---. The owner gets full permissions (rwx), the group gets read and execute (r-x), and others get no permissions (---).

Answer

rwxrwxr-x (775)

Answer

rwxrwxrwx (777)

Answer

rw-rw-r-- (664)

Question 17

Refer to the exhibit. A web server is experiencing performance issues. Based on the process list shown, which action should the administrator take first?

Accepted Answer

Identify and restart the parent process to clean up the zombie.

Answer

Increase the PID limit in /proc/sys/kernel/pid_max.

Answer

Kill the parent process of the zombie (PID 1234).

Answer

Terminate the zombie process with SIGKILL.

Question 18

Which TWO tools are specifically designed to detect rootkits on a Linux system?

Accepted Answer

rkhunter. B is correct because rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors, and possible local exploits by comparing file hashes, checking for hidden processes, and analyzing system binaries for known rootkit signatures. It is specifically designed to detect rootkits on Linux systems.

Answer

lsof

Answer

netstat

Answer

clamav

Question 19

Which TWO commands can be used to immediately synchronize the system time with an NTP server, even if the time difference is large? (Choose two.)

Accepted Answer

ntpd -g. `ntpd -g` allows the NTP daemon to perform a one-time large time jump (even if the offset exceeds the default panic threshold of 1000 seconds) and then continue normal synchronization. Option E is correct because `ntpdate pool.ntp.org` immediately sets the system clock to the time returned by the NTP server, regardless of the current time difference, making it suitable for large corrections.

Answer

chronyd -q

Answer

systemctl restart ntp

Answer

timedatectl set-ntp true

Question 20

Based on the exhibit, what is the most likely cause of the sshd service failure?

Accepted Answer

Another process is already listening on port 22. The sshd service failed because another process is already listening on port 22, which prevents sshd from binding to that port. This is indicated by the error message in the exhibit (e.g., 'bind: Address already in use'), which is a common symptom when a conflicting service or a previously running instance of sshd occupies the port. The system cannot start a new instance of sshd until the port is freed.

Answer

The firewall is blocking port 22

Answer

The sshd configuration file has incorrect permissions

Answer

The sshd service is not installed