XK0-006 Automation, Orchestration, and Scripting Practice Test 4 — 15 Questions

Question 1

A Linux administrator is automating container image management with Podman on a RHEL server. The administrator needs to run a container that reads a configuration file from the host and survives a reboot, while ensuring the container's data is retained after the container is removed. Which TWO Podman features should the administrator use to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a named volume with `podman volume create` and attach it with `--volume`.. Reading a host configuration file requires a bind mount that maps the host path into the container, while retaining data beyond the container's life requires a named volume managed by Podman. Together these storage features meet both requirements. Generating a systemd unit addresses boot-time startup, and options like `--rm` or `--privileged` either destroy data or add unnecessary risk.

Answer

Run the container with `--rm` to automatically clean up on exit.

Answer

Use `podman generate systemd --new` to create a unit file for the container.

Answer

Add `--privileged` to grant the container full host access.

Question 2

A Linux administrator is packaging a Python automation tool for a fleet of servers. The tool must be installed system-wide for all users, its metadata must be registered so that pip can later list and uninstall it, and the installation must not require network access during deployment. The administrator has the source tree, including pyproject.toml, available locally. Which TWO commands accomplish this? (Choose two.)

Accepted Answer

python3 -m pip install .. Installing directly from the local source tree with pip install . registers metadata and places the package system-wide in the active interpreter's site-packages. When the environment must stay offline, combining --no-index with --find-links against a local wheel directory achieves the same registration while preventing any PyPI contact. Both preserve the list and uninstall capability the scenario demands.

Answer

python3 -m pip download mytool --no-deps -d /tmp && python3 /tmp/mytool/setup.py install

Answer

python3 -m venv /usr/local/mytool && source /usr/local/mytool/bin/activate && pip install .

Answer

tar -xzf mytool.tar.gz -C /usr/local/lib && echo /usr/local/lib/mytool > /etc/ld.so.conf.d/mytool.conf && ldconfig

Question 3

A Linux administrator manages configuration with Ansible and needs a task that installs the httpd package only when the host belongs to the webservers group, restarting the service after installation. The playbook must be idempotent and must not fail on hosts where httpd is already present. Which task definition accomplishes this?

Accepted Answer

dnf: name=httpd state=present with a notify handler for the service restart, applied to the webservers group. Ansible tasks should describe desired state, not imperative commands. The dnf module with name=httpd and state=present is idempotent, so reruns on hosts that already have the package report no change. Pairing it with a notify directive that triggers a handler to restart httpd ensures the restart happens only when the package state actually changed, and targeting the webservers group keeps the play scoped correctly.

Answer

shell: systemctl restart httpd && dnf install -y httpd

Answer

command: dnf install -y httpd

Answer

package: name=httpd state=latest with check_mode disabled and no handler

Question 4

A Linux administrator writes a Bash script that reads a list of hostnames from /etc/hosts.allow and must skip any line that is blank or begins with a hash character. The script currently prints blank lines and comments as if they were hostnames. Which construct correctly filters those lines while reading the file?

Accepted Answer

while IFS= read -r line; do [[ -z "$line" || "$line" == \#* ]] && continue; process "$line"; done < /etc/hosts.allow. Reading a file line by line with IFS= and read -r preserves the exact content of each line, and an explicit test for empty strings plus a pattern match for a leading hash filters out blank lines and comments before processing. Using continue keeps the loop body readable and ensures only valid entries are passed to the processing function.

Answer

for line in $(cat /etc/hosts.allow); do process "$line"; done

Answer

grep -v '^$' /etc/hosts.allow | while read line; do process "$line"; done

Answer

while read line; do case "$line" in '') ;; \#*) ;; *) process "$line";; esac; done < /etc/hosts.allow

Question 5

A Linux administrator writes a Bash script that must accept a configuration file path as its first argument, and must terminate with an error message and a non-zero exit status if that argument is missing or the file does not exist. Which snippet correctly implements both checks?

Accepted Answer

if [ -z "$1" ] || [ ! -f "$1" ]; then echo "usage: $0 configfile" >&2; exit 1; fi. Robust argument validation combines an emptiness check with a file-type check. Testing -z on the quoted first argument catches a missing value, while -f confirms the supplied path is an existing regular file rather than a directory or special file. Quoting preserves paths containing spaces, and sending the usage text to standard error keeps normal output clean while exit 1 signals failure to any caller.

Answer

if [[ -z $1 || ! -e $1 ]]; then echo "usage: $0 configfile" >&2; exit 1; fi

Answer

if [ -n "$1" ] && [ -f "$1" ]; then echo "usage: $0 configfile" >&2; exit 1; fi

Answer

if [ -z $1 -a ! -f $1 ]; then echo "usage: $0 configfile" >&2; exit 1; fi

Question 6

A Linux administrator is building a container image with a multi-stage Dockerfile and needs the final runtime image to be as small and secure as possible. Which TWO practices should be applied in the final stage? (Choose two.)

Accepted Answer

Copy only the compiled artifacts from the build stage using COPY --from=builder.. Multi-stage builds separate the build environment from the runtime environment. Copying only compiled artifacts with COPY --from=builder keeps compilers and source out of the final image, and choosing a minimal base such as alpine or distroless strips shells and package managers. Together these two practices shrink the image and reduce the number of exploitable components, which are the goals stated in the scenario.

Answer

Run apt-get upgrade -y in the final stage to patch all packages.

Answer

Include the full source tree so future debugging is easier.

Answer

Add a USER directive to run the application as a non-root account.

Question 7

A Linux administrator needs a Bash script to process a CSV file line by line and print only lines where the third comma-separated field equals 'ERROR'. The script must not alter the file and must handle lines containing spaces. Which command structure should the administrator use?

Accepted Answer

while IFS=, read -r f1 f2 f3 rest; do [ "$f3" = "ERROR" ] && echo "$f1,$f2,$f3,$rest"; done < input.csv. Reading with a comma IFS into named fields isolates the third column without modifying the source file. Quoting the variable and using read -r preserves spaces and backslashes, and the test string comparison correctly filters ERROR records. The redirection from the file keeps the operation read-only, satisfying the requirement to leave the CSV untouched.

Answer

grep -E ',ERROR,' input.csv | cut -d, -f1,2,3

Answer

for line in $(cat input.csv); do IFS=, read -r f1 f2 f3 rest <<< "$line"; [ "$f3" = "ERROR" ] && echo "$line"; done

Answer

cat input.csv | while read line; do echo "$line" | awk -F, '$3 == "ERROR"'; done

Question 8

A Linux administrator is writing an Ansible playbook to configure a group of web servers. The playbook must run a task only on hosts that belong to the 'webservers' inventory group. Which playbook structure ensures the task targets exactly those hosts?

Accepted Answer

---
- hosts: webservers
  tasks:
    - name: Install nginx
      ansible.builtin.package:
        name: nginx
        state: present. The hosts directive belongs at the play level and names the inventory group to target. When it is set to webservers, Ansible limits the play to members of that group, so the package task runs on exactly the intended systems. Using the fully qualified module name and a clear task name keeps the playbook readable and avoids ambiguity about which collection provides the module.

Answer

---
- name: Configure web servers
  tasks:
    - name: Install nginx
      ansible.builtin.package:
        name: nginx
        state: present
      run_once: true
      hosts: webservers

Answer

---
- hosts: localhost
  tasks:
    - name: Install nginx
      ansible.builtin.package:
        name: nginx
        state: present
      delegate_to: webservers

Answer

---
- hosts: all
  tasks:
    - name: Install nginx
      ansible.builtin.package:
        name: nginx
        state: present
      when: inventory_hostname in groups['webservers']

Question 9

A Linux administrator maintains a Bash script that must run a cleanup function when the script receives SIGINT or SIGTERM, even if the script is terminated while waiting for a child process. Which construct should be added to the script?

Accepted Answer

trap 'cleanup' SIGINT SIGTERM; wait. To run cleanup on SIGINT or SIGTERM while the script is blocked on a child, the shell must catch the signals and be interruptible. Registering trap handlers for both signals and using wait allows the shell to receive the signal, run the handler, and exit predictably. This is the standard pattern for graceful termination in service scripts and wrappers.

Answer

trap 'cleanup' EXIT

Answer

set -e; trap 'cleanup' SIGINT SIGTERM

Answer

trap 'cleanup' SIGINT SIGTERM

Question 10

A Linux administrator needs a systemd unit that starts a custom monitoring agent after the network is online and restarts it automatically if it crashes. The agent must not be started more than five times in ten minutes. Which unit directives accomplish this?

Accepted Answer

After=network-online.target, Restart=on-failure, StartLimitIntervalSec=600, StartLimitBurst=5. Ordering after network-online.target ensures the agent starts once the network is usable, which matters for a monitoring agent that must reach remote endpoints. Restart=on-failure covers crashes that exit non-zero, and the start-limit directives cap restarts so a crash loop cannot flood the system. The interval and burst values must match the stated five-starts-per-ten-minutes policy.

Answer

Wants=network-online.target, Restart=on-failure, StartLimitIntervalSec=60, StartLimitBurst=5

Answer

After=network-online.target, Restart=on-abnormal, StartLimitIntervalSec=600, StartLimitBurst=5

Answer

Requires=network.target, Restart=always, StartLimitIntervalSec=300, StartLimitBurst=10

Question 11

A Linux administrator wants to ensure a bash script stops execution immediately if any command fails. Which line should be added to the script?

Accepted Answer

set -e. `set -e` instructs bash to exit immediately if any command returns a non-zero exit status, which is exactly the fail-fast behavior the administrator wants. This prevents subsequent commands from running after a failure, avoiding cascading errors in scripts. It is the standard idiom for making bash scripts robust in automation and CI environments.

Answer

set -x

Answer

set -u

Answer

set -o pipefail

Question 12

A developer is writing a Dockerfile. The application requires a configuration file that should be copied from the build context and the container should expose port 8080. Which combination of Dockerfile instructions is correct?

Accepted Answer

COPY config.txt /app/ and EXPOSE 8080. COPY adds files from the build context, and EXPOSE documents the port. Other instructions serve different purposes.

Answer

ADD config.txt /app/ and WORKDIR 8080

Answer

ADD config.txt /app/ and RUN expose 8080

Answer

COPY config.txt /app/ and CMD 8080

Question 13

A team uses Ansible for configuration management. They want to ensure a service is running on all managed nodes. Which Ansible module should be used in the playbook?

Accepted Answer

service. The Ansible service module is the generic, cross-platform module for managing services (started, stopped, enabled, restarted) and works across systemd, SysVinit, Upstart, and other init systems. It is the correct choice when the playbook must ensure a service is running on all managed nodes regardless of the underlying init system. Using service with state: started and enabled: yes is the idiomatic way to guarantee a service is running and persists across reboots.

Answer

systemd

Answer

command

Answer

shell

Question 14

A Docker container is running in the background. Which command allows the administrator to execute an interactive bash shell inside the running container named 'webapp'?

Accepted Answer

docker exec -it webapp bash. docker exec -it runs an interactive command in a running container. The other commands are for different purposes.

Answer

docker start -i webapp

Answer

docker run -it webapp bash

Answer

docker attach webapp

Question 15

In a bash script, a developer needs to parse command-line options such as -f filename and -v (verbose). Which built-in command is best suited for this task?

Accepted Answer

getopts. getopts is a bash built-in for parsing command-line options. It handles short options and requires option arguments.

Answer

getopt

Answer

case

Answer

shift