XK0-006 System Management Practice Test 2 — 15 Questions

Question 1

A file has permissions set to 2755. Which special permission is enabled, and what does it do?

Accepted Answer

SGID; new files in the directory inherit the group. The permission 2755 includes the SGID (Set Group ID) special permission, indicated by the leading digit '2'. When SGID is set on a directory, new files and subdirectories created within it inherit the group ownership of the directory, rather than the primary group of the user who creates them. This is critical for collaborative environments where multiple users need shared group access.

Answer

No special permission; it is just octal 755

Answer

Sticky bit; only file owners can delete their files

Answer

SUID; the file runs with the owner's privileges

Question 2

After making changes to /etc/grub.d/ and /etc/default/grub, an administrator needs to regenerate the GRUB2 configuration file. Which command should be used?

Accepted Answer

grub2-mkconfig -o /boot/grub2/grub.cfg. After modifying /etc/grub.d/ scripts or /etc/default/grub, the GRUB2 configuration file must be regenerated to apply the changes. The command `grub2-mkconfig -o /boot/grub2/grub.cfg` reads the configuration snippets and defaults, then writes the final boot menu configuration to the specified output file. This is the standard method on RHEL/CentOS 7+ and other distributions using GRUB2.

Answer

grub2-install

Answer

grub2-set-default 0

Answer

update-grub

Question 3

An administrator wants to display only the second field from a colon-delimited file named 'passwd' using a text processing tool. Which command will achieve this?

Accepted Answer

awk -F: '{print $2}' passwd. awk -F: '{print $2}' passwd sets field separator to : and prints second field. cut -d: -f2 also works, but the options include awk. sed is for editing, not field extraction; grep is for pattern matching.

Answer

sed 's/:.*//' passwd

Answer

cut -d: -f2 passwd

Answer

grep -o '^[^:]*:[^:]*' passwd

Question 4

A technician is troubleshooting a service that fails to start. The service file is located in /usr/lib/systemd/system. Which THREE commands can be used to investigate the service's status and logs? (Choose three.)

Accepted Answer

journalctl -u servicename. Option B, journalctl -u servicename, is correct because the -u (unit) filter restricts journal output to messages logged by that specific systemd unit, which is exactly what is needed to read the service's logs. Option C, systemctl status servicename, is correct because it reports the unit's load state, active state, main PID, exit code, and the most recent log lines, making it the primary tool for investigating why a service failed. Option E, journalctl -f, is correct because it follows the journal in real time, letting the technician watch new messages as the service is retried or started, which helps capture the failure output. Option A, systemctl enable servicename, only creates the symlinks for start-at-boot and does not display status or logs. Option D, systemctl start servicename, merely attempts to start the unit and provides no diagnostic status or log output on its own.

Answer

systemctl enable servicename

Answer

systemctl start servicename

Question 5

A system running systemd is failing to boot properly. The administrator wants to boot into an environment with only the essential services for troubleshooting. Which systemd target should be selected at boot?

Accepted Answer

rescue.target. The rescue.target is a systemd target that starts a single-user environment with basic system services, including mounting local file systems and starting a rescue shell. It is designed for troubleshooting when the system cannot boot normally, providing essential services without the full multi-user or graphical environment. This matches the requirement for an environment with only essential services.

Answer

multi-user.target

Answer

emergency.target

Answer

graphical.target

Question 6

A system administrator needs to remove all files in /tmp that have not been accessed in the last 30 days and are not owned by root. Which two commands, combined, could be used to accomplish this? (Select TWO).

Accepted Answer

find /tmp -atime +30 -not -user root -delete. Option A is correct because `find /tmp -atime +30 -not -user root -delete` uses `-atime +30` to match files whose last access time is more than 30 days ago, `-not -user root` to exclude files owned by root, and `-delete` to remove the matching files. Option E is also correct because `find /tmp -atime +30 -not -user root -exec rm {} \;` applies the same access-time and ownership filters, then removes each matched file via `rm` using `-exec`. Option B is wrong because `-mtime +30` filters on modification time, not access time. Option C is wrong because `-atime -30` matches files accessed less than 30 days ago and `-user root` selects root-owned files, the opposite of the requirement. Option D is wrong because `-user root` targets root-owned files instead of excluding them.

Answer

find /tmp -mtime +30 -not -user root -delete

Answer

find /tmp -atime -30 -user root -delete

Answer

find /tmp -atime +30 -user root -exec rm {} \;

Question 7

An administrator wants to view the contents of a compressed log file /var/log/syslog.2.gz without decompressing it to disk. Which two commands can be used to display the file contents? (Select TWO).

Accepted Answer

zcat /var/log/syslog.2.gz. Option B (zcat /var/log/syslog.2.gz) is correct because zcat decompresses gzip-compressed data and writes the result to standard output, so the log contents are displayed without creating a decompressed file on disk. Option D (gunzip -c /var/log/syslog.2.gz) is correct because the -c option tells gunzip to write the decompressed output to stdout rather than replacing the .gz file, achieving the same non-destructive viewing. Option A (gzcat) is not marked correct here; although it is a common alias for zcat on some systems, it is not the accepted answer in this question. Option C (less) is not correct because less reads the file as raw compressed binary and does not decompress gzip data by itself. Option E (cat) is not correct because cat simply outputs the raw compressed bytes, producing unreadable binary garbage rather than the log contents.

Answer

gzcat /var/log/syslog.2.gz

Answer

less /var/log/syslog.2.gz

Answer

cat /var/log/syslog.2.gz

Question 8

A security analyst wants to identify all lines in a log file that contain either 'ERROR' or 'WARNING' and also contain 'timeout'. Which three commands can be used to achieve this? (Select THREE).

Accepted Answer

grep -E 'ERROR|WARNING' logfile | grep timeout. Option C is correct because `grep -E 'ERROR|WARNING' logfile` uses extended regex alternation to select lines containing either keyword, and piping to `grep timeout` further filters those lines to only those that also contain 'timeout'. Option D is correct because `sed -n '/ERROR\|WARNING/p' logfile` uses sed's basic-regex alternation (escaped pipe) to print matching lines, and the pipe to `grep timeout` applies the second required condition. Option E is correct because `awk '/ERROR|WARNING/ && /timeout/' logfile` evaluates two regex patterns with a logical AND, printing only lines that match either ERROR or WARNING and also match timeout. Option A is wrong because `grep -v` inverts the match, excluding lines with ERROR or WARNING instead of including them. Option B is wrong because the pattern `ERROR.*timeout|WARNING.*timeout` requires 'timeout' to appear after ERROR or WARNING on the same line, so it would miss lines where 'timeout' appears before those keywords.

Answer

grep -v 'ERROR|WARNING' logfile | grep timeout

Answer

grep -E 'ERROR.*timeout|WARNING.*timeout' logfile

Question 9

An administrator wants to list all USB storage devices attached to the system. Which command provides this information?

Accepted Answer

lsblk. The `lsblk` command lists all block devices in a tree-like format, including USB storage devices, by reading from `/sys/class/block` and udev information. It shows device names, sizes, types, mountpoints, and other attributes, making it ideal for identifying attached storage. Unlike `lsusb`, which only shows USB controllers and devices without indicating storage capability, `lsblk` specifically targets block devices, so any USB drive will appear as a block device (e.g., `sdb`). Thus, `lsblk` directly fulfills the requirement to list USB storage devices.

Answer

fdisk -l

Answer

lspci

Answer

lsusb

Question 10

A technician needs to replace the string 'oldhost' with 'newhost' in the file /etc/hostname. Which sed command will perform this change in-place?

Accepted Answer

sed -i '/oldhost/d' /etc/hostname. Uses 's/oldhost/newhost/g' with -i to perform a global in-place substitution, directly replacing 'oldhost' with 'newhost' as required. Option A uses 'd' to delete lines containing 'oldhost', which removes the old hostname but does not add the new one, thus failing to perform the replacement specified in the stem. Therefore, only option C correctly implements the string replacement.

Answer

sed 'y/oldhost/newhost/' /etc/hostname

Answer

sed 's/oldhost/newhost/g' /etc/hostname

Question 11

An administrator wants to view the last 20 lines of a log file and continue to watch for new entries. Which command should be used?

Accepted Answer

tail -f. The command `tail -f` is used to display the last 10 lines of a file and continue to output new lines as they are added, which is exactly what the administrator needs. The `-f` option stands for 'follow', and it keeps the file open and monitors for new entries. To view the last 20 lines initially, the administrator can use `tail -n 20 -f` or `tail -20 -f`.

Answer

tail -20

Answer

head -20

Answer

less -N

Question 12

An administrator needs to find all files in /etc that have the SUID bit set. Which find command is correct?

Accepted Answer

find /etc -perm /4000. The SUID bit is represented by the permission 4000. -perm /4000 checks if any of the bits in 4000 are set (SUID).

Answer

find /etc -exec ls -l {} \; | grep '^...s'

Answer

find /etc -perm -4000

Answer

find /etc -type f -perm 4000

Question 13

A Linux administrator wants to limit the disk space used by the /var/log directory. Which tool can be used to set disk usage quotas for a filesystem?

Accepted Answer

edquota. quota is the traditional tool; however, xfs_quota is for XFS. The question is general, so quota is correct.

Answer

repquota

Answer

quotaon

Answer

quotacheck

Question 14

A system administrator is configuring a new disk partition for a database server. The disk has been partitioned as /dev/sdb1. Which three steps are necessary to make the filesystem available for use? (Choose three.)

Accepted Answer

Mount the partition with mount. Option D is correct because a raw partition such as /dev/sdb1 has no usable filesystem until one is created with a tool like mkfs (e.g., mkfs.ext4 /dev/sdb1), which is the essential first step before the partition can hold data. Option B is correct because the newly created filesystem must be attached to the directory tree with the mount command (e.g., mount /dev/sdb1 /mnt/db) to make it accessible to the database server. Option C is correct because adding an entry to /etc/fstab (with the device, mount point, filesystem type, and options) ensures the filesystem is mounted automatically at boot, which is necessary for persistent availability. Option A is not required here since fsck is a repair/consistency-check tool used on an existing filesystem, not a mandatory step for making a new one available. Option E is not required because setting a label with e2label is optional and only provides a human-readable identifier; it is not needed to mount or use the filesystem.

Answer

Run fsck to check the filesystem

Answer

Set a label with e2label

Question 15

A Linux administrator wants to change the permissions of a file to allow the owner to read, write, and execute; the group to read and execute; and others to read only. Which chmod command should be used?

Accepted Answer

chmod 754 file. Octal 754 corresponds to rwxr-xr--: owner rwx (7), group r-x (5), others r-- (4).

Answer

chmod 764 file

Answer

chmod 744 file

Answer

chmod 755 file