XK0-006 Troubleshooting Practice Test 3 — 15 Questions

Question 1

A Linux administrator is troubleshooting a service that fails to start. Which TWO commands can be used to view the last 20 lines of the systemd journal for the sshd unit?

Accepted Answer

journalctl -u sshd -n 20. journalctl -u sshd -n 20 shows last 20 lines for the unit. journalctl -u sshd | tail -20 also works. The others use wrong options or units.

Answer

journalctl -k -n 20

Answer

journalctl -u sshd -p err

Answer

journalctl -b -u sshd

Question 2

A system administrator is investigating a slow website. The web server is responding but pages load slowly. Which THREE commands can help identify network latency or packet loss?

Accepted Answer

mtr example.com. B is correct because `mtr` (My TraceRoute) combines the functionality of `ping` and `traceroute` into a single diagnostic tool. It continuously sends ICMP packets to each hop along the path to the target, displaying per-hop latency and packet loss statistics in real time. This makes it ideal for identifying where network latency or packet loss is occurring between the server and the client, which directly addresses the symptom of a slow website.

Answer

dig example.com

Answer

ss -tlnp

Question 3

An administrator needs to check the status of NetworkManager connections and devices. Which TWO commands provide this information?

Accepted Answer

nmcli dev status. The `nmcli dev status` command (option B) displays a summary of all NetworkManager-managed devices and their connection states, such as 'connected' or 'disconnected'. The `nmcli con show` command (option C) lists all configured connections (profiles) and their current status, including whether they are active. Together, these two commands provide the administrator with both device-level and connection-level status information required by the question.

Answer

nmcli device show

Answer

ifconfig -a

Answer

ip link show

Question 4

A Linux administrator needs to check which services are listening on TCP port 22. Which command should be used?

Accepted Answer

ss -tlnp | grep :22. The 'ss -tlnp' command shows listening TCP sockets with process information, making it suitable for checking services on port 22.

Answer

ping -p 22 localhost

Answer

ip addr show port 22

Answer

traceroute -p 22 localhost

Question 5

A system administrator is troubleshooting a network issue where a server cannot reach the internet. The server's IP address is 192.168.1.10/24, and the default gateway is 192.168.1.1. Which command should be used to verify the default gateway configuration?

Accepted Answer

ip route show. The `ip route show` command displays the kernel's IPv4 routing table, which includes the default gateway entry (destination 0.0.0.0/0 via 192.168.1.1). This directly verifies whether the default gateway is configured correctly for the server to reach external networks.

Answer

ip neigh show

Answer

ip addr show

Answer

ip link show

Question 6

During boot, a Linux system displays a kernel panic indicating 'not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Missing or corrupt initramfs. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate or access the root filesystem. This is most commonly caused by a missing or corrupt initramfs (initial RAM filesystem), which contains the necessary drivers and modules to mount the root filesystem. Without a valid initramfs, the kernel has no way to load storage drivers (e.g., for SATA, NVMe, or LVM) and thus fails to mount the root device.

Answer

Network configuration error

Answer

A failed filesystem check due to dirty file system

Answer

Incorrect GRUB timeout value

Question 7

A user reports that a web server is unreachable. The administrator runs 'curl -I https://example.com' and gets no response. Which command should be used next to check if the server is reachable at the network level?

Accepted Answer

ping -c 4 example.com. The `curl -I` command failed to get a response, which could be due to a network-level issue rather than an application-layer problem. The `ping` command uses ICMP echo requests to test basic IP-level connectivity to the host, bypassing higher-layer protocols like HTTP/TLS. If the server is unreachable at the network layer, `ping` will show packet loss or timeouts, confirming a routing or firewall issue.

Answer

dig -x example.com

Answer

lsof -i :443

Answer

ss -tlnp | grep 443

Question 8

An administrator wants to view the kernel ring buffer messages to check for hardware errors. Which command should be used?

Accepted Answer

dmesg. dmesg displays kernel ring buffer messages, often used for hardware diagnostics.

Answer

journalctl -k

Answer

iostat

Answer

vmstat

Question 9

A system is experiencing high load average. The administrator runs 'vmstat 1 5' and sees a high 'wa' value. What does this indicate?

Accepted Answer

High disk I/O wait. The 'wa' column in vmstat output indicates the percentage of time the CPU is waiting for I/O operations to complete. A high 'wa' value means the CPU is idle because it is blocked waiting for disk I/O, which directly points to high disk I/O wait. This is a classic indicator of a storage bottleneck.

Answer

High memory swapping activity

Answer

High CPU usage by user processes

Answer

High network I/O

Question 10

A server running RHEL 8 fails to boot with a 'Dependency failed for /data' error. The /data filesystem is an ext4 partition on /dev/sdb1. Which sequence of steps should be taken to repair the filesystem?

Accepted Answer

Boot into rescue mode, run 'umount /dev/sdb1', then 'fsck.ext4 -f /dev/sdb1'. To repair a filesystem, it must be unmounted; using a rescue environment (e.g., systemd emergency target) ensures the partition is not in use.

Answer

Use 'xfs_repair /dev/sdb1' since it's ext4

Answer

Run 'fsck.ext4 -f /dev/sdb1' from the running system

Answer

Remount the filesystem as read-only and run fsck

Question 11

A Linux administrator needs to find which process is using a specific file. Which command provides this information?

Accepted Answer

lsof /path/to/file. The `lsof` command (List Open Files) is the correct tool to identify which process is using a specific file. When invoked with a file path as an argument, `lsof` displays the PID, process name, and other details of any process that has the file open. This directly answers the administrator's need to find the process using that file.

Answer

fuser /path/to/file

Answer

strace /path/to/file

Answer

ltrace /path/to/file

Question 12

An administrator wants to check the amount of free memory and swap usage on a system in a human-readable format. Which command should be used?

Accepted Answer

free -h. free -h displays memory and swap usage in human-readable units (e.g., GiB).

Answer

vmstat -h

Answer

cat /proc/meminfo

Answer

iostat -h

Question 13

A technician suspects that a DNS resolution issue is causing connectivity problems. Which command can be used to query the DNS server for an A record for 'example.com'?

Accepted Answer

dig example.com A. The `dig` command is a flexible DNS lookup utility that can query specific record types. Using `dig example.com A` directly queries the DNS server for the IPv4 address (A record) of 'example.com', making it the correct choice for diagnosing DNS resolution issues.

Answer

traceroute example.com

Answer

ping example.com

Answer

nslookup example.com A

Question 14

A system administrator needs to capture network traffic on interface eth0, filtering for packets to or from host 10.0.0.1, and save the output to a file for later analysis. Which command accomplishes this?

Accepted Answer

tcpdump -i eth0 host 10.0.0.1 -w capture.pcap. Both tcpdump -i eth0 host 10.0.0.1 -w capture.pcap (A) and tcpdump -i eth0 -w capture.pcap host 10.0.0.1 (D) are valid commands to capture packets to/from host 10.0.0.1 on interface eth0 and write them to a file. In tcpdump, the -w option can be placed before or after the filter expression, as long as -w is followed by the filename. Options B and C are incorrect because they use wrong syntax or options.

Answer

tcpdump -n port 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 -host 10.0.0.1 > capture.pcap

Question 15

A user reports that they cannot access a website by domain name but can access it by IP address. Which of the following is the most likely cause?

Accepted Answer

DNS resolution problem. The user can access the website by IP address but not by domain name, which directly indicates that the system is unable to resolve the domain name to its corresponding IP address. This is a classic symptom of a DNS resolution problem, where the DNS client cannot query a DNS server or the DNS server fails to return the correct A or AAAA record. The fact that the web server is reachable by IP confirms that network connectivity and the web service itself are functioning correctly.

Answer

Web server is down

Answer

Firewall blocking port 80

Answer

Incorrect default gateway