XK0-006 Troubleshooting Practice Test 2 — 15 Questions

Question 1

A Linux administrator needs to check the listening TCP ports on a server. Which command should be used to view only listening TCP ports and the associated processes?

Accepted Answer

ss -tlnp. The `ss -tlnp` command displays only TCP sockets (`-t`), listening sockets (`-l`), numeric addresses/ports (`-n`), and the associated process information (`-p`). This is the modern replacement for `netstat` and is the most direct way to view listening TCP ports and their processes on a Linux system.

Answer

lsof -iTCP -sTCP:LISTEN

Answer

nmap -sT localhost

Answer

netstat -tlnp

Question 2

A technician needs to perform a DNS query to retrieve the mail exchange (MX) record for example.com using a specific DNS server at 8.8.8.8. Which command accomplishes this?

Accepted Answer

nslookup -type=MX example.com 8.8.8.8. All three commands `nslookup -type=MX example.com 8.8.8.8`, `host -t MX example.com 8.8.8.8`, and `dig example.com MX @8.8.8.8` can query the MX record for example.com using the specified DNS server 8.8.8.8. Option A is incorrect because the `dig` syntax with `-t MX` is non-standard; the correct syntax is `dig @server domain type` or `dig domain type @server`.

Answer

dig @8.8.8.8 example.com -t MX

Question 3

A user reports that they cannot reach a remote server by hostname but can reach it by IP address. Which file should be checked first for possible misconfiguration?

Accepted Answer

/etc/resolv.conf. The /etc/resolv.conf file configures the system's DNS resolver, specifying the nameservers to query for hostname-to-IP resolution. Since the user can reach the remote server by IP but not by hostname, the issue is likely with DNS resolution, and /etc/resolv.conf is the first file to check for misconfigured or missing nameserver entries.

Answer

/etc/nsswitch.conf

Answer

/etc/hosts

Answer

/etc/sysconfig/network

Question 4

A Linux server fails to boot and drops into a GRUB prompt. The administrator needs to boot into single-user mode to repair the system. Which GRUB command should be added to the kernel line temporarily?

Accepted Answer

single. At the GRUB prompt, appending 'single' to the kernel line boots the system into single-user (runlevel 1 / rescue) mode, which starts a minimal environment with root shell access and no network services. This is the classic method for repairing a system that fails to boot normally, allowing the administrator to fix filesystem, password, or service issues.

Answer

rd.break

Answer

systemd.unit=rescue.target

Answer

debug

Question 5

A technician wants to check the current IP address and subnet mask of the eth0 interface. Which command should they use?

Accepted Answer

ip addr show dev eth0. The `ip addr show dev eth0` (or `ip addr`) displays IP addresses and subnet masks.

Answer

nmcli dev show eth0

Answer

ip route show

Answer

ifconfig eth0

Question 6

A Linux system experiences intermittent network connectivity. The administrator suspects a faulty network cable or switch port. Which TWO of the following commands can provide information about link status, errors, and packet drops on the interface? (Choose TWO.)

Accepted Answer

ip link show eth0. Option C, `ip link show eth0`, is correct because it reports the interface's link state (UP/DOWN, LOWER_UP), MTU, and hardware address, and its statistics section exposes RX/TX errors, dropped packets, and overruns that point to a faulty cable or switch port. Option D, `ethtool eth0`, is correct because it queries the NIC driver for detailed link status such as Speed, Duplex, Link detected, and auto-negotiation, and `ethtool -S eth0` reports driver-level counters for errors and drops. Option A, `ss -i`, shows TCP socket-level congestion and retransmit info, not physical link status or interface error counters. Option B, `ip addr show eth0`, only displays IP addressing and basic flags, not error or drop statistics. Option E, `tcpdump -i eth0`, captures packet contents for traffic analysis but does not report link status, errors, or drop counters.

Answer

ss -i

Answer

ip addr show eth0

Answer

tcpdump -i eth0

Question 7

A Linux administrator wants to view all listening TCP ports and the associated processes on a system. Which command should be used?

Accepted Answer

ss -tlnp. The `ss -tlnp` command is correct because it displays all TCP listening sockets (`-t` for TCP, `-l` for listening) with numeric addresses (`-n`) and shows the associated process information (`-p`). This is the modern replacement for `netstat` and is the recommended tool on current Linux distributions for socket statistics.

Answer

lsof -i TCP

Answer

netstat -tulpn

Answer

nmap -sT localhost

Question 8

A technician needs to check the DNS A record for example.com using a specific DNS server at 8.8.8.8. Which command accomplishes this?

Accepted Answer

dig example.com @8.8.8.8 A. The command 'dig example.com @8.8.8.8 A' queries the DNS server at 8.8.8.8 for the A record of example.com. In dig syntax, the server is specified with '@' and the record type is given as the final argument (A is the default, but explicitly stating it is correct). This directly satisfies the requirement to check the A record using a specific DNS server.

Answer

host -a example.com 8.8.8.8

Answer

dig -x 8.8.8.8 example.com

Answer

nslookup example.com 8.8.8.8

Question 9

After modifying the network configuration on a RHEL 8 system using NetworkManager, what command should be used to apply the changes without restarting the network service?

Accepted Answer

nmcli con up 'System eth0'. The command 'nmcli con up 'System eth0'' is used to activate a specific NetworkManager connection profile, applying any changes made to its configuration without restarting the entire NetworkManager service. This command brings the connection up, which re-reads the profile and applies the new settings.

Answer

nmcli connection reload

Answer

ifup eth0

Answer

systemctl restart NetworkManager

Question 10

A Linux system fails to boot, displaying a 'kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' error. Which of the following is the most likely cause?

Accepted Answer

Corrupted initramfs. This error indicates the kernel cannot find the root filesystem, often due to a missing driver or incorrect root= parameter in the boot configuration.

Answer

Incorrect /etc/fstab entry

Answer

Full disk on /boot

Answer

Misconfigured GRUB timeout

Question 11

A web server is not responding on port 443. Using tcpdump to capture traffic on the server, which filter would capture only HTTPS packets?

Accepted Answer

tcpdump -i any tcp port 443. The filter 'tcpdump -i any tcp port 443' captures only TCP packets on port 443, which is HTTPS. HTTPS uses TCP, so specifying 'tcp port 443' is correct. The 'port 443' primitive in tcpdump matches both TCP and UDP, but since HTTPS is TCP, adding 'tcp' ensures only TCP traffic is captured.

Answer

tcpdump -i any port https

Answer

tcpdump -i any host 443

Answer

tcpdump -i any udp port 443

Question 12

A user reports that they cannot reach a website by name, but they can reach it by IP address. Which file should be checked first for possible misconfiguration?

Accepted Answer

/etc/resolv.conf. The /etc/resolv.conf file contains DNS resolver settings. If it is incorrect, name resolution will fail.

Answer

/etc/nsswitch.conf

Answer

/etc/hosts

Answer

/etc/sysconfig/network

Question 13

During boot, the system drops into an emergency target. Which command can be used to repair the root filesystem from this environment?

Accepted Answer

fsck /dev/sda1. In an emergency target, the root filesystem is typically mounted read-only, so running fsck directly on the device is the correct repair step for a traditional ext filesystem. The command fsck /dev/sda1 checks and repairs filesystem inconsistencies on that partition. This is the standard recovery action when boot fails due to filesystem corruption.

Answer

mount -o remount,rw / && fsck /

Answer

xfs_repair /dev/sda1

Answer

journalctl -xb

Question 14

A system administrator is troubleshooting a network issue and wants to use a tool that combines ping and traceroute functionality to identify packet loss and latency along the path. Which TWO tools can provide this combined functionality? (Choose two.)

Accepted Answer

tracepath. mtr (My Traceroute) combines continuous ping with traceroute path discovery, showing real-time latency and packet loss per hop. tracepath also provides path tracing with per-hop latency measurements, effectively combining path discovery and latency data, even though it does not perform continuous pinging like mtr. Both tools give insight into packet loss and latency along the path, fulfilling the question's requirement.

Answer

ping

Answer

tcpdump

Answer

traceroute

Question 15

A technician wants to capture network traffic to analyze a web server issue. Using tcpdump, which THREE options are useful for writing the capture to a file and avoiding name resolution? (Choose three.)

Accepted Answer

-n. Option A (-n) is correct because it disables DNS and service-name resolution in tcpdump, so addresses and ports are shown numerically, which directly satisfies the requirement to avoid name resolution and speeds up capture processing. Option B (-w capture.pcap) is correct because the -w flag writes the raw packets to a file (here capture.pcap) instead of printing them to the screen, which is exactly the requirement for writing the capture to a file. Option C (-i eth0) is correct because -i specifies the interface to capture on, and selecting eth0 ensures tcpdump listens on the intended network interface rather than a default one, which is necessary for a valid capture of the web server traffic. Option D (-c 100) is not marked correct because it only limits the capture to 100 packets and does not address file output or name resolution. Option E (-v) is not marked correct because it merely increases verbosity of the printed output and is unrelated to writing to a file or suppressing name resolution.

Answer

-c 100

Answer

-v