XK0-005 Hard Questions — 25 Difficult Questions

Question 1

An administrator configures a new web server with Apache and needs to ensure it starts automatically after a system reboot. The administrator runs 'systemctl enable httpd' but the service still does not start after reboot. What is the most likely reason?

Accepted Answer

The httpd service is masked, preventing it from starting.. The most likely reason the httpd service does not start after reboot despite being enabled is that it is masked. A masked service is symlinked to /dev/null, which prevents systemd from starting it even if it is enabled. The 'systemctl enable' command creates the necessary symlinks for automatic startup, but a mask overrides this by blocking the service unit entirely.

Answer

The service name is incorrect; it should be 'apache2' instead of 'httpd'.

Answer

The administrator forgot to run 'systemctl start httpd' after enabling it.

Answer

The systemd daemon needs to be reloaded with 'systemctl daemon-reload'.

Question 2

A Linux administrator is troubleshooting network connectivity. The server can ping its own IP address but cannot ping the default gateway. The output of 'ip route show' is: 'default via 10.0.0.1 dev eth0 proto static metric 100'. The output of 'ping -c 1 10.0.0.1' fails with 'Destination Host Unreachable'. Which of the following is the MOST likely cause?

Accepted Answer

The subnet mask on eth0 is incorrect, causing the gateway to be considered on a different network.. The server can ping its own IP address, confirming that the local network stack and the eth0 interface are operational. However, the 'Destination Host Unreachable' error when pinging the default gateway (10.0.0.1) indicates that the host does not have a valid route to that destination. Since the default route exists, the most likely cause is an incorrect subnet mask on eth0, which causes the kernel to treat the gateway as being on a different network, thus failing to send ARP requests or forward packets to it.

Answer

The eth0 interface is down.

Answer

The gateway is down or not responding.

Answer

The default gateway is not set.

Question 3

A database server running on Linux is experiencing high load. The administrator runs 'strace -p <pid>' and sees many 'epoll_wait' and 'futex' calls. Which THREE of the following are possible causes of the high load? (Choose THREE.)

Accepted Answer

Disk I/O contention causing processes to wait.. Option A is correct because 'epoll_wait' indicates the process is waiting for I/O events, and 'futex' calls are used for synchronization. Disk I/O contention can cause the database process to block on these system calls, leading to high load as the kernel schedules other tasks while waiting for I/O to complete.

Answer

CPU frequency scaling is set to powersave.

Answer

A memory leak in the database process.

Question 4

A senior administrator is troubleshooting a shell script that fails to execute properly. The script starts with #!/bin/bash and has execute permissions. Which of the following could cause the script to fail to run when invoked as ./script.sh?

Accepted Answer

The script contains carriage return characters (\r).. Option B is correct because carriage return characters (\r) are a common issue when scripts are edited on Windows and then transferred to Linux. The shebang line #!/bin/bash expects a Unix-style line ending (LF), but \r characters cause the shell to interpret the command interpreter as '/bin/bash\r', which is not a valid executable path. This results in a 'No such file or directory' error when the script is invoked as ./script.sh, even though permissions are correct.

Answer

The shebang line is not on the first line.

Answer

The script uses #!/bin/sh instead of bash.

Answer

The script starts with a byte order mark (BOM).

Question 5

A Linux engineer is troubleshooting a server that fails to boot. The server displays a message indicating 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which TWO actions should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Boot from a rescue disk and rebuild the initramfs with the necessary filesystem modules. The error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or mount the root filesystem. Option B is correct because rebuilding the initramfs from a rescue disk ensures the necessary filesystem drivers (e.g., ext4, xfs) are included, which may have been missing or corrupted. Option D is correct because the root= parameter in the bootloader configuration (e.g., GRUB) tells the kernel which device/partition to mount as root; a typo or incorrect value (e.g., wrong UUID or device name) will cause this exact panic.

Answer

Reinstall GRUB to the Master Boot Record

Answer

Run fsck on the root partition to check for filesystem corruption

Answer

Disable SELinux by adding selinux=0 to the kernel command line

Question 6

A company requires that all systems be configured to log all authentication attempts, both successful and failed. Which configuration file and directive should be used to ensure all auth messages are logged to /var/log/secure?

Accepted Answer

In /etc/rsyslog.conf: authpriv.* /var/log/secure. In rsyslog, the `authpriv` facility covers authentication and authorization messages, including both successful and failed login attempts. The directive `authpriv.* /var/log/secure` directs all messages from this facility to `/var/log/secure`, which is the standard secure log file on RHEL/CentOS systems. This meets the requirement to log all authentication attempts.

Answer

In /etc/rsyslog.conf: *.info /var/log/secure

Answer

In /etc/rsyslog.conf: auth.* /var/log/secure

Answer

In /etc/rsyslog.conf: kern.* /var/log/secure

Question 7

A Linux system is experiencing kernel panics after a recent update. The administrator wants to boot into a previous kernel version to restore functionality. Which three steps are required to achieve this? (Select THREE).

Accepted Answer

After booting, edit /etc/default/grub and set GRUB_DEFAULT to the saved entry, then run update-grub. Option A is correct because after booting into a working kernel, editing /etc/default/grub to set GRUB_DEFAULT to 'saved' and running update-grub (or grub-mkconfig) ensures that the GRUB bootloader will remember and default to the last successfully booted kernel, which can be the previous version. This step is necessary to make the temporary fix persistent across reboots.

Answer

Run 'yum reinstall kernel' to revert to the previous version

Answer

Edit /etc/fstab to change root filesystem parameters

Question 8

Based on the exhibit, what is the most likely cause of the sshd service failure?

Accepted Answer

Another process is already listening on port 22. The sshd service failed because another process is already listening on port 22, which prevents sshd from binding to that port. This is indicated by the error message in the exhibit (e.g., 'bind: Address already in use'), which is a common symptom when a conflicting service or a previously running instance of sshd occupies the port. The system cannot start a new instance of sshd until the port is freed.

Answer

The firewall is blocking port 22

Answer

The sshd configuration file has incorrect permissions

Answer

The sshd service is not installed

Question 9

An administrator needs to ensure that a custom script /usr/local/bin/backup.sh runs every day at 2:00 AM and logs output to /var/log/backup.log. How should this be configured using systemd?

Accepted Answer

Create a systemd timer unit that activates a service unit, with OnCalendar=daily and the desired time.. Option C is correct because systemd timer units are the modern, recommended method for scheduling recurring tasks on Linux systems that use systemd. By creating a timer unit with `OnCalendar=daily` and specifying the desired time (e.g., `02:00:00`), the associated service unit will execute `/usr/local/bin/backup.sh` at 2:00 AM daily. The service unit can also redirect output to `/var/log/backup.log` using standard output/error directives, ensuring logging is handled natively within the systemd framework.

Answer

Use anacron with a delay of 0 and a period of 1 day.

Answer

Add a cron job with '0 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1'.

Answer

Place the script in /etc/cron.daily/ and set the time with the 'START_HOURS_RANGE' variable.

Question 10

A Linux administrator needs to ensure that only the root user can run commands in the /usr/local/bin/scripts directory. Which command should be used to set the appropriate permissions?

Accepted Answer

chmod 700 /usr/local/bin/scripts. The requirement is that only the root user can run commands in the directory. Permission 700 (owner: rwx, group: ---, others: ---) grants full access exclusively to the owner (root), while denying all access to the group and others. This matches the requirement precisely.

Answer

chmod 750 /usr/local/bin/scripts

Answer

chmod 755 /usr/local/bin/scripts

Answer

chmod 770 /usr/local/bin/scripts

Question 11

A company's security policy requires that all user passwords must expire every 90 days. The administrator runs 'chage -M 90 jdoe' for user jdoe. Which additional step ensures that the password expiration policy is enforced for all new users?

Accepted Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs. Option A is correct because /etc/login.defs contains default values used by useradd and other tools when creating new users. Setting PASS_MAX_DAYS 90 in this file ensures that every new user account created will automatically have a 90-day password expiration, enforcing the policy globally without manual intervention.

Answer

Add 'password required pam_unix.so remember=5' to /etc/pam.d/system-auth

Answer

Set EXPIRE=90 in /etc/default/useradd

Answer

Modify /etc/shadow to set max days for each user

Question 12

A security audit identified that the /tmp directory is world-writable. Which THREE steps should be taken to secure /tmp on a Linux system? (Select THREE.)

Accepted Answer

Set the sticky bit on /tmp. Option A is correct because setting the sticky bit on /tmp prevents users from deleting or renaming files owned by other users, even though the directory is world-writable. This is a standard security hardening measure for shared temporary directories.

Answer

Remove world-writable permission from /tmp

Answer

Mount /tmp with the exec option

Question 13

A Linux administrator is configuring a firewall using iptables to allow incoming HTTP and HTTPS traffic but block all other incoming traffic. Which set of rules should be applied?

Accepted Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT. Option C is correct because it sets the default policy for the INPUT chain to DROP, which blocks all incoming traffic by default, and then explicitly adds rules to ACCEPT TCP traffic on ports 80 (HTTP) and 443 (HTTPS). This implements a whitelist approach: only the specified services are allowed, and all other incoming packets are dropped by the default policy. The order is critical — the ACCEPT rules must be evaluated before the default DROP policy takes effect for unmatched traffic.

Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp -j ACCEPT

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -j DROP

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Question 14

A Linux administrator is writing a Bash script to automate the backup of a database. The script must run a pre-backup command, check its exit status, and if successful, proceed with the backup; otherwise, log an error and exit. Which code snippet correctly implements this logic?

Accepted Answer

pre_backup_cmd
if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi
backup_cmd. Option C correctly runs the pre-backup command, then checks its exit status with `$?`. If the exit status is not zero (indicating failure), it logs an error to stderr and exits with code 1. Only if the pre-backup command succeeds does the script proceed to the backup command. This matches the requirement exactly: check exit status, log error on failure, and exit.

Answer

set -e
pre_backup_cmd
backup_cmd

Answer

pre_backup_cmd && backup_cmd || echo 'Error' >&2

Answer

(pre_backup_cmd; if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi) && backup_cmd

Question 15

A Linux system experiences high CPU usage from a process that appears to be a fork bomb. The administrator wants to prevent such attacks in the future by limiting the number of processes a user can create. Which configuration file should be modified, and what parameter should be set?

Accepted Answer

Add 'username hard nproc 100' in /etc/security/limits.conf. Option C is correct because /etc/security/limits.conf is the PAM-based configuration file used to set per-user resource limits via the 'nproc' parameter. Adding 'username hard nproc 100' enforces a hard limit of 100 processes for that user, preventing a fork bomb from exhausting system resources.

Answer

Set 'kernel.pid_max=100' in /etc/sysctl.conf

Answer

Set 'DefaultLimitNPROC=100' in /etc/systemd/system.conf

Answer

Add 'ulimit -u 100' to /etc/profile

Question 16

A system administrator notices that a cron job runs every 5 minutes but should run only on weekdays. The current crontab entry is: */5 * * * * /usr/local/bin/script.sh. Which change to the time fields will restrict execution to Monday through Friday?

Accepted Answer

*/5 * * * 1-5 /usr/local/bin/script.sh. Option C is correct because the fifth field in a crontab entry specifies the day of the week, where 1 represents Monday and 5 represents Friday. By setting this field to `1-5`, the cron job will only execute on weekdays, while the `*/5` in the minute field ensures it still runs every 5 minutes. The other fields remain as `*` to allow execution at any hour and any day of the month.

Answer

*/5 9-17 * * 1-5 /usr/local/bin/script.sh

Answer

*/5 * * * 1-6 /usr/local/bin/script.sh

Answer

5 * * * 1-5 /usr/local/bin/script.sh

Question 17

An administrator runs 'mount -a' and receives the error shown in the exhibit. The /home partition was recently removed and replaced with a new disk. Which of the following steps should the administrator take to resolve the issue?

Accepted Answer

Run 'blkid /dev/sda3' to find the new UUID and update /etc/fstab.. The error occurs because the /home partition was replaced with a new disk, so its UUID (or device identifier) in /etc/fstab no longer matches the actual disk. Running 'blkid /dev/sda3' retrieves the new UUID, which must then be updated in /etc/fstab so that 'mount -a' can mount the correct device automatically.

Answer

Run 'mount /dev/sda3 /home' to mount the partition manually.

Answer

Run 'fsck /dev/sda3' to check the filesystem.

Answer

Run 'mkfs.ext4 /dev/sda3' to create a new filesystem.

Question 18

Which THREE of the following are valid methods to troubleshoot a service that fails to start?

Accepted Answer

Run the service executable manually from the command line to see error output.. Option A is correct because running the service executable manually from the command line often reveals stderr output, error codes, or missing configuration details that are suppressed when the service is started by systemd. This direct execution bypasses the service manager's logging and can show immediate, unfiltered error messages that help pinpoint the failure reason.

Answer

Run df -h to check disk space.

Answer

Reload the systemd daemon with systemctl daemon-reload.

Question 19

A Linux administrator is troubleshooting a server that is running slowly. The 'sar -q' command shows a run queue length of 12 and a load average of 8.5. The CPU utilization is 90% idle. Which of the following is the most likely cause of the performance issue?

Accepted Answer

The disk I/O subsystem is a bottleneck, causing processes to wait for I/O.. The 'sar -q' output shows a high run queue length (12) and load average (8.5) despite 90% CPU idle. This indicates that processes are in an uninterruptible sleep state (D state) waiting for I/O, not contending for CPU. A disk I/O bottleneck causes processes to queue for I/O completion, inflating the load average while CPU remains idle, making D the correct answer.

Answer

The CPU is overloaded and needs to be upgraded.

Answer

The network interface is saturated.

Answer

The system is low on memory and swapping heavily.

Question 20

During a security audit, a Linux administrator finds that an unauthorized service is listening on TCP port 4444. The service is not managed by systemd. Which of the following commands should the administrator use to identify the process and disable it?

Accepted Answer

Run 'ss -tlnp | grep :4444' to find the PID, then use 'kill' to terminate the process.. Option A is correct because 'ss -tlnp' lists TCP listening sockets with numeric addresses and the associated process PID. Piping the output through 'grep :4444' isolates the unauthorized service, and the PID can then be used with 'kill' to terminate the process. Since the service is not managed by systemd, systemctl commands are irrelevant, making 'kill' the appropriate method to stop the process.

Answer

Run 'fuser 4444/tcp' to find the PID and then use 'systemctl stop' to stop the service.

Answer

Run 'lsof -i :4444' to find the PID, then use 'systemctl disable' to disable the service.

Answer

Run 'systemctl status' to find the service name, then use 'systemctl stop' to stop it.