XK0-005 Troubleshooting Practice Test 3 — 15 Questions

Question 1

Match each Linux package manager to its distribution family.

Question 2

Match each Linux access control mechanism to its description.

Question 3

A company needs to verify that the Apache HTTP server is running and see its current status along with recent log entries. Which command should be used?

Accepted Answer

systemctl status httpd. The `systemctl status httpd` command is correct because it provides a comprehensive view of the Apache HTTP server's current state (active/inactive), its process ID, memory usage, and the most recent log entries from the service's journal. This aligns with the question's requirement to both verify the service is running and see its status along with recent log entries, all in a single command output.

Answer

service httpd status

Answer

journalctl -u httpd

Answer

systemctl list-units --type=service

Question 4

After a power failure, a Linux server boots into emergency mode. The system logs indicate an unclean filesystem on /dev/sda2. Which command should the administrator run to repair the filesystem?

Accepted Answer

fsck -f /dev/sda2. After a power failure, the system logs indicate an unclean filesystem on /dev/sda2, meaning the filesystem was not properly unmounted and may contain inconsistencies. The `fsck -f /dev/sda2` command forces a filesystem check even if the filesystem appears clean, which is necessary to repair corruption on ext2/ext3/ext4 filesystems. This is the standard tool for checking and repairing such filesystems after an unclean shutdown.

Answer

badblocks /dev/sda2

Answer

xfs_repair /dev/sda2

Answer

mount -o remount,ro /

Question 5

A system administrator installs a new application that is failing to write to its configuration file in /etc. SELinux is enforcing. Which command would show the relevant SELinux denials?

Accepted Answer

ausearch -m avc -ts recent. The `ausearch -m avc -ts recent` command queries the audit log for AVC (Access Vector Cache) denial messages, which are the specific SELinux denials logged when a process is blocked from accessing a resource. This is the direct way to view recent SELinux denials in an enforcing mode environment, as it filters audit records by message type (AVC) and time range (recent).

Answer

sealert

Answer

getenforce

Answer

audit2why

Question 6

A user cannot access a file. The file has permissions 640 and is owned by root:root. The user is not root and not in the root group. Which command should the administrator use to allow the user to read the file?

Accepted Answer

chmod o+r file. The file has permissions 640, which means the owner (root) has read/write, the group (root) has read, and others have no permissions. Since the user is not root and not in the root group, they fall into the 'others' category. The command `chmod o+r file` adds read permission for others, allowing the user to read the file without changing ownership or group membership.

Answer

chgrp user file

Answer

setfacl -m u:user:r file

Answer

chown user file

Question 7

A database server is experiencing slow queries. The administrator wants to analyze system memory usage. Which command shows memory usage in megabytes and includes information about buffers and cache?

Accepted Answer

free -m. The 'free -m' command displays system memory usage in megabytes, explicitly showing separate columns for buffers and cache, which are critical for diagnosing slow queries caused by memory pressure. This makes it the correct choice for the administrator's need to analyze memory usage with buffer/cache details in MB.

Answer

top -b

Answer

cat /proc/meminfo

Answer

vmstat

Question 8

A server is unable to resolve hostnames via DNS. The /etc/resolv.conf file appears correct. Which command can be used to test DNS resolution and display the full query path?

Accepted Answer

dig +trace example.com. The `dig +trace example.com` command performs a full iterative DNS resolution from the root nameservers down to the authoritative nameservers for the queried domain, displaying each step of the query path. This is the correct choice because the question specifically asks to 'display the full query path,' which `+trace` provides by following referrals step by step, unlike simpler queries that only show the final answer.

Answer

nslookup example.com

Answer

host example.com

Answer

resolvectl query example.com

Question 9

A Linux administrator needs to find large log files that may be consuming disk space. Which command should be used to locate files larger than 100MB in the /var/log directory?

Accepted Answer

find /var/log -type f -size +100M. The `find` command with `-type f` (regular files) and `-size +100M` (files larger than 100 megabytes) is the correct tool to locate large log files in /var/log. This directly meets the requirement to find files by size, unlike other commands that only show disk usage or directory listings without size filtering.

Answer

df -h

Answer

ls -lR /var/log

Answer

du -sh /var/log/*

Question 10

After updating the kernel, the system fails to boot and displays 'Error 15: File not found' from GRUB. What is the most likely cause?

Accepted Answer

The kernel image is missing or the path in grub.cfg is incorrect. GRUB error 15 indicates that the specified file path in the GRUB configuration (grub.cfg) cannot be found. Since the error occurs after a kernel update, the most likely cause is that the new kernel image file is missing from the boot partition or the path in grub.cfg does not match the actual file location, preventing GRUB from loading the kernel.

Answer

The GRUB configuration file is missing

Answer

The initramfs image is missing

Answer

The hard drive has failed

Question 11

A Linux system is using systemd and a service fails to start. The administrator checks the service journal and sees: 'Failed to start service: Unit not found'. However, the service file exists in /etc/systemd/system/. What is the most likely cause?

Accepted Answer

systemd has not been reloaded (systemctl daemon-reload). When a service file is added or modified in /etc/systemd/system/, systemd does not automatically re-read the unit files. The administrator must run 'systemctl daemon-reload' to instruct systemd to scan for new or changed unit files. Without this reload, systemd still references its cached list of units, resulting in 'Unit not found' even though the file exists on disk.

Answer

The service is masked

Answer

The service file has incorrect permissions

Answer

The service is enabled but not started

Question 12

A web server is experiencing high load. The administrator wants to identify the processes consuming the most CPU. Which TWO commands can be used to display real-time process CPU usage?

Accepted Answer

top. Option D (top) is correct because it provides a real-time, dynamic view of system processes, including CPU usage, and updates continuously by default. Option E (ps aux --sort=-%cpu) is also correct because it lists all processes sorted by CPU usage in descending order, though it is a snapshot rather than continuous; however, the question asks for commands that can be used to display real-time process CPU usage, and ps with the --sort flag can be run repeatedly to approximate real-time monitoring.

Answer

lsof

Answer

iostat

Answer

vmstat

Question 13

A system administrator suspects a disk failure. Which TWO commands can be used to check disk health and identify bad sectors?

Accepted Answer

badblocks -v /dev/sda. The `badblocks` command (option C) directly scans a disk for defective sectors by performing read/write tests, making it a primary tool for identifying bad blocks. The `smartctl -a` command (option D) queries the disk's S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology) data, which includes attributes like reallocated sector count and pending sector errors, providing a proactive health assessment. Together, they cover both active scanning and passive monitoring of disk health.

Answer

iostat -x

Answer

fsck /dev/sda

Answer

dd if=/dev/sda of=/dev/null

Question 14

A Linux server is not accepting SSH connections. The administrator wants to troubleshoot the issue. Which THREE actions should be taken?

Accepted Answer

Check /etc/ssh/sshd_config for configuration errors. B is correct because /etc/ssh/sshd_config is the primary configuration file for the OpenSSH server. Syntax errors, incorrect directives (e.g., PermitRootLogin no, Port 22 commented out), or misconfigured authentication settings can prevent SSH from accepting connections. Checking this file is a fundamental step in troubleshooting SSH issues.

Answer

Reboot the server

Answer

Reinstall the SSH package (apt reinstall openssh-server)

Question 15

The system is experiencing slow disk I/O. Based on the exhibit, which step should the administrator take to improve performance?

Accepted Answer

Add the 'noatime' mount option in /etc/fstab. The 'noatime' mount option disables updating the access time (atime) on every file read, which eliminates a significant source of metadata write operations. Since the exhibit indicates slow disk I/O, reducing unnecessary writes directly improves performance by freeing I/O bandwidth for actual data transfers. This is a standard, low-risk optimization for workloads where access timestamps are not required.

Answer

Increase the filesystem block size

Answer

Enable write-back caching on the drive using hdparm

Answer

Change the I/O scheduler to 'deadline'