XK0-006 Troubleshooting — 15 Questions

Question 1

A user wants to look up the mail exchange (MX) records for a domain. Which command should be used?

Accepted Answer

dig domain.com MX. The `dig` command is a flexible DNS lookup utility that can query any record type by specifying it after the domain name. `dig domain.com MX` directly queries the DNS for mail exchange records, which specify the mail servers responsible for receiving email for the domain. This is the most straightforward and commonly used command for this purpose in Linux.

Answer

ping domain.com

Answer

host -t mx domain.com

Answer

nslookup -type=mx domain.com

Question 2

A system administrator needs to check the kernel ring buffer for hardware error messages. Which command should be used?

Accepted Answer

dmesg. The `dmesg` command is the standard tool for printing the kernel ring buffer, which contains messages from the kernel, including hardware error messages, device driver initialization, and system boot logs. It directly reads from `/dev/kmsg` or the syslog system call, making it the correct choice for diagnosing hardware issues at the kernel level.

Answer

journalctl -k

Answer

vmstat

Answer

lsof

Question 3

After modifying the network configuration on a RHEL 8 system, the administrator wants to bring up the interface without rebooting. Which command sequence should be used?

Accepted Answer

nmcli con up eth0. On RHEL 8, NetworkManager is the default network management service, and connections are managed as profiles rather than raw interfaces. The 'nmcli con up eth0' command activates the connection profile named 'eth0', applying the modified configuration without a reboot. This is the NetworkManager-native way to bring a connection up after editing its settings.

Answer

ip link set eth0 up

Answer

systemctl restart network && nmcli dev connect eth0

Answer

ifconfig eth0 up

Question 4

A Linux administrator is troubleshooting a DNS resolution issue. The system uses /etc/resolv.conf. Which two of the following directives are commonly found in this file? (Choose two.)

Accepted Answer

nameserver 8.8.8.8. Option D (nameserver 8.8.8.8) is correct because /etc/resolv.conf uses the nameserver directive to specify the IP address of a DNS resolver the system queries, and 8.8.8.8 is a valid resolver address. Option E (search example.com) is correct because the search directive defines the default domain suffix list appended to unqualified hostnames during resolution, and it is a standard resolv.conf keyword. Option A (domain localdomain) is not a valid resolv.conf directive; the correct keyword is 'domain' only in some legacy contexts, but the standard modern keyword is 'search', and 'domain localdomain' as written is not a recognized directive. Option B (options timeout:2) is actually valid in resolv.conf, but it is not marked correct here, so it is excluded per the question's answer key. Option C (hosts: files dns) belongs in /etc/nsswitch.conf, not /etc/resolv.conf, as it controls the name service switch order.

Answer

domain localdomain

Answer

options timeout:2

Answer

hosts: files dns

Question 5

A system fails to boot with a kernel panic. The administrator suspects a corrupt initramfs or missing kernel module. Which three methods could be used to recover the system? (Choose three.)

Accepted Answer

Boot from a live CD/DVD, mount the root filesystem, and chroot. Option A is correct because booting from a live CD/DVD lets you mount the root filesystem and chroot into it, allowing you to rebuild the initramfs (e.g., with dracut or mkinitramfs) or reinstall missing kernel modules without relying on the broken system. Option B is correct because adding 'rd.break' to the kernel command line in GRUB interrupts the boot before the initramfs switches to the real root, dropping you into an emergency shell where you can repair the initramfs or modules. Option E is correct because adding 'single' to the kernel line boots into single-user mode, giving a minimal root shell to troubleshoot and fix the corrupt initramfs or missing module. Option C is incorrect because 'fsck' is not a valid GRUB command-line operation for repairing a filesystem in this context. Option D is incorrect because 'systemctl rescue' is a runtime systemd target, not something you can invoke from the boot prompt when the kernel panics before systemd starts.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Use 'systemctl rescue' from the boot prompt

Question 6

An administrator needs to capture network traffic on interface eth0 to a file for later analysis. Which tcpdump command is correct?

Accepted Answer

tcpdump -w capture.pcap -i eth0. Both A and C are valid tcpdump commands. tcpdump accepts options in any order, so '-w capture.pcap -i eth0' (A) and '-i eth0 -w capture.pcap' (C) are functionally equivalent. Option B uses '-f' which is for filter expression, not output file. Option D is invalid because '-w' expects a filename, not an interface.

Answer

tcpdump -i eth0 -f capture.pcap

Answer

tcpdump -w eth0 capture.pcap

Question 7

After a kernel panic, the system fails to boot. The administrator suspects a missing kernel module. Which command line should be added to the GRUB boot parameters to access a rescue shell and investigate?

Accepted Answer

rd.break. rd.break is a kernel boot parameter that interrupts the boot process in the initramfs (dracut) phase before the real root filesystem is mounted, dropping the administrator into a root shell inside the initramfs. This is the correct choice when a kernel module is missing or the root filesystem cannot be mounted, because it lets you inspect /sys/module, load modules with modprobe, or repair the initramfs without needing the full system to boot. It is specifically designed for rescue and recovery scenarios on RHEL/CentOS/Fedora-style systems using dracut.

Answer

systemd.unit=emergency.target

Answer

single

Answer

nomodeset

Question 8

An administrator wants to test SMTP connectivity to a mail server without actually delivering an email. Which curl command is most appropriate?

Accepted Answer

curl -v smtp://mail.example.com:25. `curl -v smtp://mail.example.com:25` uses curl's verbose mode to open an SMTP connection and display the full protocol dialogue (banner, EHLO/HELO, capability responses) without sending a message. This is the standard way to test SMTP reachability and server response using curl.

Answer

curl --resolve mail.example.com:25:10.0.0.1 smtp://mail.example.com

Answer

curl -o /dev/null smtp://mail.example.com

Answer

curl -I smtp://mail.example.com

Question 9

An administrator needs to check the status of NetworkManager connections and devices. Which TWO commands provide this information?

Accepted Answer

nmcli dev status. Option B, `nmcli dev status`, is correct because it queries NetworkManager directly and prints a concise table of every network device along with its type, current state (connected, disconnected, unavailable, etc.), and the connection profile currently active on it. Option C, `nmcli con show`, is correct because it lists all NetworkManager connection profiles with their UUID, type, and associated device, which is exactly the connection-status information the administrator needs. Option A, `nmcli device show`, is not among the marked answers even though it is a valid nmcli subcommand, so it is not counted here. Option D, `ifconfig -a`, and Option E, `ip link show`, are incorrect because they report kernel-level interface configuration and link state from the legacy net-tools and iproute2 stacks respectively, and neither reflects NetworkManager's connection profiles or its managed device states.

Answer

nmcli device show

Answer

ifconfig -a

Answer

ip link show

Question 10

An administrator wants to view the kernel ring buffer messages to check for hardware errors. Which command should be used?

Accepted Answer

dmesg. dmesg reads and prints the kernel ring buffer, which contains boot-time and runtime kernel messages including hardware detection, driver loading, and hardware errors. It is the canonical command for viewing kernel ring buffer contents.

Answer

journalctl -k

Answer

iostat

Answer

vmstat

Question 11

A Linux administrator needs to find which process is using a specific file. Which command provides this information?

Accepted Answer

lsof /path/to/file. The `lsof` command (List Open Files) is the correct tool to identify which process is using a specific file. When invoked with a file path as an argument, `lsof` displays the PID, process name, and other details of any process that has the file open. This directly answers the administrator's need to find the process using that file.

Answer

fuser /path/to/file

Answer

strace /path/to/file

Answer

ltrace /path/to/file

Question 12

A technician suspects that a DNS resolution issue is causing connectivity problems. Which command can be used to query the DNS server for an A record for 'example.com'?

Accepted Answer

dig example.com A. The `dig` command is a flexible DNS lookup utility that can query specific record types. Using `dig example.com A` directly queries the DNS server for the IPv4 address (A record) of 'example.com', making it the correct choice for diagnosing DNS resolution issues.

Answer

traceroute example.com

Answer

ping example.com

Answer

nslookup example.com A

Question 13

A system administrator needs to capture network traffic on interface eth0, filtering for packets to or from host 10.0.0.1, and save the output to a file for later analysis. Which command accomplishes this?

Accepted Answer

tcpdump -i eth0 host 10.0.0.1 -w capture.pcap. The correct tcpdump command to capture traffic on eth0 for host 10.0.0.1 and save to a file is 'tcpdump -i eth0 host 10.0.0.1 -w capture.pcap'. This specifies the interface with -i, the host filter, and the output file with -w. Option D is also correct because tcpdump allows the filter expression after the -w option; the order of options and filters is flexible. Both A and D accomplish the task.

Answer

tcpdump -n port 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 -host 10.0.0.1 > capture.pcap

Question 14

A Linux administrator is troubleshooting a slow web server. They suspect high disk I/O. Which TWO commands can be used to monitor disk I/O statistics?

Accepted Answer

iostat -x 1. Option B (iostat -x 1) is correct because iostat from the sysstat package reports per-device extended disk I/O statistics such as tps, kB_read/s, kB_wrtn/s, and await, refreshed every 1 second, which directly exposes disk I/O load. Option E (sar -b 1) is correct because sar -b displays I/O and transfer rate statistics (tps, rtps, wtps, bread/s, bwrtn/s) sampled every 1 second, making it suitable for monitoring disk I/O over time. Option A (free -h) is wrong because it only reports memory and swap usage, not disk I/O. Option C (vmstat 1) is wrong because although it shows some block-device counters (bi/bo), it is primarily a CPU, memory, and process statistics tool rather than a dedicated disk I/O monitor. Option D (lsof) is wrong because it lists open files and the processes using them, not disk I/O throughput or latency statistics.

Answer

free -h

Answer

vmstat 1

Answer

lsof

Question 15

An administrator is investigating a security incident and needs to list all open network connections on a server, including listening and established connections, with process information. Which of the following commands can provide this information? (Choose all that apply.)

Accepted Answer

lsof -i -P -n. Option B (lsof -i -P -n) is correct because lsof's -i flag lists network files/sockets, -P suppresses port-name resolution, and -n suppresses hostname resolution, yielding open connections with the owning process. Option C (netstat -tulpn) is correct because -t and -u select TCP/UDP, -l shows listening sockets, -p includes the PID/program name, and -n keeps addresses numeric, covering both listening and established connections with process info. Option D (ss -tulpn) is correct because ss is the modern iproute2 replacement for netstat and the same -tulpn flags display TCP/UDP listening and established sockets with process details. Option A (tcpdump -i any) only captures raw packet headers/traffic on interfaces and does not map sockets to processes, and Option E (nmap -sT localhost) performs a TCP connect scan of localhost ports but does not enumerate existing connections or their owning processes.

Answer

tcpdump -i any

Answer

nmap -sT localhost