XK0-005 Troubleshooting Practice Test 2 — 15 Questions

Question 1

A Linux server is experiencing intermittent connectivity issues. The administrator reviews the system logs and finds the following messages: 'NETDEV WATCHDOG: eth0: transmit queue 0 timed out'. Which THREE actions are likely to resolve this issue? (Choose three.)

Accepted Answer

Disable NIC offloading features using 'ethtool -K eth0 tx off sg off'.. Option A is correct because the 'NETDEV WATCHDOG: eth0: transmit queue 0 timed out' error often indicates that the NIC's hardware offloading features (such as TCP segmentation offload, scatter-gather) are causing the driver to hang or fail to complete transmissions. Disabling these offloads with 'ethtool -K eth0 tx off sg off' forces the CPU to handle packet segmentation and reduces the load on the NIC, which can resolve the timeout.

Answer

Increase the transmit queue length using 'ifconfig eth0 txqueuelen 10000'.

Answer

Change the MTU on the interface to 9000.

Question 2

A Linux administrator is troubleshooting a server that is running slowly. The 'sar -q' command shows a run queue length of 12 and a load average of 8.5. The CPU utilization is 90% idle. Which of the following is the most likely cause of the performance issue?

Accepted Answer

The disk I/O subsystem is a bottleneck, causing processes to wait for I/O.. The 'sar -q' output shows a high run queue length (12) and load average (8.5) despite 90% CPU idle. This indicates that processes are in an uninterruptible sleep state (D state) waiting for I/O, not contending for CPU. A disk I/O bottleneck causes processes to queue for I/O completion, inflating the load average while CPU remains idle, making D the correct answer.

Answer

The CPU is overloaded and needs to be upgraded.

Answer

The network interface is saturated.

Answer

The system is low on memory and swapping heavily.

Question 3

A user reports that a recently installed application fails to start. The application was installed via a shell script that added a repository and installed the package. The user runs 'ldd /usr/bin/app' and sees several 'not found' libraries. Which of the following is the MOST likely cause?

Accepted Answer

The installation script did not install all required dependencies.. The `ldd` command lists shared library dependencies for a binary. When it reports 'not found' libraries, it means the dynamic linker cannot locate the required `.so` files. Since the application was installed via a shell script that added a repository and installed the package, the most likely cause is that the script failed to install all required dependencies, leaving the binary unable to resolve its shared library links.

Answer

The kernel version is outdated.

Answer

SELinux is blocking the application.

Answer

The file system is corrupted.

Question 4

A Linux administrator notices that the system clock is consistently 5 minutes behind the actual time. The administrator runs 'timedatectl' and sees 'NTP service: active'. Which of the following commands should be used to force an immediate time synchronization?

Accepted Answer

timedatectl set-ntp false && chronyd -q && timedatectl set-ntp true. Option D is correct because it first disables NTP to stop the automatic synchronization, then runs chronyd in one-shot query mode (-q) to force an immediate sync with the configured NTP servers, and finally re-enables NTP to resume normal service. This approach works with chronyd, which is the default NTP implementation on modern RHEL/CentOS 8+ and many other distributions, and directly addresses the need for an immediate synchronization without waiting for the periodic polling interval.

Answer

systemctl restart ntp

Answer

ntpdate -s time.google.com

Answer

systemctl restart chronyd

Question 5

An administrator is troubleshooting a web server that is not accessible from the internet. The server is running on port 80. Based on the iptables output, which of the following is the MOST likely reason?

Accepted Answer

The HTTP rule only allows traffic from the internal network.. The iptables output shows an HTTP rule that explicitly matches traffic from the internal network (e.g., 192.168.1.0/24) and does not include a rule allowing HTTP traffic from external (internet) sources. Since the web server is running on port 80 but the only HTTP rule restricts source IPs to the internal subnet, traffic from the internet is not matched by any ACCEPT rule and will be subject to the default policy. This is the most likely reason the server is inaccessible from the internet.

Answer

The SSH rule is blocking HTTP traffic.

Answer

The loopback interface is not accepting traffic.

Answer

The default INPUT policy is DROP.

Question 6

A Linux administrator is troubleshooting a server that has become unresponsive. The administrator connects via IPMI and runs 'top' but the process list does not show any obvious CPU or memory hog. Which TWO commands could be used to identify I/O wait issues or disk bottlenecks? (Choose TWO.)

Accepted Answer

iostat -x 1. `iostat -x 1` provides extended disk I/O statistics, including `%util` (percentage of time the device was busy servicing requests) and `await` (average time for I/O operations). These metrics directly indicate disk bottlenecks and I/O wait issues. `iotop -o` displays only processes that are currently performing I/O operations, allowing the administrator to identify which specific processes are causing disk contention.

Answer

vmstat 1

Answer

sar -b 1

Answer

dstat --disk-util

Question 7

A database server running on Linux is experiencing high load. The administrator runs 'strace -p <pid>' and sees many 'epoll_wait' and 'futex' calls. Which THREE of the following are possible causes of the high load? (Choose THREE.)

Accepted Answer

Disk I/O contention causing processes to wait.. Option A is correct because 'epoll_wait' indicates the process is waiting for I/O events, and 'futex' calls are used for synchronization. Disk I/O contention can cause the database process to block on these system calls, leading to high load as the kernel schedules other tasks while waiting for I/O to complete.

Answer

CPU frequency scaling is set to powersave.

Answer

A memory leak in the database process.

Question 8

A company runs a critical web application on a Linux server. The server has 16GB RAM and 4 CPU cores. Recently, users have reported intermittent timeouts and slow response times. The administrator logs in and runs 'top', which shows the web server process using 200% CPU (multi-threaded) and 2GB RAM. Free memory is 12GB, and swap usage is 0. The load average is 3.5, 4.0, 4.2. The administrator checks 'dmesg' and sees no OOM or hardware errors. The web server logs show many 'connection refused' errors during peak times. The application is configured to handle up to 500 concurrent connections. The administrator suspects the issue is related to the number of worker processes or threads. Which of the following is the BEST course of action to resolve the issue?

Accepted Answer

Increase the number of worker processes or threads in the web server configuration.. The web server is using 200% CPU (multi-threaded) and has 12GB free RAM with no swap usage, indicating CPU is the bottleneck, not memory. The load average (3.5–4.2) exceeds the 4 CPU cores, meaning the system is overloaded with processes/threads. The 'connection refused' errors during peak times suggest the server is hitting its connection limit (500 concurrent connections) and rejecting new ones. Increasing worker processes/threads allows the server to handle more concurrent connections, utilizing the available CPU cores more efficiently to reduce timeouts and refusals.

Answer

Add more CPU cores by migrating to a larger instance.

Answer

Decrease the number of worker processes to reduce CPU load.

Answer

Add more RAM to the server.

Question 9

A Linux administrator receives reports that a web application hosted on the company's internal server is intermittently slow. The server runs CentOS 7 and hosts multiple virtual hosts. The administrator checks system resources and notices that the system's swap usage is high. Which of the following is the MOST likely cause of the performance issue?

Accepted Answer

Insufficient physical memory for the workload. High swap usage indicates that the system is actively paging memory to disk because the available physical RAM is insufficient to hold the active working set. This causes significant latency because disk I/O is orders of magnitude slower than RAM, leading to intermittent slowdowns for the web application. The fact that multiple virtual hosts are running on CentOS 7 increases the memory demand, making insufficient physical memory the most likely root cause.

Answer

Misconfigured virtual host causing memory leaks

Answer

Network congestion on the internal network

Answer

Excessive CPU load from a runaway process

Question 10

A Linux engineer is troubleshooting a server that fails to boot. The server displays a message indicating 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which TWO actions should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Boot from a rescue disk and rebuild the initramfs with the necessary filesystem modules. The error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or mount the root filesystem. Option B is correct because rebuilding the initramfs from a rescue disk ensures the necessary filesystem drivers (e.g., ext4, xfs) are included, which may have been missing or corrupted. Option D is correct because the root= parameter in the bootloader configuration (e.g., GRUB) tells the kernel which device/partition to mount as root; a typo or incorrect value (e.g., wrong UUID or device name) will cause this exact panic.

Answer

Reinstall GRUB to the Master Boot Record

Answer

Run fsck on the root partition to check for filesystem corruption

Answer

Disable SELinux by adding selinux=0 to the kernel command line

Question 11

Refer to the exhibit. A Linux administrator runs the netstat command to check listening services. The output shows that services are listening on ports 22, 80, and 443. Which of the following conclusions is correct based on the exhibit?

Accepted Answer

The Apache HTTP server is running and listening on both port 80 and port 443. The netstat output shows services listening on ports 80 and 443, which are the standard ports for HTTP and HTTPS respectively. Apache HTTP server is the most common service that listens on both these ports simultaneously. The fact that both ports are listed as listening indicates that Apache (or another web server) is bound to these ports and ready to accept connections.

Answer

The HTTP server is only listening on the loopback interface

Answer

A firewall is blocking incoming connections to port 443

Answer

The SSH daemon is configured to listen on a non-standard port

Question 12

Drag and drop the steps to add a new user to the system in the correct order.

Question 13

Drag and drop the steps to troubleshoot a network connectivity issue using common commands in the correct order.

Question 14

Drag and drop the steps to configure SELinux to allow a custom web application to listen on port 8080 in the correct order.

Question 15

Match each Linux filesystem to its typical use case.