XK0-006 Hard Questions — 25 Difficult Questions

Question 1

Based on the exhibit, which file has an incorrect SELinux context for serving web content via Apache?

Accepted Answer

index.html. (index.html) because the exhibit shows that index.html has the SELinux context type 'user_home_t', which is not accessible by Apache's httpd process. Apache requires files served via HTTP to have the 'httpd_sys_content_t' context type (or 'httpd_sys_rw_content_t' for writable content) to be readable by the httpd daemon. Without this context, SELinux will block Apache from serving the file, even if file permissions and ownership are correct.

Answer

Neither

Answer

style.css

Answer

Both

Question 2

A DevOps engineer wants to reduce the size of a Docker image by combining build stages. Which Dockerfile feature should be used?

Accepted Answer

Multi-stage builds (multiple FROM statements). Multi-stage builds, implemented by using multiple FROM statements in a single Dockerfile, allow a DevOps engineer to copy only the necessary artifacts from intermediate build stages into the final image. This eliminates build-time dependencies, tools, and intermediate layers from the final image, significantly reducing its size without sacrificing build functionality.

Answer

RUN --mount=type=cache

Answer

Layer caching

Answer

Using a smaller base image like Alpine

Question 3

A system administrator runs 'umask 027' in a Bash shell. What will be the default permissions for a new directory created in that shell? (Assume no other umask changes.)

Accepted Answer

rwxr-x--- (750). The umask value 027 subtracts permissions from the base 777 for directories. 777 minus 027 equals 750, which translates to rwxr-x---. The owner gets full permissions (rwx), the group gets read and execute (r-x), and others get no permissions (---).

Answer

rwxrwxr-x (775)

Answer

rwxrwxrwx (777)

Answer

rw-rw-r-- (664)

Question 4

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

Accepted Answer

aa-enforce /etc/apparmor.d/profile. The aa-enforce command is the AppArmor userspace utility that sets a profile to enforce mode, causing the kernel to actively block operations that violate the profile. Running aa-enforce /etc/apparmor.d/profile transitions the specified profile from complain (or unconfined) to enforce. This is the standard way to harden a service after testing its profile in complain mode.

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-status --enforce /etc/apparmor.d/profile

Answer

aa-complain /etc/apparmor.d/profile

Question 5

A company is implementing a security policy that requires all files created in a shared directory /data to be owned by the group 'engineers' and have group read/write permissions, regardless of the user's umask. Which approach should be used?

Accepted Answer

Set the setgid bit and configure ACL default permissions on /data. Setting the setgid bit on /data ensures that new files inherit the group ownership of the directory (engineers), but it does not override the user's umask for permissions. Configuring ACL default permissions on /data explicitly sets the group read/write permissions for new files, overriding the umask. Together, they guarantee both correct group ownership and group rw permissions regardless of the user's umask.

Answer

Set the setgid bit only on /data

Answer

Set the sticky bit on /data

Answer

Configure ACL default permissions only on /data

Question 6

During the boot process, after the kernel is loaded and the initramfs is executed, which component is responsible for starting the user-space services and managing the system state?

Accepted Answer

systemd. Systemd is the init system that starts services and manages targets. GRUB2 is the bootloader that loads the kernel. The kernel itself initializes hardware. Initramfs is an initial root filesystem used to load drivers.

Answer

initramfs

Answer

GRUB2

Answer

Kernel

Question 7

A Linux security administrator needs to generate a self-signed certificate for a web server. They want to create a private key and a certificate signing request (CSR) in one step. Which OpenSSL command should be used?

Accepted Answer

openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem. The 'req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem' command generates a new private key and CSR. The other options either generate a self-signed certificate directly or are incomplete.

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -key key.pem -out req.pem

Answer

openssl req -new -key key.pem -out req.pem

Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

Question 8

During boot, the system stops at a shell with limited functionality. The administrator suspects the root filesystem is corrupted. Which target should the system be booted into to perform recovery?

Accepted Answer

emergency.target. emergency.target provides a minimal environment with a single-user shell, suitable for filesystem repairs without starting other services.

Answer

rescue.target

Answer

multi-user.target

Answer

graphical.target

Question 9

Refer to the exhibit. An API call returns HTTP 200 but an empty body. What is the most likely cause?

Accepted Answer

The request is missing required query parameters, such as pagination or filters.. An HTTP 200 response indicates the request reached the server and was processed successfully, so the issue is not connectivity or server failure. An empty body most commonly occurs when the API requires query parameters such as pagination, filters, or a specific resource identifier, and without them the endpoint returns a valid but empty result set.

Answer

The server is experiencing a network timeout.

Answer

The SSL certificate is expired or invalid.

Answer

The API endpoint has been moved permanently (301).

Question 10

A sysadmin needs to set a default gateway for a network interface. Which command(s) accomplish this?

Accepted Answer

Both B and C. Both the legacy `route` command (route add default gw 192.168.1.1) and the modern `ip route` command (ip route add default via 192.168.1.1) can be used to set a default gateway. Therefore, the correct choice is D, which includes both valid commands. `netstat -rn` only displays routing information and cannot modify routes.

Answer

netstat -rn

Answer

route add default gw 192.168.1.1

Answer

ip route add default via 192.168.1.1

Question 11

Which TWO tools are specifically designed to detect rootkits on a Linux system?

Accepted Answer

rkhunter. rkhunter (B) is a dedicated rootkit hunter that scans for known rootkit signatures, suspicious files, and hidden processes on Linux, making it specifically designed for rootkit detection. chkrootkit (E) is likewise a purpose-built tool that checks system binaries and common rootkit infection vectors on Linux. By contrast, lsof (A) only lists open files and associated processes, netstat (C) merely displays network connections and routing tables, and clamav (D) is an antivirus scanner targeting malware such as viruses and trojans rather than rootkits specifically, so none of these are specifically designed for rootkit detection.

Answer

lsof

Answer

netstat

Answer

clamav

Question 12

An administrator is troubleshooting a web server that is running under SELinux enforcing mode. The web content is located in a non-standard directory /webfiles. Using the standard SELinux context 'httpd_sys_content_t', the files are still inaccessible. Which command will properly set the context recursively and persist across relabels?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t '/webfiles(/.*)?' ; restorecon -Rv /webfiles. `semanage fcontext -a -t httpd_sys_content_t '/webfiles(/.*)?'` adds a file-context mapping to the SELinux policy database, ensuring the context survives a `restorecon` or filesystem relabel. The subsequent `restorecon -Rv /webfiles` applies that context recursively to the directory. Without the `semanage` entry, `restorecon` alone would revert to the default context (often `default_t`), which is not accessible by httpd.

Answer

chcon -R -t httpd_sys_content_t /webfiles

Answer

setenforce 0

Answer

restorecon -Rv /webfiles

Question 13

A Kubernetes administrator is creating a YAML manifest for a Deployment. Which three fields are required in a valid Deployment specification? (Choose three.)

Accepted Answer

apiVersion. A valid Kubernetes Deployment manifest actually requires four top-level fields: apiVersion, kind, metadata, and spec. The current explanation incorrectly states that only three fields are required and that metadata is not one of them. The correct required fields are all of A, B, C, and E.

Answer

status

Question 14

Refer to the exhibit. A security analyst notices repeated failed SSH login attempts from multiple IP addresses. Which two actions would best mitigate this brute-force attack? (Choose two.)

Accepted Answer

Set PermitRootLogin to no in /etc/ssh/sshd_config to prevent root login.. The logs show repeated failed SSH login attempts from multiple IPs, characteristic of a brute-force attack. Setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents attackers from targeting the root account directly, a common target. Installing and configuring fail2ban automatically blocks IPs after a configurable number of failed attempts, reducing the attack surface. Option B (changing the port) is security through obscurity and not a robust mitigation—automated scanners will find the new port. Option C (disabling password authentication) may be a valid long-term security measure but is not the most immediate mitigation, and it could break legitimate users if keys are not yet deployed. Option D (increasing MaxAuthTries) would allow more attempts, making the attack easier, not harder.

Answer

Change the SSH port to a non-standard port to evade automated attacks.

Answer

Disable password authentication and force key-based authentication only.

Answer

Increase MaxAuthTries to allow more retries before disconnection.

Question 15

Refer to the exhibit. A system administrator notices that the SSH service has failed. What is the most likely cause?

Accepted Answer

Another process is already using port 22.. The error message indicates that the address is already in use, meaning another process is already listening on port 22.

Answer

The SSH configuration file has a syntax error.

Answer

The firewall is blocking port 22.

Answer

The SSH service is not enabled to start on boot.

Question 16

A Docker container using port 8080 fails to start with the error 'port is already allocated'. Which command should the administrator use to identify the process using that port?

Accepted Answer

ss -tlnp. The `ss -tlnp` command lists TCP listening sockets (`-l`) with numeric addresses (`-n`) and shows the process identifier (PID) and process name (`-p`) that owns each socket. This directly identifies which process has bound port 8080, allowing the administrator to resolve the 'port is already allocated' error.

Answer

ss -tan

Answer

ss -tln

Answer

ss -r

Question 17

A Kubernetes pod has a container that fails with CrashLoopBackOff. The administrator runs 'kubectl logs pod-name' but sees no output. What is the most likely cause?

Accepted Answer

The container exited before writing to stdout, and logs need to be retrieved with 'kubectl logs --previous'.. When a container enters CrashLoopBackOff, it restarts repeatedly. If 'kubectl logs pod-name' shows no output, it means the current (restarted) container has not written anything to stdout yet. The previous instance of the container may have written logs before crashing, and those logs are accessible using 'kubectl logs --previous' to retrieve the output from the terminated container.

Answer

The container has no logging driver configured.

Answer

The log file is rotated and deleted.

Answer

The pod is not scheduled on any node.

Question 18

A storage administrator needs to automate the expansion of an LVM volume group when free space drops below 10%. The script must add a new physical volume from a spare disk. Which of the following commands should be used in the script to add the new disk to the volume group?

Accepted Answer

pvcreate /dev/sdb1 && vgextend vg01 /dev/sdb1. It first uses `pvcreate` to initialize the spare disk partition `/dev/sdb1` as a physical volume, which is a prerequisite for adding it to an LVM volume group. Then `vgextend vg01 /dev/sdb1` adds that initialized physical volume to the existing volume group `vg01`, expanding its total capacity. This two-step process ensures the disk is properly prepared for LVM management before being incorporated into the volume group.

Answer

vgcreate vg01 /dev/sdb

Answer

vgextend vg01 /dev/sdb1

Answer

lvresize -L +100G vg01

Question 19

A server crashed with a kernel panic. After reboot, the administrator wants to analyze the crash dump. Which THREE actions should be taken to ensure a valid core dump is captured and accessible? (Choose THREE.)

Accepted Answer

Configure a dump target in /etc/kdump.conf.. Option A is correct because /etc/kdump.conf is the kdump configuration file where you must specify the dump target (e.g., a raw device, path, NFS, or SSH location) so the vmcore is written to a persistent, accessible location after the crash. Option B is correct because the kdump service (kdump.service) must be enabled and started so the kdump initramfs is loaded and the capture mechanism is armed for the next kernel panic. Option C is correct because the crashkernel=auto (or an explicit size like crashkernel=256M) kernel parameter in the boot loader reserves memory for the secondary kernel that performs the dump; without it, no dump can be captured. Option D is not required to capture a dump; kernel-debuginfo is only needed later for analyzing the vmcore with tools like crash. Option E is incorrect because /var/crash/vmcore is the result of a successful capture, not an action taken to ensure one, and its presence cannot be guaranteed before a crash occurs.

Answer

Install kernel-debuginfo packages.

Answer

Ensure /var/crash has a vmcore file.

Question 20

A system administrator is working with compressed files. Which THREE commands can be used to view their contents? (Select THREE).

Accepted Answer

zgrep. Option A, zgrep, is correct because it searches inside gzip-compressed files directly, decompressing the stream on the fly and printing matching lines without requiring manual extraction. Option C, zcat, is correct because it decompresses gzip files to standard output, allowing their contents to be viewed (often piped to a pager). Option E, zless, is correct because it is a pager wrapper that decompresses gzip files and displays them page by page, making it ideal for viewing compressed content interactively. Options B (cat) and D (less) are not marked correct because they operate on plain uncompressed files and would output raw binary garbage when applied directly to a gzip-compressed file.

Answer

cat

Answer

less