XK0-006 Troubleshooting Practice Test 10 — 15 Questions

Question 1

A Linux administrator is troubleshooting a server that is running out of disk space. Which TWO commands can be used to identify which directories or files are consuming the most space? (Choose two.)

Accepted Answer

du -sh /*. To identify space consumption, du -sh /* summarizes the size of top-level directories, quickly showing which are largest. The find command with -size +100M locates large individual files. Together, they help pinpoint both large directories and files. df only shows filesystem-level usage, ls -laR is too verbose, and iostat measures I/O performance, not space.

Answer

iostat -d

Answer

ls -laR /

Answer

df -h

Question 2

A Linux administrator is troubleshooting a service that fails to start. They want to view the most recent log entries for that service using systemd's journal. Which command should they use?

Accepted Answer

journalctl -u servicename. The journalctl -u command filters the systemd journal by unit, providing all log messages for that service. This is the correct tool to diagnose why a service fails to start, as it captures the service's standard output, error messages, and systemd's own messages about the unit.

Answer

dmesg | grep servicename

Answer

systemctl status servicename

Answer

tail -f /var/log/messages

Question 3

A Linux administrator notices that a server's root filesystem is filling up rapidly. After running `df -h`, the root filesystem shows 100% usage. However, when the administrator runs `du -sh /*` from the root directory, the total size is only about 40% of the filesystem. The administrator suspects that a deleted file is still being held open by a process. Which command should the administrator use to identify the process holding the deleted file?

Accepted Answer

lsof +L1. The `lsof +L1` command is specifically designed to list open files with a link count less than 1, meaning they have been deleted but are still held open by a process. This is the most direct and reliable way to identify the process causing the disk space discrepancy. Other commands may show open files but do not target deleted files specifically.

Answer

ls -l /proc/*/fd | grep deleted

Answer

fuser -mv /

Answer

find / -inum 0 -print

Question 4

A Linux server has a single disk /dev/sda with LVM. The root logical volume is nearly full and the administrator adds a new disk /dev/sdb to extend it. After creating a physical volume on /dev/sdb and adding it to the volume group, which command should be used to extend the root logical volume and its filesystem in one step?

Accepted Answer

lvextend -r -l +100%FREE /dev/vg0/root. Extending an LVM logical volume and its filesystem in one step is done with lvextend -r (or --resizefs). The -r flag automatically calls the appropriate filesystem resize tool (resize2fs for ext4, xfs_growfs for XFS) after growing the LV. Using -l +100%FREE allocates all remaining extents in the volume group. This avoids a separate manual resize step and works for both ext4 and XFS, making it the most reliable choice.

Answer

vgextend vg0 /dev/sdb && lvcreate -l +100%FREE -n root vg0

Answer

lvresize -L +10G /dev/vg0/root && resize2fs /dev/vg0/root

Answer

pvresize /dev/sdb && lvextend -L +10G /dev/vg0/root

Question 5

A Linux administrator notices that a production server's root filesystem is 100% full, but du reports only 40 GB used on a 100 GB partition. Which command should the administrator use to identify deleted files still held open by running processes?

Accepted Answer

lsof +L1. The discrepancy between df and du indicates deleted files still held open by processes. lsof +L1 specifically lists open files with a link count of zero, which are deleted files still consuming disk space. This allows the administrator to identify the process holding the file and restart it to release the space.

Answer

fuser -mv /

Answer

df -i

Answer

find / -size +1G -exec ls -l {} \;

Question 6

A Linux administrator notices that a server's clock is drifting and NTP synchronization is failing. The administrator runs 'chronyc sources' and sees that all sources are marked with a '?' character. Which command should be run next to diagnose why chronyd cannot reach the NTP servers?

Accepted Answer

chronyc ntpdata. The '?' character in chronyc sources means the source is unreachable or has not provided a valid packet. To diagnose why, chronyc ntpdata shows per-source packet details, including whether NTP requests are being sent and responses received. This helps identify network blocks, incorrect server addresses, or firewall rules. Other chronyc subcommands like tracking, activity, and sourcestats do not provide the packet-level view needed for this specific failure.

Answer

chronyc tracking

Answer

chronyc activity

Answer

chronyc sourcestats

Question 7

A Linux administrator is troubleshooting a server that is running out of disk space. Which TWO commands can be used to identify which directories or files are consuming the most space? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip link set ens33 up && ip addr add 192.168.1.50/24 dev ens33. To restore connectivity, the administrator must both bring the interface up and assign an IP address. The `ip link set ens33 up` command changes the administrative state to UP, and `ip addr add` assigns the address. Combining them ensures the interface is operational with the correct IP, which is the most direct solution.

Answer

ip addr add 192.168.1.50/24 dev ens33

Answer

ifconfig ens33 192.168.1.50 netmask 255.255.255.0 up

Answer

ip route add 192.168.1.0/24 dev ens33

Question 8

A Linux server is experiencing intermittent network connectivity issues. The administrator needs to capture and analyze network traffic to diagnose the problem. Which TWO commands or tools can be used to capture packets on the eth0 interface? (Choose two.)

Accepted Answer

tcpdump -i eth0. tcpdump and tshark are both packet capture tools that can operate on a specified interface like eth0. They allow real-time capture and analysis of network traffic, which is essential for diagnosing intermittent connectivity issues. The other commands provide statistics or connection lists but do not capture packets.

Answer

netstat -i eth0

Answer

nmap -sP 192.168.1.0/24

Answer

ss -t -a

Question 9

A Linux server's root filesystem was extended with LVM, but after a reboot users report that only the original capacity is available again. Running 'df -h' shows the mount smaller than the logical volume, and 'lvextend' completed successfully before the reboot. Which command should the administrator run to make the filesystem use the additional space on an XFS root volume?

Accepted Answer

xfs_growfs /. XFS filesystems must be grown with xfs_growfs rather than resize2fs, and the operation can be performed online on a mounted root filesystem. Since lvextend already expanded the logical volume, the remaining step is to tell XFS to claim the new space by pointing xfs_growfs at the mount point. Without this step the filesystem keeps its original size even though the block device is larger.

Answer

resize2fs /dev/mapper/vg0-root

Answer

parted /dev/sda resizepart 2 100%

Answer

vgchange -ay vg0

Question 10

A Linux administrator receives reports that a server becomes unresponsive for several seconds at a time. Running `uptime` shows a load average of 14.2 on a system with 4 CPU cores, and `vmstat 1` reports a steadily rising 'r' column with a 'wa' column near zero. Which command should the administrator run NEXT to identify which processes are consuming CPU time?

Accepted Answer

top -o %CPU. A load average of 14.2 on four cores with a growing run queue and almost no I/O wait indicates CPU contention, not storage or memory pressure. The fastest way to attribute that contention is a live, CPU-sorted process view, which shows exactly which tasks are runnable and consuming cycles so the administrator can decide whether to renice, restart, or investigate further.

Answer

iostat -x 1

Answer

free -m

Answer

df -h

Question 11

A Linux administrator notices that the /home filesystem is full. They want to identify which top-level directories under /home are consuming the most disk space. Which command should they run?

Accepted Answer

du -sh /home/*. To find which directories under /home are using the most space, the administrator needs aggregated per-directory sizes. The du command with -s and -h summarizes each top-level directory in human-readable units, directly identifying the largest consumers. Filesystem-level tools like df only confirm fullness, while recursive file listings require manual aggregation and partition tools are unrelated to in-filesystem usage.

Answer

ls -lR /home

Answer

df -h /home

Answer

fdisk -l /dev/sda

Question 12

A Linux administrator receives reports that a database server becomes unresponsive every day around 02:00. Reviewing logs, the administrator notices repeated messages about 'blocked for more than 120 seconds' and high I/O wait. Which command should be used to identify which process is generating the most disk I/O during this period?

Accepted Answer

iotop -o -d 5. The administrator must attribute heavy disk I/O to a specific process. iotop is designed for per-process I/O monitoring and the -o flag filters out idle processes, making it ideal for identifying the culprit during the nightly issue. Other tools show device-level or system-wide I/O but cannot tie activity to a process.

Answer

iostat -x 5

Answer

vmstat 5

Answer

sar -d 5 3

Question 13

A production web server intermittently stops responding for about 30 seconds at a time. The administrator runs 'vmstat 1' during an incident and observes the 'wa' column consistently above 80 while 'us' and 'sy' remain low. Which conclusion best describes the bottleneck?

Accepted Answer

Processes are blocked waiting on I/O, indicating a storage subsystem bottleneck rather than CPU saturation.. In vmstat output the wa column reports the percentage of CPU time spent idle while outstanding I/O requests exist. When wa is very high while us and sy stay low, the processors are not the limiting factor; the storage path is. The intermittent multi-second stalls are consistent with a storage device or array struggling to service requests, so the administrator should investigate disk health, queue depth, and I/O load.

Answer

The kernel is spending excessive time in system calls, indicating a runaway kernel thread.

Answer

User-space applications are consuming all available CPU cycles, indicating a runaway process.

Answer

The system is swapping heavily because physical memory is exhausted, indicating a memory shortfall.

Question 14

A user reports that an application fails with 'Permission denied' when writing to /srv/reports, even though the user is a member of the group that owns the directory. Running `ls -ld /srv/reports` returns 'drwxr-x--- 2 root reports 4096 Jun 10 09:14 /srv/reports'. The user's `id` output confirms membership in the reports group. Which action will allow the user to create files in that directory?

Accepted Answer

Run chmod g+w /srv/reports as root. The mode string shows the group triad as r-x, so members of the reports group can list and enter the directory but cannot create entries. Since the user's group membership is verified, the correct fix is to add write permission to the group triad only. This grants exactly the needed capability while preserving the restrictive access for all other accounts.

Answer

Run chmod u+w /srv/reports as root

Answer

Run chmod o+w /srv/reports as root

Answer

Run chown user:reports /srv/reports as root

Question 15

A Linux server's root filesystem is filling rapidly. The administrator suspects a process is writing to a deleted file that still holds space. They want to identify which running process has an open file descriptor to a deleted file. Which command should they use?

Accepted Answer

lsof +L1. When a process holds a deleted file open, the inode and its blocks remain allocated until the process closes or exits, so the space does not return to the filesystem. The lsof command with +L1 filters open files whose link count is below one, precisely matching deleted-but-open files. It outputs the responsible PID and command, enabling the administrator to restart the process and reclaim the space.

Answer

vmstat 1 5

Answer

ps aux --sort=-%mem

Answer

df -i /