XK0-005 Troubleshooting Practice Test 4 — 15 Questions

Question 1

The system is a web server running Apache and MySQL. Based on the exhibit, which of the following is the most likely cause of the full disk?

Accepted Answer

Apache access and error logs are growing unchecked. Apache access and error logs are a common cause of full disks on web servers because they can grow unchecked, consuming all available space. By default, Apache logs are stored in /var/log/httpd/ or /var/log/apache2/ and are not rotated unless logrotate is configured. The exhibit likely shows a high percentage of disk usage in /var/log, confirming that log files are the culprit.

Answer

A user has filled their home directory

Answer

The /tmp directory is not being cleaned

Answer

The MySQL database has grown too large

Question 2

The administrator wants to block the IP address shown in the exhibit. Which command should be used?

Accepted Answer

iptables -A INPUT -s 192.168.1.100 -j DROP. Option C is correct because `iptables -A INPUT -s 192.168.1.100 -j DROP` appends a rule to the INPUT chain that drops all incoming packets from the source IP 192.168.1.100. This is the standard Linux firewall command for blocking traffic at the network layer using netfilter, and it works immediately without requiring a service restart.

Answer

fail2ban

Answer

echo '192.168.1.100' >> /etc/hosts.deny

Answer

firewall-cmd --add-source=192.168.1.100 --permanent

Question 3

A system administrator notices that a Linux server is running low on disk space. Which command should be used to identify which directories are consuming the most space?

Accepted Answer

du -h /path | sort -rh. Option D is correct because the `du -h /path | sort -rh` command recursively calculates disk usage for each directory under the specified path, displays sizes in human-readable format (`-h`), and then sorts the output in reverse numerical order (`-rh`), showing the largest directories first. This directly identifies which directories are consuming the most space, which is exactly what the system administrator needs.

Answer

ls -laR

Answer

find / -size +100M

Answer

df -h

Question 4

A user reports that a service fails to start with the error 'Permission denied'. The service runs under a non-root user. Which command should the administrator use to check if the service has the correct file permissions?

Accepted Answer

namei -l /path/to/service. The error 'Permission denied' when starting a service under a non-root user often involves not just the file's own permissions but also the permissions of each directory in the path leading to the service binary. The `namei -l` command recursively lists the permissions of every component in the path, revealing if any parent directory lacks execute (search) permission for the service user, which would block access even if the binary itself is correctly set. This makes it the most comprehensive tool for diagnosing path-based permission issues.

Answer

ls -l /path/to/service

Answer

getfacl /path/to/service

Answer

stat /path/to/service

Question 5

A Linux server experiences intermittent network connectivity issues. The administrator suspects a duplex mismatch. Which tool can best confirm duplex and speed settings on a network interface?

Accepted Answer

ethtool eth0. Option D is correct because `ethtool eth0` is the standard Linux utility for querying and controlling network interface driver and hardware settings, including negotiated speed and duplex mode. It directly displays the current link status, speed (e.g., 1000Mb/s), and duplex (full/half), making it the best tool to confirm a duplex mismatch.

Answer

mii-tool eth0

Answer

dmesg | grep eth0

Answer

ip link show eth0

Question 6

A technician needs to troubleshoot a system that is not booting. Which of the following is the most appropriate first step when using a rescue environment?

Accepted Answer

Mount the root filesystem to /mnt/sysimage.. When using a rescue environment, the first priority is to gain access to the system's configuration and log files by mounting the root filesystem. Mounting to /mnt/sysimage (a conventional mount point in Red Hat-based rescue modes) allows the technician to chroot into the environment and treat it as the running system, enabling further troubleshooting steps like checking logs or repairing the bootloader. This step is foundational because without the root filesystem mounted, commands like checking logs or running fsck cannot operate on the actual system data.

Answer

Check the system logs in /var/log/messages.

Answer

Run fsck on all partitions.

Answer

Reinstall the bootloader immediately.

Question 7

A database server is running slow. The administrator uses iostat and notices high await times on the disk. Which of the following best explains the implication of high await?

Accepted Answer

Disk I/O requests are taking a long time to complete.. In iostat, 'await' measures the average time (in milliseconds) for I/O requests to be served by the disk, including time spent in the queue and the actual service time. A high await value indicates that disk I/O requests are taking a long time to complete, which directly explains the database server's slowness due to disk latency.

Answer

The CPU is waiting too long for memory access.

Answer

The disk is almost full, causing fragmentation.

Answer

The network filesystem is experiencing latency.

Question 8

A system administrator is investigating why a particular process is not responding. They run strace on the process but get no output. What could be the most likely reason?

Accepted Answer

The administrator does not have permission to trace that process.. The most likely reason strace produces no output is that the administrator lacks the necessary permissions to trace the process. By default, strace uses the ptrace system call, which requires either root privileges or the same user ID as the target process, and the process must not have the `dumpable` attribute set to 0 (e.g., via prctl(PR_SET_DUMPABLE, 0)). Without proper permissions, strace fails silently or returns an error like 'Operation not permitted' depending on the output configuration.

Answer

The process is already being traced by another strace instance.

Answer

The process is a kernel thread.

Answer

The process is a zombie process.

Question 9

After a system update, a custom application no longer runs due to a shared library error. The library exists on the system but is in a non-standard path. Which environment variable should be checked or set to resolve this?

Accepted Answer

LD_LIBRARY_PATH. Option C is correct because the LD_LIBRARY_PATH environment variable tells the dynamic linker (ld.so) where to search for shared libraries before the standard system paths. When a custom application fails with a shared library error after an update, and the library exists in a non-standard path, setting LD_LIBRARY_PATH to include that path resolves the issue by allowing the linker to find the library at runtime.

Answer

LD_PRELOAD

Answer

PATH

Answer

LD_RUN_PATH

Question 10

A system administrator needs to find out which process is using a particular file. Which command should they use?

Accepted Answer

lsof /path/to/file. The `lsof` command (list open files) is the correct tool because it displays information about files opened by processes, including the specific file path. When given a file path, `lsof` lists the PID and process name that currently have that file open, directly answering the administrator's need.

Answer

fuser /path/to/file

Answer

ps aux | grep file

Answer

stat /path/to/file

Question 11

A server is experiencing frequent kernel panics. The administrator wants to capture the crash dump for analysis. Which kernel parameter must be set to enable crash dumps?

Accepted Answer

crashkernel=auto. The `crashkernel=auto` kernel parameter is required to reserve a portion of system memory for the kdump mechanism, which captures a crash dump when a kernel panic occurs. Without this reserved memory, the crash dump cannot be written to disk because the kernel has no safe memory region to operate the dump capture kernel. This parameter is set in the bootloader configuration (e.g., GRUB) and is specific to the kdump service on Linux systems.

Answer

panic=10

Answer

kdump_enabled=1

Answer

irqpoll

Question 12

A system administrator is troubleshooting a network issue where a server cannot reach external websites. The server can ping the default gateway and internal hosts. Which TWO commands should the administrator use to further diagnose the problem? (Choose TWO.)

Accepted Answer

nslookup google.com. The server can reach internal hosts and the default gateway, which rules out Layer 2/3 connectivity issues within the local network. However, it cannot reach external websites, suggesting a DNS resolution failure or a routing problem beyond the gateway. 'nslookup google.com' (A) tests DNS resolution by querying the configured DNS server for the IP address of google.com; if it fails, the issue is with DNS. 'traceroute 8.8.8.8' (E) traces the path to a known external IP (Google's public DNS), bypassing DNS, to determine if packets are being dropped or misrouted after the gateway.

Answer

route -n

Answer

ping 127.0.0.1

Answer

ifconfig eth0

Question 13

A server crashed with a kernel panic. After reboot, the administrator wants to analyze the crash dump. Which THREE actions should be taken to ensure a valid core dump is captured and accessible? (Choose THREE.)

Accepted Answer

Configure a dump target in /etc/kdump.conf.. Option A is correct because /etc/kdump.conf specifies where the crash dump should be saved (e.g., to a local disk, NFS, or SSH target). Without a configured dump target, the kdump mechanism does not know where to write the vmcore file, making the dump inaccessible after a kernel panic.

Answer

Install kernel-debuginfo packages.

Answer

Ensure /var/crash has a vmcore file.

Question 14

A user cannot log in to a Linux system via SSH, but the SSH service is running and network connectivity is fine. Which TWO commands should the administrator use to troubleshoot the issue? (Choose TWO.)

Accepted Answer

journalctl -u sshd -n 20. Option A is correct because `journalctl -u sshd -n 20` displays the last 20 log entries for the SSH daemon (sshd). This allows the administrator to see authentication failures, configuration errors, or other SSH-specific issues that prevent login, even when the service is running and network connectivity is fine.

Answer

cat /etc/ssh/sshd_config

Answer

passwd -S username

Answer

ss -tlnp | grep :22

Question 15

A user reports that their system fails to boot and displays a 'GRUB' prompt. Which command should be run first to attempt to load the operating system manually?

Accepted Answer

boot. When the system boots to a GRUB prompt, it means the bootloader has loaded but cannot find or automatically load the operating system. The `boot` command at the GRUB prompt instructs GRUB to attempt to boot the currently configured kernel and initramfs, which is the correct first step to manually load the OS.

Answer

rescue

Answer

reboot

Answer

exit

XK0-005 Troubleshooting Practice Test 4 — 15 Questions

Exhibit

XK0-005 Troubleshooting Practice Test 4 — 15 Questions

Exhibit