XK0-006 Troubleshooting Practice Test 5 — 15 Questions

Question 1

A Linux engineer is investigating high disk I/O on a server. Which command provides disk I/O statistics including %util, await, r/s, and w/s?

Accepted Answer

iostat -x 1. iostat reports CPU and disk I/O statistics, with columns like %util, await, r/s, and w/s.

Answer

sar -b

Answer

vmstat 1 5

Answer

free -h

Question 2

During boot, a Linux system displays a kernel panic with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Corrupt initramfs missing a necessary kernel module for the root device. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' occurs when the kernel cannot locate or access the root filesystem device. This typically happens because the initramfs (initial RAM filesystem) is corrupt or missing the kernel module (e.g., storage controller driver like ahci, virtio_blk, or LVM/dm modules) needed to detect and mount the root device. Without that module, the kernel has no way to translate the root= parameter into a usable block device, resulting in unknown-block(0,0).

Answer

Incorrect time configuration in the BIOS

Answer

The /etc/fstab file has an invalid filesystem type for the root partition

Answer

A defective network cable

Question 3

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

Accepted Answer

strace -p . strace is the standard Linux utility for tracing system calls made by a process. Using strace -p attaches to an already-running process and displays its system calls in real time, which is exactly what is needed to diagnose a misbehaving process at the kernel interface level. This makes it the correct tool for observing file opens, reads, writes, network calls, and signal handling.

Answer

tcpdump -i any

Answer

ltrace -p <PID>

Answer

lsof -p <PID>

Question 4

An administrator wants to capture network traffic on interface eth0, writing the output to a file for later analysis, without resolving hostnames. Which command accomplishes this?

Accepted Answer

tcpdump -i eth0 -w capture.pcap -n. tcpdump -i eth0 -w capture.pcap -n captures packets on interface eth0, writes them to capture.pcap for later analysis, and the -n flag prevents hostname resolution (shows IP addresses instead). This matches all three requirements: interface selection, file output, and no name resolution.

Answer

tcpdump -i eth0 -r capture.pcap

Answer

tcpdump -i any -w capture.pcap

Answer

tcpdump -n -w eth0 capture.pcap

Question 5

A technician needs to check the current memory usage on a Linux system, including buffers and cache. Which command provides the most user-friendly output?

Accepted Answer

free -h. The `free -h` command displays memory usage in a human-readable format (e.g., KiB, MiB, GiB) and explicitly breaks down total, used, free, shared, buffers/cache, and available memory. This makes it the most user-friendly option for quickly assessing current memory usage including buffers and cache.

Answer

cat /proc/meminfo

Answer

iostat -m

Answer

vmstat -s

Question 6

A server is experiencing intermittent network connectivity issues. The administrator wants to run a continuous test that combines ping and traceroute to monitor the path and packet loss to a target host. Which command should be used?

Accepted Answer

mtr target. The mtr command combines the functionality of ping and traceroute by continuously sending packets to a target and displaying per-hop latency and packet loss, making it ideal for monitoring intermittent network issues over time.

Answer

tcpdump -i any host target

Answer

ping -f target

Answer

traceroute -n target

Question 7

An administrator needs to check the current routing table on a Linux system. Which command should be used?

Accepted Answer

ip route. The `ip route` command displays the kernel routing table, showing the paths that packets take to reach network destinations. This is the standard tool on modern Linux systems for viewing and manipulating routing entries, replacing the older `route -n` command.

Answer

dig -t A

Answer

ss -r

Answer

ip neigh

Question 8

An administrator needs to identify which processes are consuming the most CPU and memory resources. Which two commands can provide this information? (Choose two.)

Accepted Answer

top. Option A, top, is correct because it is an interactive process monitor that displays a live, continuously refreshed list of running processes ranked by CPU usage by default, and it also shows per-process memory (RES/%MEM) so the administrator can identify the top CPU and memory consumers in one view. Option E, ps aux --sort=-%mem, is correct because it produces a static snapshot of all processes (a = all users, u = user-oriented format, x = include processes without a controlling terminal) sorted in descending order by memory percentage, which directly reveals the heaviest memory consumers and, with the aux output, their CPU usage as well. Option B, free -h, is not correct because it only reports aggregate system memory and swap usage in human-readable units, not per-process consumption. Option C, iostat -x, is not correct because it reports extended disk I/O and CPU utilization statistics per device, not which processes are using CPU or memory. Option D, vmstat 1 5, is not correct because it samples system-wide virtual memory, CPU, and I/O statistics every second for five iterations, but it does not attribute resource usage to individual processes.

Answer

free -h

Answer

iostat -x

Answer

vmstat 1 5

Question 9

A Linux administrator needs to view all current IPv4 addresses assigned to network interfaces on a system. Which command should be used?

Accepted Answer

ip addr. The 'ip addr' command displays all IP addresses assigned to network interfaces. 'ifconfig' is deprecated, 'ip link' shows link-layer info, and 'hostname -I' only shows primary IPs.

Answer

ip link show

Answer

ifconfig -a

Answer

hostname -I

Question 10

A user reports that they cannot access a web server at 192.168.1.100. The administrator wants to check if the server is reachable and measure round-trip time. Which command is most appropriate?

Accepted Answer

ping 192.168.1.100. The `ping` command sends ICMP Echo Request packets to the target host and waits for ICMP Echo Reply packets, which directly tests reachability and measures round-trip time (RTT). This is the most appropriate tool for the administrator's stated goal of checking if the server is reachable and measuring RTT.

Answer

nmap -sn 192.168.1.100

Answer

traceroute 192.168.1.100

Answer

ss -tlnp | grep 192.168.1.100

Question 11

An administrator is troubleshooting a DNS issue and needs to query the authoritative name servers for example.com. Which dig command should be used?

Accepted Answer

dig example.com NS. The NS (Name Server) record type identifies the authoritative name servers for a domain. Running 'dig example.com NS' queries those NS records directly, showing which servers are authoritative for example.com. This is the correct query to enumerate authoritative name servers.

Answer

dig example.com MX

Answer

dig example.com A

Answer

dig example.com ANY

Question 12

A system administrator notices that a web server is running but users cannot connect to port 443. Which ss command will show if the server is listening on that port?

Accepted Answer

ss -tlnp. The ss command with -tlnp shows TCP sockets (-t), in listening state (-l), with numeric ports (-n), and the owning process (-p). That combination directly answers whether anything is bound to TCP 443 and which process holds it. This is the standard diagnostic for a web server that is running but unreachable on its expected port.

Answer

ss -s

Answer

ss -tuln

Answer

ss -tan

Question 13

A system is experiencing high disk I/O wait. Which command can provide disk I/O statistics such as requests per second and average wait time?

Accepted Answer

iostat -x 1. The iostat -x 1 command provides extended disk I/O statistics, including requests per second (r/s, w/s), average wait time (await), and utilization (%util), refreshed every second. This directly answers the need for per-device I/O performance data during high I/O wait.

Answer

sar -u 1 5

Answer

free -h

Answer

vmstat 1 5

Question 14

An administrator needs to check the kernel ring buffer for hardware error messages after a system crash. Which command should be used?

Accepted Answer

dmesg. dmesg shows kernel ring buffer messages including hardware errors. journalctl -k shows kernel messages from systemd journal, but dmesg is the direct command for the ring buffer.

Answer

journalctl -k

Answer

tail -f /var/log/messages

Answer

strace -e trace=open

Question 15

A technician suspects a process is leaking file descriptors. Which command can be used to list open files associated with a specific PID?

Accepted Answer

lsof -p PID. The lsof (list open files) command with the -p flag filters output to show all open files associated with a specific process ID. Since Linux treats file descriptors as open files (including sockets, pipes, and regular files), lsof -p PID is the canonical tool for diagnosing file descriptor leaks by revealing exactly what a process has open.

Answer

top -p PID

Answer

strace -p PID

Answer

ltrace -p PID