XK0-006 Troubleshooting Practice Test 4 — 15 Questions

Question 1

A Linux administrator is troubleshooting a slow web server. They suspect high disk I/O. Which TWO commands can be used to monitor disk I/O statistics?

Accepted Answer

iostat -x 1. iostat directly reports disk I/O stats; sar can collect and report I/O statistics historically.

Answer

free -h

Answer

vmstat 1

Answer

lsof

Question 2

A system fails to boot with a kernel panic. The administrator wants to recover by accessing a root shell. Which THREE methods can be used to achieve this?

Accepted Answer

Append 'single' to the kernel command line in GRUB. Appending 'single' to the kernel command line in GRUB instructs the kernel to boot into single-user mode, which provides a root shell without requiring a password. This is a standard method for recovering from a kernel panic by allowing the administrator to repair filesystems or troubleshoot boot issues.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Press 'e' in GRUB and remove 'quiet'

Question 3

An administrator is investigating a security incident and needs to list all open network connections on a server, including listening and established connections, with process information. Which of the following commands can provide this information? (Choose all that apply.)

Accepted Answer

lsof -i -P -n. All three commands (lsof -i -P -n, netstat -tulpn, and ss -tulpn) can display open network connections with process information. lsof lists open files, and the -i flag filters for network connections; netstat and ss with the -tulpn flags show TCP/UDP listening and established connections along with the associated process ID.

Answer

tcpdump -i any

Answer

nmap -sT localhost

Question 4

A Linux administrator needs to check the listening TCP ports on a server. Which command should be used to view only listening TCP ports and the associated processes?

Accepted Answer

ss -tlnp. The `ss -tlnp` command displays only TCP sockets (`-t`), listening sockets (`-l`), numeric addresses/ports (`-n`), and the associated process information (`-p`). This is the modern replacement for `netstat` and is the most direct way to view listening TCP ports and their processes on a Linux system.

Answer

lsof -iTCP -sTCP:LISTEN

Answer

nmap -sT localhost

Answer

netstat -tlnp

Question 5

A system administrator is investigating high disk I/O on a server. Which command can provide disk utilization statistics, including average wait time (await) and percentage of CPU time during which I/O requests were issued (%util)?

Accepted Answer

iostat -x 1. The `iostat` command reports disk I/O statistics including await and %util.

Answer

free -h

Answer

sar -b 1 5

Answer

vmstat 1 5

Question 6

During boot, a Linux system displays a kernel panic with the message 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Corrupted initramfs missing necessary storage drivers. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or access the root filesystem. This is most commonly caused by a corrupted or missing initramfs that lacks the necessary storage drivers (e.g., for SATA, NVMe, or LVM) to communicate with the root device. Without these drivers, the kernel cannot read the root filesystem, resulting in a panic.

Answer

Incorrect GRUB timeout setting

Answer

A faulty RAM module causing memory errors

Answer

Filesystem corruption on the boot partition

Question 7

A user reports that they cannot reach a remote server by hostname but can reach it by IP address. Which file should be checked first for possible misconfiguration?

Accepted Answer

/etc/resolv.conf. The /etc/resolv.conf file configures the system's DNS resolver, specifying the nameservers to query for hostname-to-IP resolution. Since the user can reach the remote server by IP but not by hostname, the issue is likely with DNS resolution, and /etc/resolv.conf is the first file to check for misconfigured or missing nameserver entries.

Answer

/etc/nsswitch.conf

Answer

/etc/hosts

Answer

/etc/sysconfig/network

Question 8

A Linux system is running slowly with high I/O wait as shown by vmstat. To investigate the I/O activity of a specific process that is suspected of causing the bottleneck, which of the following commands would be used to trace its system calls related to I/O?

Accepted Answer

strace -p . The 'wa' in vmstat indicates CPU time spent waiting for I/O. To examine what I/O operations a particular process is performing, strace can be used to trace system calls such as read, write, and ioctl. By attaching to the process with strace -p , the administrator can see the I/O calls being made in real time. iostat provides aggregated per-device statistics, not per-process details. dmesg shows kernel messages, which may contain I/O errors but not process-level I/O patterns. free displays memory usage and is unrelated to I/O tracing.

Answer

iostat -x 1

Answer

dmesg | tail

Answer

free -h

Question 9

An administrator needs to capture network traffic on interface eth0, filter for packets to/from host 10.0.0.1, and save the output to a file for later analysis. Which command should be used?

Accepted Answer

tcpdump -i eth0 host 10.0.0.1 -w capture.pcap. The `tcpdump` command with the `host` filter captures all traffic (both source and destination) to or from the specified IP address, which matches the requirement to filter for packets to/from host 10.0.0.1. The `-i eth0` specifies the interface, and `-w capture.pcap` writes the output to a file for later analysis.

Answer

tcpdump -i eth0 src 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 dst 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 -n host 10.0.0.1 -w capture.pcap

Question 10

A technician is troubleshooting a network connectivity issue. They need to trace the path packets take to a remote server and see the round-trip time for each hop. Which command should they use?

Accepted Answer

traceroute. traceroute (or tracepath) shows the path and RTT per hop.

Answer

ping

Answer

nslookup

Answer

nmap

Question 11

A system administrator wants to review kernel-related log messages from the current boot session. Which journalctl command should be used to filter the kernel messages?

Accepted Answer

journalctl -k. journalctl -k shows kernel messages from the current boot.

Answer

journalctl -p err

Answer

journalctl -b -u systemd-journald

Answer

journalctl --since today

Question 12

A Linux server fails to boot and drops into a GRUB prompt. The administrator needs to boot into single-user mode to repair the system. Which GRUB command should be added to the kernel line temporarily?

Accepted Answer

single. Adding 'single' to the kernel boot parameters boots into single-user mode.

Answer

rd.break

Answer

systemd.unit=rescue.target

Answer

debug

Question 13

An administrator is troubleshooting a service that fails to start with a 'Permission denied' error. The administrator runs `strace -f -o /tmp/strace.log systemctl start myservice`. Which of the following best describes what this command achieves?

Accepted Answer

It traces system calls for systemctl and its children, recording them to a file.. strace traces system calls; -f follows child processes; -o writes output to file.

Answer

It records the kernel messages related to the service start.

Answer

It monitors network connections opened by the service.

Answer

It traces library calls made by the service startup.

Question 14

A technician wants to check the current IP address and subnet mask of the eth0 interface. Which command should they use?

Accepted Answer

ip addr show dev eth0. The `ip addr show dev eth0` (or `ip addr`) displays IP addresses and subnet masks.

Answer

nmcli dev show eth0

Answer

ip route show

Answer

ifconfig eth0

Question 15

An administrator is investigating a network issue where a server cannot connect to an external website. They run `ping 8.8.8.8` successfully, but `ping google.com` fails. Which TWO of the following are the most likely causes? (Choose TWO.)

Accepted Answer

The DNS server is unreachable or misconfigured.. Successful ping to IP but failure to hostname indicates DNS resolution problem or incorrect DNS server configuration.

Answer

The network interface is down.

Answer

The default gateway is misconfigured.

Answer

The firewall is blocking ICMP traffic.