XK0-006 Troubleshooting Practice Test 6 — 15 Questions

Question 1

A Linux administrator needs to view all listening TCP ports and the associated processes on a server. Which command should be used?

Accepted Answer

ss -tlnp. The ss command with -tlnp options shows listening TCP ports with process information, replacing netstat.

Answer

netstat -tulpn

Answer

lsof -i

Answer

nmap localhost

Question 2

A system is experiencing high memory usage. The administrator wants to see a brief summary of memory usage in human-readable format, including buffers and cache. Which command is most appropriate?

Accepted Answer

free -h. free -h displays memory usage in human-readable format, including buffers and cache.

Answer

iostat -m

Answer

cat /proc/meminfo

Answer

vmstat -s

Question 3

A Linux administrator is troubleshooting a DNS resolution issue. They need to query the MX record for example.com using a specific DNS server at 8.8.8.8. Which command should they use?

Accepted Answer

dig MX example.com @8.8.8.8. dig @server type name queries a specific DNS server for the specified record type.

Answer

host -t MX example.com 8.8.8.8

Answer

nslookup -type=MX example.com 8.8.8.8

Answer

ping -c 1 example.com

Question 4

During boot, a Linux system displays a kernel panic. The administrator suspects a corrupt initramfs. Which GRUB boot parameter can be added to boot into an emergency shell before the initramfs is loaded, allowing repair?

Accepted Answer

rd.break. The rd.break parameter stops the boot process before the initramfs is fully loaded, dropping to a shell for troubleshooting.

Answer

single

Answer

init=/bin/bash

Answer

emergency

Question 5

An administrator needs to check the kernel ring buffer for hardware error messages from the current boot. Which command displays this information?

Accepted Answer

dmesg. dmesg displays the kernel ring buffer, which includes hardware-related messages from the current boot.

Answer

vmstat -f

Answer

journalctl -k -b 0

Answer

cat /var/log/boot.log

Question 6

Which command is used to trace the network path to a destination host, showing each hop along the way, and is similar to traceroute but does not require root privileges by default?

Accepted Answer

tracepath. tracepath is similar to traceroute but uses UDP probes and does not require root, making it more accessible.

Answer

ip route

Answer

mtr

Answer

ping

Question 7

An administrator needs to capture network traffic on interface eth0, filtering only packets from host 192.168.1.1, and write the output to a file for later analysis. Which command accomplishes this?

Accepted Answer

tcpdump -i eth0 host 192.168.1.1 -w capture.pcap. tcpdump -i eth0 host 192.168.1.1 -w capture.pcap captures packets from the specified host on eth0 and writes to a file.

Answer

tcpdump -i eth0 src 192.168.1.1 -w capture.pcap

Answer

tcpdump -i eth0 dst 192.168.1.1 > capture.pcap

Answer

tcpdump -n -i eth0 host 192.168.1.1 > capture.pcap

Question 8

A technician wants to check the disk I/O statistics, focusing on the average I/O wait time and utilization percentage. Which command provides this information?

Accepted Answer

iostat -x. iostat displays disk I/O statistics including %util (utilization) and await (average I/O wait time).

Answer

sar -b

Answer

vmstat -d

Answer

free -h

Question 9

Which command shows the IP address, link status, and other configuration details for all network interfaces on a Linux system?

Accepted Answer

ip addr. ip addr shows IP addresses and link information for all interfaces.

Answer

nmcli dev status

Answer

cat /etc/network/interfaces

Answer

ifconfig -a

Question 10

A system administrator is troubleshooting a service that fails to start. They want to see the recent logs for that specific service unit. Which journalctl command should be used?

Accepted Answer

journalctl -u service_name. The `-u` option in `journalctl` filters logs by the systemd unit name, allowing you to view recent logs specifically for a service. This is the correct approach when troubleshooting a service that fails to start, as it isolates the relevant log entries without noise from other system messages.

Answer

journalctl -k

Answer

tail -f /var/log/syslog

Answer

journalctl -p err

Question 11

A Linux administrator wants to check the history of CPU usage for the past two days using the system activity reporter. Which sar option retrieves data from the daily history file for a specific date?

Accepted Answer

sar -f /var/log/sa/sa$(date +%d --date='2 days ago'). sar -f /var/log/sa/saDD reads from the history file for a specific day (DD is the day of month).

Answer

sar -r -b

Answer

sar -n DEV

Answer

sar -u -s 00:00:00 -e 23:59:59

Question 12

A user cannot access a website, but other websites work. The administrator wants to see the HTTP response headers from the web server. Which command is most appropriate?

Accepted Answer

curl -I https://example.com. curl -I fetches the HTTP headers only, which is useful for debugging web server responses.

Answer

wget --spider https://example.com

Answer

curl -v https://example.com

Answer

telnet example.com 80

Question 13

A Linux administrator is troubleshooting a slow system. They decide to use vmstat to get an overall picture. Which two of the following fields in vmstat output are most directly related to CPU performance issues? (Choose two.)

Accepted Answer

sy (system CPU time). The 'us' field shows user time, 'sy' shows system time, 'id' shows idle, and 'wa' shows I/O wait. High 'us' or 'sy' can indicate CPU-bound issues.

Answer

id (idle time)

Answer

wa (I/O wait time)

Answer

r (run queue)

Question 14

A system is experiencing boot failures. The administrator wants to view kernel messages from the current boot to diagnose the issue. Which two commands can be used to see these messages? (Choose two.)

Accepted Answer

journalctl -k. `journalctl -k` displays kernel messages from the current boot by querying the systemd journal, which logs kernel ring buffer messages persistently. `dmesg` reads the kernel ring buffer directly and shows messages from the current boot cycle. Both commands provide the kernel diagnostic output needed to troubleshoot boot failures.

Answer

cat /proc/kmsg

Answer

tail -f /var/log/boot.log

Answer

vmstat -f

Question 15

An administrator needs to capture network traffic on interface eth0 for packets destined to port 443 from host 10.0.0.1, while also writing the capture to a file for later analysis. Which three tcpdump options should be used together? (Choose three.)

Accepted Answer

-i eth0. To capture network traffic on interface eth0 for packets destined to port 443 from host 10.0.0.1, the tcpdump options needed are -i to specify the interface, port to filter by destination port, and host to specify the source host. These three options (A, B, D) together filter the desired traffic. To write the capture to a file, the -w option is additionally required, but it is not among the answer choices. Thus, the correct selections from the given list are A, B, and D.

Answer

-c 100

Answer

-n