XK0-005 Troubleshooting — 50 Questions

Question 1

A system administrator notices that a service named 'myapp' fails to start on a Linux server. The command 'systemctl status myapp' shows 'Active: failed (Result: exit-code)'. Which of the following is the BEST first step to diagnose the issue?

Accepted Answer

Run 'journalctl -u myapp.service' to inspect the service logs.. The 'journalctl -u myapp.service' command retrieves the systemd journal logs specifically for the myapp service, which contain the service's stdout, stderr, and any error messages generated during its failed startup attempt. Since the service failed with an exit code, these logs are the most direct source of diagnostic information to identify why the process terminated abnormally.

Answer

Run 'dmesg' to view kernel messages.

Answer

Run 'ps aux | grep myapp' to check if the process is running.

Answer

Edit the service file with 'systemctl edit myapp' and increase timeout values.

Question 2

A user reports that they receive 'Permission denied' when trying to run a script located in their home directory. The script has permissions -rw-rw-r-- and is owned by the user. Which command should the user run to resolve the issue?

Accepted Answer

chmod u+x script.sh. The script has permissions -rw-rw-r--, meaning the owner (user) has read and write but not execute permission. To run it as a script, the execute bit must be set for the owner. The command chmod u+x script.sh adds execute permission for the user, allowing them to run the script directly.

Answer

chmod g-w script.sh

Answer

sudo chown user:user script.sh

Answer

chmod a+x script.sh

Question 3

A Linux administrator is troubleshooting network connectivity. The server can ping its own IP address but cannot ping the default gateway. The output of 'ip route show' is: 'default via 10.0.0.1 dev eth0 proto static metric 100'. The output of 'ping -c 1 10.0.0.1' fails with 'Destination Host Unreachable'. Which of the following is the MOST likely cause?

Accepted Answer

The subnet mask on eth0 is incorrect, causing the gateway to be considered on a different network.. The server can ping its own IP address, confirming that the local network stack and the eth0 interface are operational. However, the 'Destination Host Unreachable' error when pinging the default gateway (10.0.0.1) indicates that the host does not have a valid route to that destination. Since the default route exists, the most likely cause is an incorrect subnet mask on eth0, which causes the kernel to treat the gateway as being on a different network, thus failing to send ARP requests or forward packets to it.

Answer

The eth0 interface is down.

Answer

The gateway is down or not responding.

Answer

The default gateway is not set.

Question 4

A Linux server is running low on disk space in the /var partition. The administrator runs 'du -sh /var/log/*' and finds that /var/log/syslog is 10 GB. Which of the following is the BEST long-term solution to prevent recurrence?

Accepted Answer

Configure logrotate to rotate and compress the syslog file daily.. Option C is correct because logrotate is the standard Linux utility for managing log file growth. By configuring logrotate to rotate and compress /var/log/syslog daily, the system automatically archives old logs and prevents a single file from consuming excessive disk space, addressing the root cause without manual intervention.

Answer

Manually truncate the syslog file with '> /var/log/syslog'.

Answer

Delete the syslog file and restart the syslog service.

Answer

Increase the log rotation frequency in /etc/logrotate.conf to monthly.

Question 5

A user cannot access a directory '/data/projects' even though they are in the 'projects' group. The directory permissions are 'drwxr-x---' and the group owner is 'projects'. Which command should the administrator run to grant the group write permission?

Accepted Answer

chmod g+w /data/projects. The directory '/data/projects' has permissions 'drwxr-x---', meaning the group owner 'projects' currently has read and execute (r-x) but not write (w) access. Since the user is a member of the 'projects' group, the administrator needs to add write permission for the group using 'chmod g+w /data/projects'. This directly modifies the group permission bits to grant write access without affecting other permissions.

Answer

chmod o+w /data/projects

Answer

chmod u+w /data/projects

Answer

chown :projects /data/projects

Question 6

Which TWO commands can be used to display the amount of free and used memory on a Linux system?

Accepted Answer

free -h. The `free -h` command displays the total, used, and free physical memory (RAM) and swap space in a human-readable format. The `cat /proc/meminfo` command reads the kernel's memory statistics directly from the virtual filesystem, providing detailed information about memory usage, including free, available, buffered, and cached memory. Both commands are standard tools for inspecting memory utilization on a Linux system.

Answer

df -h

Answer

du -sh

Answer

iostat

Question 7

Which THREE of the following are valid methods to troubleshoot a service that fails to start?

Accepted Answer

Run the service executable manually from the command line to see error output.. Option A is correct because running the service executable manually from the command line often reveals stderr output, error codes, or missing configuration details that are suppressed when the service is started by systemd. This direct execution bypasses the service manager's logging and can show immediate, unfiltered error messages that help pinpoint the failure reason.

Answer

Run df -h to check disk space.

Answer

Reload the systemd daemon with systemctl daemon-reload.

Question 8

A user runs the ping command and receives the output shown in the exhibit. Which of the following is the MOST likely cause of the issue?

Accepted Answer

The TTL value in the ping packet is too low.. The output shows 'Request timed out' or similar, which can occur when the TTL (Time to Live) value in the ping packet expires before reaching the destination. A TTL that is too low causes routers to decrement the value to zero and drop the packet, sending an ICMP Time Exceeded message back to the sender, but if the sender does not receive a reply, it indicates the packet never reached the destination. This is the most likely cause because the ping command uses a default TTL (e.g., 128 on Windows, 64 on Linux), and if the path requires more hops, the packet is silently discarded.

Answer

The destination host is down.

Answer

The local system does not have a default gateway configured.

Answer

There is a routing loop causing packets to be dropped.

Question 9

An administrator runs 'mount -a' and receives the error shown in the exhibit. The /home partition was recently removed and replaced with a new disk. Which of the following steps should the administrator take to resolve the issue?

Accepted Answer

Run 'blkid /dev/sda3' to find the new UUID and update /etc/fstab.. The error occurs because the /home partition was replaced with a new disk, so its UUID (or device identifier) in /etc/fstab no longer matches the actual disk. Running 'blkid /dev/sda3' retrieves the new UUID, which must then be updated in /etc/fstab so that 'mount -a' can mount the correct device automatically.

Answer

Run 'mount /dev/sda3 /home' to mount the partition manually.

Answer

Run 'fsck /dev/sda3' to check the filesystem.

Answer

Run 'mkfs.ext4 /dev/sda3' to create a new filesystem.

Question 10

A user reports that a Linux workstation fails to boot and displays 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

The root filesystem device is incorrectly specified in the kernel command line.. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate the root filesystem device. The most likely cause is that the root filesystem device is incorrectly specified in the kernel command line (e.g., via a bootloader parameter like root=), preventing the kernel from finding the correct block device to mount as root.

Answer

A filesystem listed in /etc/fstab has errors.

Answer

A memory module is faulty.

Answer

The boot loader is missing or corrupted.

Question 11

A Linux administrator notices that the system’s disk I/O performance has degraded significantly. Running 'iostat -x 1' shows high %util values on /dev/sda, but low await. Which of the following is the most likely issue?

Accepted Answer

There are many concurrent I/O requests (high queue depth).. High %util with low await indicates that the device is busy processing many concurrent I/O requests, but each request completes quickly. This is characteristic of a high queue depth where the disk is saturated with parallel requests, not that individual requests are slow. The low await confirms that the disk itself is responding fast, so the bottleneck is the volume of simultaneous I/O, not latency per request.

Answer

The filesystem is nearly full.

Answer

The disk cable is loose or faulty.

Answer

The disk is failing and needs replacement.

Question 12

During a security audit, a Linux administrator finds that an unauthorized service is listening on TCP port 4444. The service is not managed by systemd. Which of the following commands should the administrator use to identify the process and disable it?

Accepted Answer

Run 'ss -tlnp | grep :4444' to find the PID, then use 'kill' to terminate the process.. Option A is correct because 'ss -tlnp' lists TCP listening sockets with numeric addresses and the associated process PID. Piping the output through 'grep :4444' isolates the unauthorized service, and the PID can then be used with 'kill' to terminate the process. Since the service is not managed by systemd, systemctl commands are irrelevant, making 'kill' the appropriate method to stop the process.

Answer

Run 'fuser 4444/tcp' to find the PID and then use 'systemctl stop' to stop the service.

Answer

Run 'lsof -i :4444' to find the PID, then use 'systemctl disable' to disable the service.

Answer

Run 'systemctl status' to find the service name, then use 'systemctl stop' to stop it.

Question 13

A user reports that the /data directory is inaccessible. The Linux administrator runs the commands shown in the exhibit. Which of the following is the most likely cause of the issue?

Accepted Answer

The filesystem is full and has become corrupted.. The 'Input/output error' when accessing /data, combined with the 'Structure needs cleaning' message from dmesg, indicates filesystem corruption on /dev/sdb1. This is a classic symptom of a full filesystem that has become corrupted, not a simple permission or mount issue. The administrator's inability to read or write to the directory, despite the mount appearing normal, points to underlying filesystem damage.

Answer

The user does not have read permissions on /data.

Answer

The device /dev/sdb1 is not present.

Answer

The filesystem is mounted as read-only.

Question 14

A technician needs to troubleshoot a network connectivity issue on a Linux server. The server can ping its own IP address but cannot ping the default gateway. Which of the following is the most likely cause?

Accepted Answer

The Ethernet cable is disconnected or the switch port is down.. Option D is correct because the server can ping its own IP address (loopback or local interface), confirming that the network stack is functioning and the interface is up. However, the inability to ping the default gateway indicates a Layer 1 or Layer 2 issue, such as a disconnected Ethernet cable or a switch port that is administratively down, which prevents any traffic from leaving the local subnet.

Answer

The default gateway is misconfigured in the routing table.

Answer

The DNS resolver is not configured correctly.

Answer

The iptables firewall is blocking outgoing ICMP traffic.

Question 15

A Linux administrator suspects a memory leak in a process. Which TWO commands can be used to monitor memory usage over time for a specific process? (Choose two.)

Accepted Answer

top. Option A (top) is correct because it provides a real-time, interactive view of system processes, including memory usage (RES, VIRT, %MEM) that updates by default every 3 seconds. You can filter by PID to monitor a specific process over time, making it ideal for detecting memory growth patterns indicative of a leak.

Answer

vmstat

Answer

iostat

Answer

free

Question 16

A Linux server is experiencing intermittent connectivity issues. The administrator reviews the system logs and finds the following messages: 'NETDEV WATCHDOG: eth0: transmit queue 0 timed out'. Which THREE actions are likely to resolve this issue? (Choose three.)

Accepted Answer

Disable NIC offloading features using 'ethtool -K eth0 tx off sg off'.. Option A is correct because the 'NETDEV WATCHDOG: eth0: transmit queue 0 timed out' error often indicates that the NIC's hardware offloading features (such as TCP segmentation offload, scatter-gather) are causing the driver to hang or fail to complete transmissions. Disabling these offloads with 'ethtool -K eth0 tx off sg off' forces the CPU to handle packet segmentation and reduces the load on the NIC, which can resolve the timeout.

Answer

Increase the transmit queue length using 'ifconfig eth0 txqueuelen 10000'.

Answer

Change the MTU on the interface to 9000.

Question 17

A Linux administrator is troubleshooting a server that is running slowly. The 'sar -q' command shows a run queue length of 12 and a load average of 8.5. The CPU utilization is 90% idle. Which of the following is the most likely cause of the performance issue?

Accepted Answer

The disk I/O subsystem is a bottleneck, causing processes to wait for I/O.. The 'sar -q' output shows a high run queue length (12) and load average (8.5) despite 90% CPU idle. This indicates that processes are in an uninterruptible sleep state (D state) waiting for I/O, not contending for CPU. A disk I/O bottleneck causes processes to queue for I/O completion, inflating the load average while CPU remains idle, making D the correct answer.

Answer

The CPU is overloaded and needs to be upgraded.

Answer

The network interface is saturated.

Answer

The system is low on memory and swapping heavily.

Question 18

A user reports that a recently installed application fails to start. The application was installed via a shell script that added a repository and installed the package. The user runs 'ldd /usr/bin/app' and sees several 'not found' libraries. Which of the following is the MOST likely cause?

Accepted Answer

The installation script did not install all required dependencies.. The `ldd` command lists shared library dependencies for a binary. When it reports 'not found' libraries, it means the dynamic linker cannot locate the required `.so` files. Since the application was installed via a shell script that added a repository and installed the package, the most likely cause is that the script failed to install all required dependencies, leaving the binary unable to resolve its shared library links.

Answer

The kernel version is outdated.

Answer

SELinux is blocking the application.

Answer

The file system is corrupted.

Question 19

A Linux administrator notices that the system clock is consistently 5 minutes behind the actual time. The administrator runs 'timedatectl' and sees 'NTP service: active'. Which of the following commands should be used to force an immediate time synchronization?

Accepted Answer

timedatectl set-ntp false && chronyd -q && timedatectl set-ntp true. Option D is correct because it first disables NTP to stop the automatic synchronization, then runs chronyd in one-shot query mode (-q) to force an immediate sync with the configured NTP servers, and finally re-enables NTP to resume normal service. This approach works with chronyd, which is the default NTP implementation on modern RHEL/CentOS 8+ and many other distributions, and directly addresses the need for an immediate synchronization without waiting for the periodic polling interval.

Answer

systemctl restart ntp

Answer

ntpdate -s time.google.com

Answer

systemctl restart chronyd

Question 20

An administrator is troubleshooting a web server that is not accessible from the internet. The server is running on port 80. Based on the iptables output, which of the following is the MOST likely reason?

Accepted Answer

The HTTP rule only allows traffic from the internal network.. The iptables output shows an HTTP rule that explicitly matches traffic from the internal network (e.g., 192.168.1.0/24) and does not include a rule allowing HTTP traffic from external (internet) sources. Since the web server is running on port 80 but the only HTTP rule restricts source IPs to the internal subnet, traffic from the internet is not matched by any ACCEPT rule and will be subject to the default policy. This is the most likely reason the server is inaccessible from the internet.

Answer

The SSH rule is blocking HTTP traffic.

Answer

The loopback interface is not accepting traffic.

Answer

The default INPUT policy is DROP.