XK0-006 Troubleshooting Practice Test 7 — 15 Questions

Question 1

A Linux system is running slowly with high I/O wait as shown by vmstat. To investigate the I/O activity of a specific process that is suspected of causing the bottleneck, which of the following commands would be used to trace its system calls related to I/O?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

strace -p . strace attaches to a running process and traces its system calls, including I/O-related calls like read, write, open, and fsync, making it the right tool to pinpoint which syscalls a specific process is issuing. By using 'strace -p ', the administrator can observe the exact I/O behavior of the suspect process. This directly addresses the need to trace system calls related to I/O for a specific PID.

Answer

iostat -x 1

Answer

dmesg | tail

Answer

free -h

Question 2

An administrator needs to capture network traffic on interface eth0, filter for packets to/from host 10.0.0.1, and save the output to a file for later analysis. Which command should be used?

Accepted Answer

tcpdump -i eth0 host 10.0.0.1 -w capture.pcap. The `tcpdump` command with the `host` filter captures all traffic (both source and destination) to or from the specified IP address, which matches the requirement to filter for packets to/from host 10.0.0.1. The `-i eth0` specifies the interface, and `-w capture.pcap` writes the output to a file for later analysis.

Answer

tcpdump -i eth0 src 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 dst 10.0.0.1 -w capture.pcap

Answer

tcpdump -i eth0 -n host 10.0.0.1 -w capture.pcap

Question 3

A technician is troubleshooting a network connectivity issue. They need to trace the path packets take to a remote server and see the round-trip time for each hop. Which command should they use?

Accepted Answer

traceroute. traceroute (or tracepath) shows the path and RTT per hop.

Answer

ping

Answer

nslookup

Answer

nmap

Question 4

A system administrator wants to review kernel-related log messages from the current boot session. Which journalctl command should be used to filter the kernel messages?

Accepted Answer

journalctl -k. journalctl -k shows kernel messages from the current boot.

Answer

journalctl -p err

Answer

journalctl -b -u systemd-journald

Answer

journalctl --since today

Question 5

An administrator is troubleshooting a service that fails to start with a 'Permission denied' error. The administrator runs `strace -f -o /tmp/strace.log systemctl start myservice`. Which of the following best describes what this command achieves?

Accepted Answer

It traces system calls for systemctl and its children, recording them to a file.. strace traces system calls; -f follows child processes; -o writes output to file.

Answer

It records the kernel messages related to the service start.

Answer

It monitors network connections opened by the service.

Answer

It traces library calls made by the service startup.

Question 6

An administrator is investigating a network issue where a server cannot connect to an external website. They run `ping 8.8.8.8` successfully, but `ping google.com` fails. Which TWO of the following are the most likely causes? (Choose TWO.)

Accepted Answer

The DNS server is unreachable or misconfigured.. Option C is correct because the successful `ping 8.8.8.8` proves IP connectivity and routing to the internet work, while the failure of `ping google.com` indicates name resolution is failing — meaning the configured DNS server is unreachable, misconfigured, or not responding on port 53. Option E is correct because an incorrect entry for google.com in /etc/hosts would cause the resolver to return a wrong IP address for that hostname before ever querying DNS, producing exactly this symptom (numeric IP works, hostname fails). Option A is wrong because a down network interface would prevent even `ping 8.8.8.8` from succeeding. Option B is wrong because a misconfigured default gateway would break routing to external IP addresses, so the numeric ping to 8.8.8.8 would also fail. Option D is wrong because a firewall blocking ICMP would cause both pings to fail, not just the hostname-based one.

Answer

The network interface is down.

Answer

The default gateway is misconfigured.

Answer

The firewall is blocking ICMP traffic.

Question 7

A system administrator needs to collect performance data over time to analyze CPU and memory usage trends. Which THREE of the following commands can be used to gather historical performance data? (Choose THREE.)

Accepted Answer

iostat. Option A, iostat, is correct because it reports CPU utilization and disk I/O statistics and can be run repeatedly (e.g., iostat 5) or logged over time to reveal performance trends. Option D, sar, is correct because the System Activity Reporter collects and stores historical performance data via the sadc collector and sysstat service, allowing retrieval of past CPU and memory statistics with commands like sar -u or sar -r. Option E, vmstat, is correct because it samples CPU, memory, paging, and I/O statistics at intervals (e.g., vmstat 5) and its output can be captured over time for trend analysis. Option B, uptime, is not correct because it only shows a single snapshot of load average and uptime, not historical performance data. Option C, free, is not correct because it displays a one-time snapshot of current memory usage rather than collecting data over time.

Answer

uptime

Answer

free

Question 8

A system administrator notices that the server is performing poorly. Running 'vmstat 1 5' shows high 'wa' values. Which subsystem is most likely experiencing a bottleneck?

Accepted Answer

Disk I/O. In vmstat output, the 'wa' column reports the percentage of CPU time spent waiting for I/O operations to complete. High 'wa' values indicate that the CPU is idle but blocked waiting on disk (or other block device) I/O, which points directly to a disk I/O bottleneck. This is distinct from high 'us' or 'sy' (user/system CPU) or high 'si'/'so' (swap), which would indicate CPU or memory pressure respectively.

Answer

Memory

Answer

Network

Answer

CPU

Question 9

An administrator is troubleshooting a service that fails to start. They want to trace the system calls made by the service binary. Which command should they use?

Accepted Answer

strace. strace traces system calls and signals. It is used to debug what a program is doing at the kernel level.

Answer

ltrace

Answer

dmesg

Answer

lsof

Question 10

Which command displays the current routing table on a Linux system?

Accepted Answer

ip route. ip route shows the routing table. The older route command is deprecated.

Answer

ip neigh

Answer

ip addr

Answer

ip link

Question 11

An administrator wants to monitor disk I/O performance in real-time, focusing on metrics like wait time and I/O queue size. Which tool is best suited for this?

Accepted Answer

iostat -x 1. iostat -x 1 provides extended disk statistics refreshed every second, including await (average wait time), svctm, %util, and avgqu-sz (average queue size), which directly match the requested metrics. The -x flag enables the extended report that exposes per-device wait and queue depth, making it the correct real-time tool.

Answer

vmstat

Answer

sar -b

Answer

free -h

Question 12

A technician needs to check the kernel ring buffer for hardware errors detected during system boot. Which command should be used?

Accepted Answer

dmesg. The kernel ring buffer contains messages emitted by the kernel, including hardware detection and error messages during boot. The 'dmesg' command reads and prints this buffer directly. It is the canonical tool for inspecting kernel-level hardware errors, driver initialization failures, and boot-time device detection.

Answer

journalctl -k

Answer

lspci

Answer

cat /var/log/boot.log

Question 13

A Linux server is experiencing high CPU usage. Which TWO commands can be used to identify which processes are consuming the most CPU? (Choose two.)

Accepted Answer

ps aux --sort=-%cpu. Option A, `ps aux --sort=-%cpu`, is correct because it lists all processes with their CPU utilization and sorts them in descending order by the %CPU column, immediately revealing the top CPU consumers. Option B, `top`, is correct because it provides a real-time, dynamically refreshing view of running processes ranked by CPU usage, allowing an administrator to identify which processes are consuming the most CPU. Option C, `iostat`, is incorrect because it reports CPU and I/O statistics per device rather than per-process CPU consumption. Option D, `vmstat`, is incorrect because it reports system-wide memory, paging, and CPU summary statistics, not individual process CPU usage. Option E, `free`, is incorrect because it only displays memory and swap usage, providing no per-process CPU information.

Answer

iostat

Answer

vmstat

Answer

free

Question 14

A system is experiencing high memory usage. The administrator wants to see a brief summary of memory usage in human-readable format, including buffers and cache. Which command is most appropriate?

Accepted Answer

free -h. free -h is correct because it prints a concise summary of total, used, free, shared, buff/cache, and available memory in human-readable units (MiB/GiB), directly satisfying the requirement to include buffers and cache. The -h flag converts raw kilobytes into readable values, making it the most appropriate single command for a quick memory overview.

Answer

iostat -m

Answer

cat /proc/meminfo

Answer

vmstat -s

Question 15

An administrator needs to check the kernel ring buffer for hardware error messages from the current boot. Which command displays this information?

Accepted Answer

dmesg. dmesg displays the kernel ring buffer, which includes hardware-related messages from the current boot.

Answer

vmstat -f

Answer

journalctl -k -b 0

Answer

cat /var/log/boot.log