XK0-006 Troubleshooting Practice Test 6 — 15 Questions

Question 1

A server running RHEL 8 has intermittent network connectivity. The administrator wants to view the current DNS resolver configuration. Which file should be examined?

Accepted Answer

/etc/resolv.conf. The /etc/resolv.conf file is the standard configuration file that lists the DNS nameservers (via 'nameserver' directives) and search domains used by the resolver. On RHEL 8, even when NetworkManager manages DNS, the effective resolver configuration is written to /etc/resolv.conf (often as a symlink to /run/NetworkManager/resolv.conf). Therefore, examining this file shows the current DNS resolver settings.

Answer

/etc/sysconfig/network-scripts/ifcfg-eth0

Answer

/etc/nsswitch.conf

Answer

/etc/hosts

Question 2

A technician needs to trace the system calls made by a running process to debug a performance issue. Which tool should be used?

Accepted Answer

strace -p PID. `strace -p PID` intercepts and records system calls (kernel-level operations like file I/O, network, and process control) made by a running process, which is exactly what is needed to trace system calls for debugging performance issues. The `-p` flag attaches strace to an existing process by its PID, allowing real-time monitoring of kernel interactions.

Answer

gdb -p PID

Answer

lsof -p PID

Answer

ltrace -p PID

Question 3

A Linux administrator is troubleshooting a service that fails to start. Which TWO commands can be used to view the last 20 lines of the systemd journal for the sshd unit?

Accepted Answer

journalctl -u sshd -n 20. Option A, `journalctl -u sshd -n 20`, is correct because `-u sshd` filters the journal to the sshd unit and `-n 20` limits the output to the last 20 lines, exactly matching the requirement. Option B, `journalctl -u sshd | tail -20`, is also correct because `journalctl -u sshd` produces the sshd unit's journal entries and piping them to `tail -20` displays only the final 20 lines. Option C, `journalctl -k -n 20`, is wrong because `-k` restricts output to kernel messages rather than the sshd unit. Option D, `journalctl -u sshd -p err`, is wrong because `-p err` filters by priority level (error and above) instead of returning the last 20 lines. Option E, `journalctl -b -u sshd`, is wrong because `-b` limits output to the current boot but does not restrict the result to the last 20 lines.

Answer

journalctl -k -n 20

Answer

journalctl -u sshd -p err

Answer

journalctl -b -u sshd

Question 4

A system administrator is investigating a slow website. The web server is responding but pages load slowly. Which THREE commands can help identify network latency or packet loss?

Accepted Answer

mtr example.com. Option B, mtr example.com, is correct because mtr combines ping and traceroute into a continuous, per-hop report showing packet loss percentages and latency (average/best/worst) at each router along the path, which directly exposes where latency or loss is introduced. Option C, ping -c 10 example.com, is correct because it sends 10 ICMP Echo Requests and reports round-trip time statistics plus packet loss percentage to the destination, giving a quick measure of latency and loss to the target host. Option E, traceroute example.com, is correct because it maps the hop-by-hop path to the destination using incrementing TTL values and reports per-hop RTTs, revealing which intermediate hop adds delay or drops packets. Option A, dig example.com, is not correct here because it only queries DNS records and measures name-resolution behavior, not end-to-end network latency or packet loss. Option D, ss -tlnp, is not correct because it merely lists local listening TCP sockets and their owning processes, providing no path latency or loss measurements.

Answer

dig example.com

Answer

ss -tlnp

Question 5

A Linux administrator needs to check which services are listening on TCP port 22. Which command should be used?

Accepted Answer

ss -tlnp | grep :22. The 'ss' command (socket statistics) with the -tlnp flags lists TCP (-t) listening (-l) sockets with numeric ports (-n) and the owning process (-p). Piping to grep :22 filters for port 22, showing which service is listening on SSH. This is the modern replacement for netstat and is available on all current Linux distributions.

Answer

ping -p 22 localhost

Answer

ip addr show port 22

Answer

traceroute -p 22 localhost

Question 6

A system administrator is troubleshooting a network issue where a server cannot reach the internet. The server's IP address is 192.168.1.10/24, and the default gateway is 192.168.1.1. Which command should be used to verify the default gateway configuration?

Accepted Answer

ip route show. The `ip route show` command displays the kernel's IPv4 routing table, which includes the default gateway entry (destination 0.0.0.0/0 via 192.168.1.1). This directly verifies whether the default gateway is configured correctly for the server to reach external networks.

Answer

ip neigh show

Answer

ip addr show

Answer

ip link show

Question 7

During boot, a Linux system displays a kernel panic indicating 'not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Missing or corrupt initramfs. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate or access the root filesystem. This is most commonly caused by a missing or corrupt initramfs (initial RAM filesystem), which contains the necessary drivers and modules to mount the root filesystem. Without a valid initramfs, the kernel has no way to load storage drivers (e.g., for SATA, NVMe, or LVM) and thus fails to mount the root device.

Answer

Network configuration error

Answer

A failed filesystem check due to dirty file system

Answer

Incorrect GRUB timeout value

Question 8

A user reports that a web server is unreachable. The administrator runs 'curl -I https://example.com' and gets no response. Which command should be used next to check if the server is reachable at the network level?

Accepted Answer

ping -c 4 example.com. The `curl -I` command failed to get a response, which could be due to a network-level issue rather than an application-layer problem. The `ping` command uses ICMP echo requests to test basic IP-level connectivity to the host, bypassing higher-layer protocols like HTTP/TLS. If the server is unreachable at the network layer, `ping` will show packet loss or timeouts, confirming a routing or firewall issue.

Answer

dig -x example.com

Answer

lsof -i :443

Answer

ss -tlnp | grep 443

Question 9

A system is experiencing high load average. The administrator runs 'vmstat 1 5' and sees a high 'wa' value. What does this indicate?

Accepted Answer

High disk I/O wait. The 'wa' column in vmstat output indicates the percentage of time the CPU is waiting for I/O operations to complete. A high 'wa' value means the CPU is idle because it is blocked waiting for disk I/O, which directly points to high disk I/O wait. This is a classic indicator of a storage bottleneck.

Answer

High memory swapping activity

Answer

High CPU usage by user processes

Answer

High network I/O

Question 10

A server running RHEL 8 fails to boot with a 'Dependency failed for /data' error. The /data filesystem is an ext4 partition on /dev/sdb1. Which sequence of steps should be taken to repair the filesystem?

Accepted Answer

Boot into rescue mode, run 'umount /dev/sdb1', then 'fsck.ext4 -f /dev/sdb1'. To repair an ext4 filesystem that failed to mount at boot, you must boot into rescue mode (or single-user), ensure the filesystem is unmounted, then run 'fsck.ext4 -f /dev/sdb1' to force a check and repair. fsck must never run on a mounted read-write filesystem, and rescue mode gives you a clean environment where /data is not mounted. This is the standard RHEL recovery procedure.

Answer

Use 'xfs_repair /dev/sdb1' since it's ext4

Answer

Run 'fsck.ext4 -f /dev/sdb1' from the running system

Answer

Remount the filesystem as read-only and run fsck

Question 11

An administrator wants to check the amount of free memory and swap usage on a system in a human-readable format. Which command should be used?

Accepted Answer

free -h. The free command displays total, used, and available physical memory and swap space, and the -h flag formats the output in human-readable units such as MiB and GiB. This directly satisfies the requirement to check free memory and swap usage in a readable format. It is the standard Linux utility for this purpose.

Answer

vmstat -h

Answer

cat /proc/meminfo

Answer

iostat -h

Question 12

A user reports that they cannot access a website by domain name but can access it by IP address. Which of the following is the most likely cause?

Accepted Answer

DNS resolution problem. The user can access the website by IP address but not by domain name, which directly indicates that the system is unable to resolve the domain name to its corresponding IP address. This is a classic symptom of a DNS resolution problem, where the DNS client cannot query a DNS server or the DNS server fails to return the correct A or AAAA record. The fact that the web server is reachable by IP confirms that network connectivity and the web service itself are functioning correctly.

Answer

Web server is down

Answer

Firewall blocking port 80

Answer

Incorrect default gateway

Question 13

A system fails to boot with a kernel panic. The administrator wants to recover by accessing a root shell. Which THREE methods can be used to achieve this?

Accepted Answer

Append 'single' to the kernel command line in GRUB. Option B is correct because appending 'single' (or '1') to the kernel command line in GRUB boots the system into single-user/rescue mode, which starts a root shell without requiring the normal login and is a standard recovery method. Option D is correct because appending 'rd.break' to the kernel command line interrupts the boot process in the initramfs (dracut) before the root filesystem is mounted, dropping the administrator into a root shell where the real root can be mounted and repaired. Option E is correct because booting from a live CD/USB and then chrooting into the installed system's root filesystem gives a root shell with access to the broken system's files and tools, allowing repairs such as reinstalling GRUB or fixing /etc/fstab. Option A is incorrect because 'fsck /dev/sda1' is not a valid GRUB command-line operation for obtaining a root shell; GRUB's command line is for bootloader commands, not for running filesystem checks as a recovery shell. Option C is incorrect because pressing 'e' in GRUB only opens the menu entry for editing and removing 'quiet' merely changes console verbosity; it does not by itself provide a root shell.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Press 'e' in GRUB and remove 'quiet'

Question 14

A system administrator is investigating high disk I/O on a server. Which command can provide disk utilization statistics, including average wait time (await) and percentage of CPU time during which I/O requests were issued (%util)?

Accepted Answer

iostat -x 1. The `iostat` command reports disk I/O statistics including await and %util.

Answer

free -h

Answer

sar -b 1 5

Answer

vmstat 1 5

Question 15

During boot, a Linux system displays a kernel panic with the message 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Corrupted initramfs missing necessary storage drivers. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or access the root filesystem. This is most commonly caused by a corrupted or missing initramfs that lacks the necessary storage drivers (e.g., for SATA, NVMe, or LVM) to communicate with the root device. Without these drivers, the kernel cannot read the root filesystem, resulting in a panic.

Answer

Incorrect GRUB timeout setting

Answer

A faulty RAM module causing memory errors

Answer

Filesystem corruption on the boot partition