XK0-006 Troubleshooting — 25 Questions

Question 1

A user reports that they cannot reach a website. The administrator wants to check the path that packets take to the destination server. Which command should be used?

Accepted Answer

traceroute. The `traceroute` command is used to trace the path packets take from the source to a destination host, showing each hop (router) along the way. It uses ICMP echo requests (or UDP packets on Linux) with incrementing TTL values to elicit ICMP Time Exceeded messages from intermediate routers, which reveals the network path. This directly addresses the administrator's need to check the path to the destination server.

Answer

ip addr

Answer

ss

Answer

ping

Question 2

A technician needs to perform a DNS query to retrieve the mail exchange (MX) record for example.com using a specific DNS server at 8.8.8.8. Which command accomplishes this?

Accepted Answer

nslookup -type=MX example.com 8.8.8.8. All three commands `nslookup -type=MX example.com 8.8.8.8`, `host -t MX example.com 8.8.8.8`, and `dig example.com MX @8.8.8.8` can query the MX record for example.com using the specified DNS server 8.8.8.8. Option A is incorrect because the `dig` syntax with `-t MX` is non-standard; the correct syntax is `dig @server domain type` or `dig domain type @server`.

Answer

dig @8.8.8.8 example.com -t MX

Question 3

A system administrator needs to collect performance data over time to analyze CPU and memory usage trends. Which THREE of the following commands can be used to gather historical performance data? (Choose THREE.)

Accepted Answer

iostat. sar is specifically designed for historical data collection and reporting using logs in /var/log/sa/. iostat can collect CPU and I/O statistics over time when invoked with an interval and count, and its output can be saved for historical analysis. vmstat reports system statistics including CPU and memory; using the -s option shows cumulative counters, and running it at intervals provides data for trend analysis. All three can gather historical performance data.

Answer

uptime

Answer

free

Question 4

A system administrator is troubleshooting a network issue and wants to use a tool that combines ping and traceroute functionality to identify packet loss and latency along the path. Which TWO tools can provide this combined functionality? (Choose two.)

Accepted Answer

tracepath. mtr (My Traceroute) combines continuous ping with traceroute path discovery, showing real-time latency and packet loss per hop. tracepath also provides path tracing with per-hop latency measurements, effectively combining path discovery and latency data, even though it does not perform continuous pinging like mtr. Both tools give insight into packet loss and latency along the path, fulfilling the question's requirement.

Answer

ping

Answer

tcpdump

Answer

traceroute

Question 5

A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?

Accepted Answer

ss -tlnp. The ss command is the modern replacement for netstat, and ss -tlnp shows listening TCP ports with process information.

Answer

nmap localhost

Answer

ip link show

Answer

dig -t any localhost

Question 6

A Linux engineer is investigating high disk I/O on a server. Which command provides disk I/O statistics including %util, await, r/s, and w/s?

Accepted Answer

iostat -x 1. iostat reports CPU and disk I/O statistics, with columns like %util, await, r/s, and w/s.

Answer

sar -b

Answer

vmstat 1 5

Answer

free -h

Question 7

During boot, a Linux system displays a kernel panic with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Corrupt initramfs missing a necessary kernel module for the root device. This error indicates that the root filesystem cannot be found, often due to a missing driver for the storage device in the initramfs.

Answer

Incorrect time configuration in the BIOS

Answer

The /etc/fstab file has an invalid filesystem type for the root partition

Answer

A defective network cable

Question 8

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

Accepted Answer

strace -p <PID>. strace can attach to a running process with -p PID and display all system calls made by the process.

Answer

tcpdump -i any

Answer

ltrace -p <PID>

Answer

lsof -p <PID>

Question 9

A user wants to look up the mail exchange (MX) records for a domain. Which command should be used?

Accepted Answer

dig domain.com MX. The `dig` command is a flexible DNS lookup utility that can query any record type by specifying it after the domain name. `dig domain.com MX` directly queries the DNS for mail exchange records, which specify the mail servers responsible for receiving email for the domain. This is the most straightforward and commonly used command for this purpose in Linux.

Answer

ping domain.com

Answer

host -t mx domain.com

Answer

nslookup -type=mx domain.com

Question 10

An administrator wants to capture network traffic on interface eth0, writing the output to a file for later analysis, without resolving hostnames. Which command accomplishes this?

Accepted Answer

tcpdump -i eth0 -w capture.pcap -n. tcpdump -i eth0 -w file.pcap -n captures packets without name resolution and writes to a file.

Answer

tcpdump -i eth0 -r capture.pcap

Answer

tcpdump -i any -w capture.pcap

Answer

tcpdump -n -w eth0 capture.pcap

Question 11

A system administrator needs to check the kernel ring buffer for hardware error messages. Which command should be used?

Accepted Answer

dmesg. The `dmesg` command is the standard tool for printing the kernel ring buffer, which contains messages from the kernel, including hardware error messages, device driver initialization, and system boot logs. It directly reads from `/dev/kmsg` or the syslog system call, making it the correct choice for diagnosing hardware issues at the kernel level.

Answer

journalctl -k

Answer

vmstat

Answer

lsof

Question 12

After modifying the network configuration on a RHEL 8 system, the administrator wants to bring up the interface without rebooting. Which command sequence should be used?

Accepted Answer

nmcli con up eth0. nmcli con up ifcfg-eth0 activates the connection. If using legacy scripts, ifup eth0 would work, but nmcli is the modern method for NetworkManager.

Answer

ip link set eth0 up

Answer

systemctl restart network && nmcli dev connect eth0

Answer

ifconfig eth0 up

Question 13

A technician needs to check the current memory usage on a Linux system, including buffers and cache. Which command provides the most user-friendly output?

Accepted Answer

free -h. The `free -h` command displays memory usage in a human-readable format (e.g., KiB, MiB, GiB) and explicitly breaks down total, used, free, shared, buffers/cache, and available memory. This makes it the most user-friendly option for quickly assessing current memory usage including buffers and cache.

Answer

cat /proc/meminfo

Answer

iostat -m

Answer

vmstat -s

Question 14

A server is experiencing intermittent network connectivity issues. The administrator wants to run a continuous test that combines ping and traceroute to monitor the path and packet loss to a target host. Which command should be used?

Accepted Answer

mtr target. mtr combines ping and traceroute functionality, continuously showing each hop and packet loss statistics.

Answer

tcpdump -i any host target

Answer

ping -f target

Answer

traceroute -n target

Question 15

An administrator needs to check the current routing table on a Linux system. Which command should be used?

Accepted Answer

ip route. The `ip route` command displays the kernel routing table, showing the paths that packets take to reach network destinations. This is the standard tool on modern Linux systems for viewing and manipulating routing entries, replacing the older `route -n` command.

Answer

dig -t A

Answer

ss -r

Answer

ip neigh

Question 16

A Linux administrator is troubleshooting a DNS resolution issue. The system uses /etc/resolv.conf. Which two of the following directives are commonly found in this file? (Choose two.)

Accepted Answer

nameserver 8.8.8.8. /etc/resolv.conf typically contains nameserver entries and optionally search and domain directives.

Answer

domain localdomain

Answer

options timeout:2

Answer

hosts: files dns

Question 17

A system fails to boot with a kernel panic. The administrator suspects a corrupt initramfs or missing kernel module. Which three methods could be used to recover the system? (Choose three.)

Accepted Answer

Boot from a live CD/DVD, mount the root filesystem, and chroot. At the GRUB menu, editing boot parameters to add 'rd.break' drops into an emergency shell; adding 'single' boots into single-user mode; booting from a live CD allows chroot and repair.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Use 'systemctl rescue' from the boot prompt

Question 18

An administrator needs to identify which processes are consuming the most CPU and memory resources. Which two commands can provide this information? (Choose two.)

Accepted Answer

top. The `top` command provides a real-time, dynamic view of running processes, displaying CPU and memory usage by default and allowing sorting by resource consumption. The `ps aux --sort=-%mem` command lists all processes with detailed memory and CPU statistics, sorted by memory usage in descending order, making it easy to identify the most resource-intensive processes.

Answer

free -h

Answer

iostat -x

Answer

vmstat 1 5

Question 19

A Linux administrator needs to view all current IPv4 addresses assigned to network interfaces on a system. Which command should be used?

Accepted Answer

ip addr. The 'ip addr' command displays all IP addresses assigned to network interfaces. 'ifconfig' is deprecated, 'ip link' shows link-layer info, and 'hostname -I' only shows primary IPs.

Answer

ip link show

Answer

ifconfig -a

Answer

hostname -I

Question 20

A user reports that they cannot access a web server at 192.168.1.100. The administrator wants to check if the server is reachable and measure round-trip time. Which command is most appropriate?

Accepted Answer

ping 192.168.1.100. The `ping` command sends ICMP Echo Request packets to the target host and waits for ICMP Echo Reply packets, which directly tests reachability and measures round-trip time (RTT). This is the most appropriate tool for the administrator's stated goal of checking if the server is reachable and measuring RTT.

Answer

nmap -sn 192.168.1.100

Answer

traceroute 192.168.1.100

Answer

ss -tlnp | grep 192.168.1.100