XK0-005 Troubleshooting — All Questions With Answers

Refer to the exhibit.

$ ping -c 2 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
From 192.168.1.1 icmp_seq=1 Time to live exceeded
From 192.168.1.1 icmp_seq=2 Time to live exceeded

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss

Refer to the exhibit.

# cat /etc/fstab
UUID=abc123 / ext4 defaults 0 1
UUID=def456 /boot ext4 defaults 0 2
UUID=ghi789 /home ext4 defaults 0 2
UUID=jkl012 swap swap defaults 0 0

# mount -a
mount: /home: special device UUID=ghi789 does not exist.

Refer to the exhibit.

# mount | grep /data
/dev/sdb1 on /data type ext4 (rw,relatime,errors=remount-ro)
# df -h /data
Filesystem      Size  Used Avail Use% Mounted on
/dev/sdb1       9.8G  9.5G     0 100% /data
# ls -la /data | head
ls: reading directory /data: Input/output error

Refer to the exhibit.

# netstat -tulpn | grep -E ':(22|80|443)'
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1234/sshd
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      5678/httpd
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      5678/httpd

Refer to the exhibit.
[ 2.345678] EXT4-fs (sda1): mounted filesystem with ordered data mode. Options: (null)
[ 2.345690] systemd[1]: Started Journal Service.
[ 2.345700] sd 0:0:0:0: [sda] No Caching mode page found
[ 2.345710] sd 0:0:0:0: [sda] Assuming drive cache: write through

Refer to the exhibit.
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2        50G   50G     0 100% /

Refer to the exhibit.
journalctl -u sshd output:
sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
sshd[1235]: Failed password for root from 192.168.1.100 port 22 ssh2
... repeated ...

Refer to the exhibit.

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       20G   19G  1.0G  95% /
/dev/sda2       50G   30G   20G  60% /var
/dev/sda3       30G   10G   20G  33% /home

Refer to the exhibit.

-- Logs begin at Tue 2023-06-01 08:15:32 EDT, end at Tue 2023-06-01 09:23:11 EDT. --
Jun 01 08:20:01 server sshd[1234]: Connection from 192.168.1.100 port 22
Jun 01 08:20:05 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Jun 01 08:20:10 server sshd[1234]: Connection closed by authenticating user root 192.168.1.100 port 22 [preauth]

Refer to the exhibit.
$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       20G   20G     0 100% /
/dev/sda2       50G   10G   40G  20% /home
tmpfs          1.9G  1.2M  1.9G   1% /tmp

Refer to the exhibit.
$ journalctl -u httpd
-- Logs begin at Mon 2023-10-23 09:11:22 EDT, end at Mon 2023-10-23 10:45:17 EDT. --
Oct 23 10:45:00 server httpd[1234]: (13)Permission denied: AH00035: access to /var/www/html/index.html denied (filesystem path '/var/www/html/index.html') because search permissions are missing on a component of the path

Refer to the exhibit.
# /etc/fstab
UUID=1234-5678-90ab-cdef /     ext4 defaults 1 1
UUID=abcd-ef12-3456-7890 /boot ext4 defaults 1 2
UUID=90ab-cdef-1234-5678 /home ext4 defaults 1 2
# Note: The root filesystem UUID is incorrect because the disk was replaced.

Refer to the exhibit.

[user@server ~]$ sudo lvdisplay /dev/vg_root/lv_root
  --- Logical volume ---
  LV Path                /dev/vg_root/lv_root
  LV Name                lv_root
  VG Name                vg_root
  LV UUID                xxxxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxxxx
  LV Write Access        read/write
  LV Creation host, time server01, 2023-01-15 10:30:00 -0500
  LV Status              NOT available
  # open                 0
  LV Size                50.00 GiB
  Current LE             12800
  Segments               1
  Allocation             inherit
  Read ahead sectors     auto
  - currently set to     256
  Block device           253:0

# crontab -l
*/5 * * * * /usr/local/bin/backup.sh
# Log excerpt:
Mar 10 12:35:01 server CROND[12345]: (root) CMD (/usr/local/bin/backup.sh)
Mar 10 12:35:03 server backup.sh[12346]: Error: Permission denied writing to /mnt/backup/backup.tar.gz
Mar 10 12:35:03 server backup.sh[12346]: rsync: failed to set permissions on "/mnt/backup/backup.tar.gz": Operation not permitted (1)
Mar 10 12:35:03 server backup.sh[12346]: rsync error: some files/attrs were not transferred (code 23) at main.c(1865) [generator=3.2.3]

systemctl status sshd.service
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2025-03-10 10:30:25 UTC; 2h 15min ago
 Main PID: 1234 (sshd)
   CGroup: /system.slice/sshd.service
           └─1234 /usr/sbin/sshd -D

journalctl -u sshd.service -p err --since "1 hour ago"
Mar 10 12:35:01 server sshd[5678]: error: Could not load host key: /etc/ssh/ssh_host_rsa_key
Mar 10 12:35:01 server sshd[5678]: error: Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Mar 10 12:35:01 server sshd[5678]: fatal: No supported key exchange algorithms [preauth]

# /etc/nftables.conf
flush ruleset
table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        tcp dport 22 accept
        tcp dport 80 accept
        tcp dport 443 accept
        ip protocol icmp accept
        ct state established,related accept
    }
}

ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
From 10.0.0.2 icmp_seq=1 Destination Port Unreachable

ls -la /var/log/syslog
-rw-r----- 1 syslog adm 1024000 Mar 10 12:45 /var/log/syslog
df -h /var/log
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       20G   19G  1.0G  95% /

tail -5 /var/log/syslog
Mar 10 12:44:59 server rsyslogd: [origin software="rsyslogd" swVersion="8.2106.0" x-pid="789" x-info="https://www.rsyslog.com"] start
Mar 10 12:45:00 server rsyslogd: problem with file /var/log/syslog: No space left on device
Mar 10 12:45:00 server rsyslogd: [origin software="rsyslogd" swVersion="8.2106.0" x-pid="789" x-info="https://www.rsyslog.com"] rsyslogd: HUP received, trying to restart.

User reports: "I can't access the web server at https://example.com from my office network."

From the user's workstation:
$ nslookup example.com
Server: 192.168.1.1
Address: 192.168.1.1#53
Non-authoritative answer:
Name: example.com
Address: 10.0.0.5

From another host on the same subnet:
$ curl -I https://example.com
HTTP/2 200

From the user's workstation:
$ curl -I https://example.com
curl: (7) Failed to connect to example.com port 443: Connection refused

$ iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)