XK0-006 Automation, Orchestration, and Scripting Practice Test 3 — 15 Questions

Question 1

A containerized application uses a bind mount to persist logs. When the container is removed and recreated, the logs are missing. What is the most likely cause?

Accepted Answer

The bind mount was not specified in the new container run command. Bind mounts depend on the host path; if the bind mount was not re-specified, the new container does not have access to the previous host directory unless explicitly mounted.

Answer

The container was run with --rm, which deletes the bind mount

Answer

The host directory was deleted when the container was removed

Answer

The log files were written to the container's writable layer instead of the mount

Question 2

In a bash script, an administrator wants to check if a file exists and is readable. Which of the following test expressions accomplishes this?

Accepted Answer

[ -f file -a -r file ]. The test expression `[ -f file -a -r file ]` uses the `-f` flag to check that the file exists and is a regular file, and the `-a` logical AND operator combined with the `-r` flag verifies that the file is readable by the current user. This matches the administrator's requirement exactly.

Answer

[ -e file -a -w file ]

Answer

test -d file -o -r file

Answer

[[ -f file && -x file ]]

Question 3

A systems administrator is writing a bash script that must accept command-line options: -f for a configuration file, -v for verbose mode, and -d for a directory. Which TWO of the following are correct ways to parse these options using getopts? (Select TWO).

Accepted Answer

while getopts ':f:vd:' opt; do. Option C is correct because the leading colon in ':f:vd:' puts getopts into silent error mode, and the colons after f and d correctly declare that -f and -d take arguments while -v is a flag. Option E is correct because 'f:vd:' properly marks -f and -d as requiring arguments and -v as a no-argument flag, which matches the script's requirements. Option A is wrong because 'f v d' contains spaces and no colons, so getopts would treat the spaces as option characters and none of the options would accept arguments. Option B is wrong because 'f:vd' makes only -f take an argument, leaving -d without one. Option D is wrong because 'fv:d:' makes -v take an argument and leaves -f without one, which is the opposite of what is needed.

Answer

while getopts 'f v d' opt; do

Answer

while getopts 'f:vd' opt; do

Answer

while getopts 'fv:d:' opt; do

Question 4

A Linux administrator wants to create a Docker image from a Dockerfile. Which TWO of the following commands are needed? (Select TWO).

Accepted Answer

docker tag. Option D (docker build) is correct because it reads a Dockerfile and produces a new image from it, which is exactly the task of creating an image from a Dockerfile. Option C (docker tag) is correct because the newly built image needs a meaningful repository name and tag (e.g., myapp:1.0) so it can be referenced and later pushed or run; docker build alone often leaves an image with only an auto-generated ID or a name supplied via -t, and tagging is the standard way to assign that identifier. Option A (docker run) is incorrect because it starts a container from an existing image rather than building one. Option B (docker push) is incorrect because it uploads an already-built image to a registry, which is a distribution step, not a build step. Option E (docker commit) is incorrect because it creates an image from a running container's changes, not from a Dockerfile.

Answer

docker run

Answer

docker push

Answer

docker commit

Question 5

A Kubernetes administrator needs to expose a deployment externally using a Service. Which THREE of the following Service types can be used? (Select THREE).

Accepted Answer

ClusterIP. Option A (ClusterIP) is correct because a ClusterIP Service provides a stable virtual IP reachable from within the cluster, and it can be exposed externally by fronting it with an Ingress controller or a NodePort/LoadBalancer, making it a valid building block for external exposure. Option B (LoadBalancer) is correct because this Service type provisions an external load balancer (e.g., via a cloud provider) that routes traffic from outside the cluster directly to the backing pods. Option D (NodePort) is correct because it opens a static port on every node's IP, allowing external clients to reach the Service via :. Option C (ExternalName) is not correct because it merely maps a Service to an external DNS name via a CNAME record and does not expose pods in the cluster. Option E (Ingress) is not correct because Ingress is a separate API resource (an HTTP/HTTPS routing layer), not a Service type.

Answer

ExternalName

Answer

Ingress

Question 6

A DevOps engineer is writing a Bash script to automate deployment of a containerized application. The script must: (1) exit immediately if any command fails, (2) build a Docker image with tag 'myapp:latest' from the current directory, (3) run a container from that image in detached mode with port mapping 8080:80, (4) set environment variable ENV=production inside the container, and (5) bind mount a host directory /data to /app/data inside the container. Which TWO of the following snippets should be included in the script to meet these requirements? (Choose TWO.)

Accepted Answer

set -e. Option B, `set -e`, is correct because it makes the Bash script exit immediately whenever any command returns a non-zero status, satisfying requirement (1). Option C, `docker build -t myapp:latest .`, is correct because it builds a Docker image tagged `myapp:latest` using the current directory (`.`) as the build context, satisfying requirement (2). Option A is not marked correct even though its flags are valid, because the question asks for the two snippets to include and the build step must also be present; A alone would not build the image. Option D is not marked correct because although `--tag` is a valid long form of `-t`, it is not one of the selected answers. Option E is not marked correct because `-eENV=production` without a space is still parsed by Docker as setting ENV, but it is not one of the selected answers and the required build command is missing.

Answer

docker run -d -p 8080:80 -e ENV=production -v /data:/app/data myapp:latest

Answer

docker build --tag myapp:latest .

Answer

docker run -d -p 8080:80 -eENV=production -v /data:/app/data myapp:latest

Question 7

A Linux administrator manages a fleet of 40 Ubuntu 24.04 servers. They need to run a one-line command that installs the package `nginx` on all servers simultaneously, using SSH, without writing a script or installing additional orchestration software. Which command should they use?

Accepted Answer

for host in $(cat hosts.txt); do ssh "$host" 'apt-get install -y nginx'; done. The requirement is to install nginx on 40 servers with a one-line command using only default tools. A Bash for-loop that reads a host list and runs ssh with apt-get install on each host meets all constraints: it uses the shell and SSH, requires no extra software, and is a single command line. Other options either need non-default tools or fail to target all hosts.

Answer

ssh -o BatchMode=yes -o ConnectTimeout=5 $(cat hosts.txt) 'apt-get install -y nginx'

Answer

ansible all -i hosts.txt -m apt -a 'name=nginx state=present'

Answer

parallel-ssh -h hosts.txt 'apt-get install -y nginx'

Question 8

A Linux administrator is writing a Bash script that must ensure a variable `CONFIG_FILE` is set and non-empty before proceeding. If it is unset or empty, the script should print an error to stderr and exit with status 1. Which construct should be used?

Accepted Answer

: ${CONFIG_FILE:?Error: CONFIG_FILE not set or empty}. The construct `${CONFIG_FILE:?message}` is designed to enforce that a variable is set and non-empty. It prints the specified message to stderr and exits with status 1 if the variable is unset or null. This is the most concise and idiomatic way in Bash to satisfy the requirement, and it works correctly even when `set -u` is enabled, unlike plain variable references.

Answer

if [ -v CONFIG_FILE ] && [ -n "$CONFIG_FILE" ]; then :; else echo "Error: CONFIG_FILE not set or empty" >&2; exit 1; fi

Answer

if [ -z "$CONFIG_FILE" ]; then echo "Error: CONFIG_FILE not set" >&2; exit 1; fi

Answer

if [ -z "${CONFIG_FILE:-}" ]; then echo "Error: CONFIG_FILE not set or empty" >&2; exit 1; fi

Question 9

A Linux administrator is automating the deployment of a web application using Ansible. The playbook must ensure that the package 'nginx' is installed, the service 'nginx' is running and enabled, and a configuration file is copied from the control node to the managed hosts. Which TWO of the following Ansible modules are appropriate for these tasks? (Choose two.)

Accepted Answer

package. The playbook needs to install a package and manage a service. Ansible provides dedicated modules for these tasks: `package` for package management and `service` for service management. These modules are idempotent and handle differences across distributions. Other modules like `copy`, `file`, or `command` are not designed for these specific tasks and would either be inefficient or incorrect in this context.

Answer

file

Answer

command

Answer

copy

Question 10

A configuration-management team stores Ansible playbooks in Git. A playbook that previously configured web servers now must also install and enable a specific firewalld service on the same hosts, and the task must be idempotent so repeat runs report no changes once the service is open. Which task module should be used to open the http service permanently and immediately?

Accepted Answer

ansible.posix.firewalld with permanent: true, immediate: true, and state: enabled. Declarative modules that express desired state let Ansible compare current configuration with the target and skip work when they already match. The firewalld module supports runtime and permanent application in one task, so the http service is opened immediately and survives reloads, while repeat executions of the playbook remain idempotent and report no changes after the first successful run.

Answer

ansible.builtin.command running firewall-cmd --add-service=http

Answer

ansible.builtin.shell running iptables -A INPUT -p tcp --dport 80 -j ACCEPT

Answer

ansible.builtin.service with name: firewalld and state: started

Question 11

A Linux administrator maintains a deployment script that must run only on systems where the file /etc/app/release.conf exists; otherwise the script should print an error and terminate with a non-zero status. The administrator writes a conditional block using the test command. Which of the following lines accomplishes the file-existence check correctly?

Accepted Answer

if [ -f /etc/app/release.conf ]; then. The test command's -f primary is the standard way to verify that a path exists and is a regular file, which matches the requirement to proceed only when release.conf is present. The other primaries in the option set check permissions or directory status, so they would misclassify a plain configuration file and drive the script into the wrong branch.

Answer

if [ -x /etc/app/release.conf ]; then

Answer

if [ -e /etc/app/release.conf -a -d /etc/app/release.conf ]; then

Answer

if [ -r /etc/app/release.conf ]; then

Question 12

A systems administrator uses systemd timers to schedule recurring automation on a server. The administrator creates `backup.timer` and `backup.service` units but the job never runs, and `systemctl list-timers` shows no entry for it. Which command should the administrator run first to make systemd aware of the new timer unit?

Accepted Answer

systemctl enable --now backup.timer. Creating timer and service unit files does not activate them; systemd must be told to enable and start the timer. Using `systemctl enable --now backup.timer` both creates the boot-time symlink and starts the timer immediately, so it registers as an active timer and schedules the paired service. Until that happens, the unit is simply a file on disk and will not appear in `list-timers`.

Answer

systemd-analyze verify backup.timer

Answer

systemctl start backup.service

Answer

systemctl daemon-reload

Question 13

A Linux administrator is building a container image with a Dockerfile. The image must start a web application and must gracefully handle termination signals so that in-flight requests complete before the container stops. Which of the following Dockerfile instructions should be used to define the application as the container's main process?

Accepted Answer

ENTRYPOINT ["/usr/bin/webapp", "--foreground"] in exec form. ENTRYPOINT in exec form makes the web application PID 1, so it directly receives signals like SIGTERM and can drain in-flight requests before exiting. Because ENTRYPOINT is not overridden by runtime arguments, the application is guaranteed to remain the main process, which is essential for graceful termination behavior.

Answer

RUN /usr/bin/webapp --foreground during the image build

Answer

SHELL ["/usr/bin/webapp", "--foreground"]

Answer

CMD ["/usr/bin/webapp", "--foreground"] in exec form

Question 14

A Linux administrator schedules a cleanup script with a systemd timer instead of cron. The script should run every day at 02:30 and must not run if the previous invocation is still active. Which combination of unit directives accomplishes this on a systemd-based distribution?

Accepted Answer

OnCalendar=*-*-* 02:30:00 in the timer unit plus a service unit whose ExecStart runs the script. Systemd timers pair a .timer unit that defines the trigger with a .service unit that defines the work. A calendar expression anchors execution to a wall-clock time, and systemd's default behavior of not starting a unit that is already active prevents overlapping executions. This gives the administrator a deterministic daily schedule with built-in overlap protection and journal visibility.

Answer

A crontab entry of 30 2 * * * /usr/local/bin/cleanup.sh with a lock file created by flock

Answer

A .timer unit with OnUnitActiveSec=24h and RemainAfterElapse=no

Answer

OnBootSec=24h in the timer unit with Persistent=true in the service unit

Question 15

A Linux administrator is building an automation script that reads a list of hostnames from a file and must process each entry, skipping blank lines and lines beginning with a hash. Which TWO constructs correctly implement this line-by-line read with the stated filtering? (Choose two.)

Accepted Answer

while IFS= read -r line; do case "$line" in ''|'#'*) continue;; esac; process "$line"; done < hosts.txt. Reliable line-by-line processing uses read -r with an empty IFS so backslashes and leading whitespace survive, and feeds the file through redirection rather than a pipe to keep the loop in the current shell. Filtering blank and hash-prefixed lines can be done with a compound test or a case statement, and both preserve the exact content of each accepted hostname.

Answer

cat hosts.txt | while read line; do grep -q '^#' <<< "$line" && continue; process "$line"; done

Answer

for line in $(cat hosts.txt); do [[ -z "$line" ]] && continue; process "$line"; done

Answer

for line in "$(< hosts.txt)"; do process "$line"; done