XK0-006 Troubleshooting Practice Test 8 — 15 Questions

Question 1

A technician wants to check the disk I/O statistics, focusing on the average I/O wait time and utilization percentage. Which command provides this information?

Accepted Answer

iostat -x. The iostat -x command displays extended disk I/O statistics, including per-device metrics such as average wait time (await), utilization percentage (%util), and queue sizes. The -x flag is specifically what surfaces these extended columns, making it the correct tool for analyzing I/O wait and utilization. sar -b reports overall block device activity but not per-device extended metrics like await and %util.

Answer

sar -b

Answer

vmstat -d

Answer

free -h

Question 2

A system administrator is troubleshooting a service that fails to start. They want to see the recent logs for that specific service unit. Which journalctl command should be used?

Accepted Answer

journalctl -u service_name. The `-u` option in `journalctl` filters logs by the systemd unit name, allowing you to view recent logs specifically for a service. This is the correct approach when troubleshooting a service that fails to start, as it isolates the relevant log entries without noise from other system messages.

Answer

journalctl -k

Answer

tail -f /var/log/syslog

Answer

journalctl -p err

Question 3

A user cannot access a website, but other websites work. The administrator wants to see the HTTP response headers from the web server. Which command is most appropriate?

Accepted Answer

curl -I https://example.com. The curl -I command sends a HEAD request to the server and displays only the HTTP response headers. This is the most appropriate way to quickly inspect headers like status codes, content-type, and server information without downloading the body. It directly addresses the administrator's need to see response headers.

Answer

wget --spider https://example.com

Answer

curl -v https://example.com

Answer

telnet example.com 80

Question 4

A system is experiencing boot failures. The administrator wants to view kernel messages from the current boot to diagnose the issue. Which two commands can be used to see these messages? (Choose two.)

Accepted Answer

journalctl -k. Option A, journalctl -k, is correct because the -k (--dmesg) filter restricts systemd-journald output to kernel messages only, and by default journalctl shows the current boot's entries, so it displays kernel messages from the present boot. Option D, dmesg, is correct because it reads the kernel ring buffer, which contains the kernel messages generated during the current boot, making it ideal for diagnosing boot failures. Option B, cat /proc/kmsg, is not a good choice because /proc/kmsg is a blocking, consume-once interface intended for a single reader such as klogd or dmesg; reading it directly can steal messages and it does not cleanly present the current boot log. Option C, tail -f /var/log/boot.log, is incorrect because boot.log contains service startup output from the init/boot process, not kernel messages, and it may not exist on systemd systems. Option E, vmstat -f, is incorrect because it reports the number of forks since boot, which is unrelated to viewing kernel messages.

Answer

cat /proc/kmsg

Answer

tail -f /var/log/boot.log

Answer

vmstat -f

Question 5

A Linux administrator needs to verify which network interfaces are up and their IP addresses on a server. Which command provides this information?

Accepted Answer

ip addr. The `ip addr` command displays all network interfaces along with their IP addresses, MAC addresses, and status (UP/DOWN).

Answer

ss -tlnp

Answer

nmcli dev show

Answer

ifconfig -a

Question 6

A server fails to boot with a kernel panic after a system update. The administrator suspects a corrupt initramfs. Which GRUB boot parameter should be added temporarily to boot into an emergency shell where the filesystem can be repaired?

Accepted Answer

rd.break. rd.break is a kernel boot parameter that interrupts the boot process before the initramfs switches control to the real root filesystem, dropping the administrator into a debug shell (switch_root prompt). From there, the root filesystem can be mounted read-write and repaired, or the initramfs regenerated. This is the standard RHEL/CentOS method for recovering from a corrupt initramfs or forgotten root password.

Answer

emergency

Answer

single

Answer

nomodeset

Question 7

A system administrator wants to collect network performance statistics over time, including packet loss and latency, to diagnose intermittent connectivity issues. Which tool combines the functionality of ping and traceroute into a single continuous monitoring command?

Accepted Answer

mtr. mtr (My TraceRoute) continuously sends packets and displays real-time statistics including loss and latency for each hop, combining ping and traceroute.

Answer

tcpdump

Answer

ss

Answer

netstat

Question 8

A Linux technician is troubleshooting a system that is experiencing high disk I/O wait times. Which TWO commands can be used to identify disk I/O performance issues? (Choose two.)

Accepted Answer

vmstat. Option B (vmstat) is correct because it reports virtual memory statistics including the 'wa' (I/O wait) column in its CPU breakdown, which directly shows the percentage of time the CPU spent waiting on disk I/O, making it ideal for diagnosing high I/O wait times. Option C (iostat) is correct because it is specifically designed to report per-device and per-partition disk I/O statistics such as tps, kB_read/s, kB_wrtn/s, and %util, which pinpoint which block devices are saturated. Option A (lsof) lists open files and the processes using them, which can hint at file usage but does not measure disk I/O performance or wait times. Option D (free -h) only displays memory and swap usage in human-readable form, providing no direct disk I/O metrics. Option E (dmesg) shows kernel ring buffer messages, useful for hardware or driver errors, but it does not report ongoing disk I/O performance statistics.

Answer

lsof

Answer

free -h

Answer

dmesg

Question 9

An administrator needs to verify DNS resolution for a web server. Which TWO commands can be used to query DNS A records for a given hostname? (Choose two.)

Accepted Answer

nslookup. Option B (nslookup) is correct because it is a dedicated DNS query tool that, by default, resolves a hostname to its A record (IPv4 address) by querying the configured DNS resolver, and it can also be used interactively to specify record types. Option D (dig) is correct because it is a DNS lookup utility that explicitly queries DNS records; running 'dig hostname A' returns the A record along with authoritative server and query details. Option A (traceroute) is incorrect because it maps the network path to a host using TTL-limited packets, not DNS record queries. Option C (ping) is incorrect because although it resolves a hostname to an IP via the resolver, it is an ICMP reachability test rather than a DNS query tool and does not let you query specific record types. Option E (curl -I) is incorrect because it sends an HTTP HEAD request to fetch response headers, not a DNS A record query.

Answer

traceroute

Answer

ping

Answer

curl -I

Question 10

A system is running slowly and the administrator suspects a memory leak. Which THREE commands or tools can be used to analyze memory usage and identify processes consuming excessive memory? (Choose three.)

Accepted Answer

ps aux --sort=-%mem. Option B (ps aux --sort=-%mem) is correct because it lists all processes with their memory usage and sorts them in descending order by the %MEM column, directly revealing which processes consume the most memory. Option D (vmstat 1) is correct because it reports virtual memory statistics (swpd, free, buff, cache, si, so) every second, helping detect memory pressure and swapping indicative of a leak. Option E (free -h) is correct because it displays total, used, free, shared, buff/cache, and available memory in human-readable units, giving a quick overview of overall memory consumption. Option A (strace -p PID) is not appropriate here because strace traces system calls of a single process and does not summarize memory usage across processes. Option C (iostat -x) is incorrect because it reports extended disk I/O statistics, not memory usage.

Answer

strace -p PID

Answer

iostat -x

Question 11

A Linux server's root filesystem was accidentally filled to 100% capacity by runaway application logs. After the administrator deletes several large log files with rm, df -h still reports the filesystem at 100% usage. Which command should the administrator use to identify the process that is holding these deleted files open?

Accepted Answer

lsof +L1. The correct tool is lsof +L1, which specifically lists open files with a link count less than one, indicating deleted files still held open by a process. In this scenario, the deleted log files are still consuming disk space because a process has them open. Identifying and restarting that process will release the space, resolving the 100% usage.

Answer

df -i

Answer

fuser -m /

Answer

du -sh /var/log

Question 12

A Linux administrator is troubleshooting a service that fails to start. The service unit file is present and enabled, but systemctl status shows 'failed' with exit code 203. Which command should the administrator run to view the most recent log messages specific to this service?

Accepted Answer

journalctl -u servicename.service -n 50. The administrator should use journalctl -u servicename.service -n 50 to view the most recent log entries for that unit. This command queries the systemd journal, which captures stdout/stderr from the service and systemd's own messages about start failures. It is the most direct way to diagnose why the service failed with exit code 203.

Answer

dmesg | grep servicename

Answer

tail -f /var/log/messages

Answer

systemctl cat servicename.service

Question 13

A Linux server's /var/log partition is 100% full and rsyslogd has stopped writing logs. The administrator needs to find which directories under /var/log consume the most space without deleting anything. Which command should the administrator run?

Accepted Answer

du -sh /var/log/* | sort -rh | head -n 10. To find what is filling a filesystem, aggregate usage per directory and sort by size. du -sh with a glob gives one line per item under /var/log, and sort -rh orders them largest first, so the top offenders are immediately visible. df only shows the filesystem total, find -delete destroys data, and recursive ls provides no aggregation.

Answer

ls -laR /var/log | less

Answer

df -h /var/log

Answer

find /var/log -type f -size +100M -delete

Question 14

A Linux administrator receives reports that a server's root filesystem is completely full. They run `df -h` and see that the root partition is at 100% usage. Which command should they use NEXT to identify which directories are consuming the most space?

Accepted Answer

du -sh /* | sort -h. When a filesystem is full, the administrator must first identify which directories are consuming the most space. The `du` command with the `-s` and `-h` options provides a summary of disk usage per directory, and piping to `sort -h` orders the results by size. This quickly highlights the largest directories, enabling efficient troubleshooting.

Answer

fdisk -l

Answer

find / -type f -size +1G

Answer

ls -la /

Question 15

A Linux administrator is troubleshooting a server that has become unresponsive. They suspect a process is consuming excessive CPU. Which command should they use to display a real-time, interactive view of processes sorted by CPU usage?

Accepted Answer

top. The top command is designed for real-time process monitoring, showing a continuously updated list of processes sorted by CPU usage. It allows an administrator to quickly spot which process is consuming the most CPU and take action, such as renice or kill. Other tools like ps provide only a snapshot, while vmstat and iostat give system-wide statistics without per-process breakdown.

Answer

iostat -c

Answer

vmstat 1

Answer

ps aux