XK0-006 Troubleshooting Practice Test 4 — 15 Questions

Question 1

A Linux server fails to boot and drops into an emergency shell. The administrator notices that the /etc/fstab file contains an entry for a UUID that no longer exists. Which command should the administrator use to identify the correct UUID of the intended filesystem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

blkid. In an emergency shell, the administrator needs to find the correct filesystem UUID to update /etc/fstab. The `blkid` command lists all block devices with their UUIDs and filesystem types, making it the ideal tool. It is lightweight and typically available in recovery environments. Other commands either show partition UUIDs, are less reliable, or do not provide UUID information.

Answer

lsblk -f

Answer

mount -a

Answer

fdisk -l

Question 2

A Linux administrator notices that the /var/log directory is filling up rapidly. They suspect that a process is writing an excessive amount of data to a log file. Which command would best help identify the process that is actively writing to files in /var/log?

Accepted Answer

inotifywait -m -r /var/log. The goal is to identify the process actively writing to files in /var/log. inotifywait provides real-time monitoring of filesystem events, showing exactly which files are being modified and when. By observing the output, the administrator can see which files are repeatedly written and then use tools like lsof or fuser to find the associated process. This approach directly addresses the need to catch active write activity.

Answer

strace -p $(pgrep -d, -f rsyslogd)

Answer

fuser -v /var/log/*

Answer

lsof +D /var/log

Question 3

A Linux administrator is investigating a service that fails to start. The service's log indicates a permission denied error when trying to access a file. Which command should the administrator use to check the SELinux context of the file and the process?

Accepted Answer

ls -Z /path/to/file. To diagnose SELinux-related permission issues, the administrator must inspect the SELinux context of the file and compare it to the expected context for the service. The `ls -Z` command displays the context of a file. Other commands either change contexts, show global SELinux status, or list default mappings, but none show the actual context of a specific file.

Answer

chcon -t httpd_sys_content_t /path/to/file

Answer

semanage fcontext -l

Answer

getenforce

Question 4

A Linux administrator is investigating a server that becomes unresponsive for several seconds under load. They suspect high I/O wait. Which command should they use to display per-process I/O statistics, including the amount of data read from and written to storage, to identify the process causing the bottleneck?

Accepted Answer

iotop -o. To identify the process causing high I/O wait, a per-process I/O monitoring tool is required. `iotop -o` shows only active I/O processes sorted by usage, making it the most direct way to spot the culprit. `iostat` and `vmstat` provide device or system-wide views, and `pidstat -d` can show per-process I/O but is less immediate for interactive troubleshooting.

Answer

pidstat -d 1

Answer

vmstat 1

Answer

iostat -x 1

Question 5

A Linux server has a service that fails to start, and the administrator suspects that a required environment variable is not set correctly. The service unit file is managed by systemd. Which command should the administrator use to view the environment variables that systemd will pass to the service when it starts?

Accepted Answer

systemctl show <service> --property=Environment. To see the environment variables that systemd will pass to a service, the administrator should query the unit's Environment property. systemctl show with --property=Environment returns the effective environment, including variables set in the unit file and any drop-in overrides. This provides a definitive answer without needing to interpret unit file contents manually.

Answer

systemctl status <service>

Answer

systemctl cat <service>

Answer

systemd-analyze environment <service>

Question 6

A Linux administrator is troubleshooting a server that intermittently loses network connectivity. The administrator suspects packet loss on the local segment. Which command should be used to continuously ping the default gateway and display a timestamp for each reply to correlate with other logs?

Accepted Answer

ping -D -i 1 192.168.1.1. To continuously monitor connectivity and correlate with logs, ping with the -D option adds timestamps to each reply, and -i 1 sets a one-second interval. This produces a steady stream of timestamped results, making it easy to match packet loss events with other log entries. Other tools like traceroute, mtr, and arping serve different diagnostic purposes and do not provide the same continuous, timestamped single-hop monitoring.

Answer

traceroute -n 192.168.1.1

Answer

arping -I eth0 192.168.1.1

Answer

mtr -r -c 10 192.168.1.1

Question 7

A Linux administrator is troubleshooting a service that fails to start. The service unit file is located at /etc/systemd/system/myapp.service. The administrator runs `systemctl start myapp` and receives an error: 'Failed to start myapp.service: Unit myapp.service not found.' Which command should the administrator use to verify the unit file is recognized by systemd?

Accepted Answer

systemctl daemon-reload && systemctl list-units --type=service --all | grep myapp. The error 'Unit not found' indicates systemd has not loaded the unit file. This often occurs because the unit file was recently added or modified and systemd's configuration has not been reloaded. Running `systemctl daemon-reload` forces systemd to re-read all unit files. Then, listing all units with `--all` and filtering confirms whether the unit is recognized. This sequence is essential for troubleshooting new or changed unit files.

Answer

systemctl show myapp.service

Answer

systemctl list-unit-files --type=service | grep myapp

Answer

systemctl status myapp.service

Question 8

A Linux server is experiencing high CPU usage. The administrator runs top and sees a process in 'D' state consuming significant CPU time. Which command should the administrator use to investigate what the process is waiting for?

Accepted Answer

cat /proc//stack. The /proc//stack file exposes the kernel stack of a process, which for a D state process shows the exact kernel function where it is blocked. This directly answers what the process is waiting for, such as a mutex or disk I/O completion. Other commands either list D state processes or provide system-wide I/O statistics without per-process kernel details.

Answer

iostat -x 1

Answer

ps -eo pid,stat,comm | grep D

Answer

strace -p <PID>

Question 9

A Linux administrator is troubleshooting a system that is experiencing high CPU usage. The administrator runs `top` and sees that a process named `python3` is consuming 95% CPU. The administrator wants to identify which specific Python script is running under this process. Which command should the administrator use?

Accepted Answer

lsof -p | grep '\.py'. To identify the specific Python script, the administrator should look at the files opened by the process. Python opens the script file and keeps it open during execution. Using `lsof -p ` and filtering for '.py' files will reveal the script's path. This method is more reliable than checking command-line arguments, which may not always include the script name.

Answer

ps -p <PID> -o args

Answer

cat /proc/<PID>/cmdline | tr '\0' ' '

Answer

ls -l /proc/<PID>/exe

Question 10

A Linux administrator is troubleshooting a server that fails to boot properly. The system drops into an emergency shell. The administrator wants to inspect the boot process and identify which systemd unit failed. Which TWO commands can be used to display failed systemd units and their status? (Choose two.)

Accepted Answer

journalctl -b -p err. To identify failed units, the administrator can use systemctl --failed to get a list of failed units, and journalctl -b -p err to see error messages from the current boot that explain why those units failed. Together, these commands provide both the list and the cause, enabling effective troubleshooting.

Answer

systemctl status

Answer

systemctl list-units --state=failed

Answer

systemd-analyze blame

Question 11

A developer reports that a service they started manually from an SSH session stopped running shortly after they disconnected. They want the process to keep running after logout and to survive a dropped connection. Which command should they use to launch it?

Accepted Answer

nohup ./myservice &. The failure is caused by SIGHUP being delivered to the process when its controlling terminal disappears. Running the service through nohup ignores that signal, and the ampersand detaches it from the foreground so the shell is usable again. Together they satisfy both requirements: survive logout and return control to the developer.

Answer

setsid ./myservice

Answer

./myservice &

Answer

disown -h %1

Question 12

A Linux administrator is troubleshooting a server that has become unresponsive. The administrator suspects a process is consuming excessive CPU. Which command should be used to display a real-time, sorted list of processes by CPU usage, allowing the administrator to identify the top CPU consumer?

Accepted Answer

ps aux --sort=-%cpu | head. The administrator needs to identify the top CPU-consuming process. ps aux --sort=-%cpu | head provides a sorted, non-interactive list of processes by CPU usage, making it ideal for a quick check. While top and htop are interactive and vmstat is system-wide, ps with sorting directly answers the question.

Answer

vmstat 1 5

Answer

top -o %CPU

Answer

htop

Question 13

A Linux administrator is troubleshooting a server that is experiencing intermittent network connectivity issues. The administrator suspects that the network interface is dropping packets or experiencing errors. Which TWO commands can be used to display statistics about packet drops and errors on a network interface? (Choose two.)

Accepted Answer

ip -s link show eth0. The `ip -s link show eth0` command provides interface statistics including errors and drops, and `ethtool -S eth0` offers detailed hardware-level counters for the same. Both are current, widely available tools. The other commands either are deprecated, show different information, or do not focus on interface errors.

Answer

netstat -i

Answer

ss -s

Answer

ifconfig eth0

Question 14

A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?

Accepted Answer

ss -tlnp. The `ss` command is the modern replacement for `netstat`, providing socket statistics. The flags `-tlnp` specifically show TCP (`-t`) listening (`-l`) sockets with numeric ports (`-n`) and the process (`-p`) using them, which directly answers the administrator's need to see listening TCP ports and associated services.

Answer

nmap localhost

Answer

ip link show

Answer

dig -t any localhost

Question 15

A user reports that they cannot reach a website. The administrator wants to check the path that packets take to the destination server. Which command should be used?

Accepted Answer

traceroute. The `traceroute` command is used to trace the path packets take from the source to a destination host, showing each hop (router) along the way. It uses ICMP echo requests (or UDP packets on Linux) with incrementing TTL values to elicit ICMP Time Exceeded messages from intermediate routers, which reveals the network path. This directly addresses the administrator's need to check the path to the destination server.

Answer

ip addr

Answer

ss

Answer

ping