XK0-006 Troubleshooting Practice Test 9 — 15 Questions

Question 1

Users report that a web application on a Linux server is unreachable from external clients. From the server itself, curl http://localhost works fine. The administrator wants to confirm whether the service is bound only to the loopback interface. Which command should the administrator run?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ss -tlnp. The symptom pattern, local success plus remote failure, often means the daemon is bound to 127.0.0.1 rather than all interfaces. ss -tlnp displays each listening TCP socket's local address and process, making the bind scope explicit. Routing, loopback scanning, and loopback capture all miss the actual socket configuration.

Answer

nmap -p 80 localhost

Answer

ip route show

Answer

tcpdump -i lo port 80

Question 2

A Linux server is experiencing intermittent network connectivity issues. The administrator suspects that packets are being dropped due to a misconfigured firewall rule. Which command should the administrator use to view the current iptables rules and their packet counters?

Accepted Answer

iptables -L -v -n. To diagnose firewall-related packet drops, the administrator needs to see the iptables rules along with their match counters. The `iptables -L -v -n` command provides a verbose listing with packet and byte counts, and numeric output. This reveals which rules are being hit and can indicate if a drop rule is matching traffic. Other commands either modify the firewall or show unrelated information.

Answer

tcpdump -i eth0

Answer

iptables -F

Answer

netstat -tuln

Question 3

A Linux administrator notices that a server's root filesystem is using 100% of its inodes, even though `df -h` shows only 60% of the disk space used. Users are unable to create new files. Which command most directly helps identify directories containing large numbers of small files that are consuming inodes?

Accepted Answer

du --inodes -s /* | sort -n. The root filesystem has run out of inodes, not blocks, so tools that report disk space are ineffective. `du --inodes -s /*` followed by numeric sorting reveals which top-level directories contain the most inodes, allowing the administrator to drill down and remove unneeded small files. This approach directly targets the exhausted resource and avoids wasted effort on block-space analysis.

Answer

find / -xdev -type f | wc -l

Answer

du -sh /*

Answer

df -i

Question 4

A Linux server is experiencing intermittent network connectivity issues. The administrator suspects that the network interface is dropping packets due to a duplex mismatch. Which command should be used to check the duplex setting and link status of the interface?

Accepted Answer

ethtool eth0. The ethtool command is the standard tool for querying and modifying Ethernet device settings, including duplex and speed. It directly reports the negotiated duplex mode, allowing the administrator to verify if the interface is operating at half duplex when it should be full duplex. Other commands like ifconfig or ip link do not expose duplex information, and netstat only shows statistics, not configuration.

Answer

ifconfig eth0

Answer

ip link show eth0

Answer

netstat -i

Question 5

A Linux administrator is diagnosing a system that occasionally hangs during boot. The administrator suspects a hardware issue. Which command will display kernel ring buffer messages, including hardware detection and driver errors, from the current boot?

Accepted Answer

dmesg. The dmesg command displays the kernel ring buffer, which contains low-level messages about hardware, drivers, and kernel events. These messages are generated during boot and can reveal hardware detection failures, driver errors, or other kernel issues that cause hangs. It is the most direct tool for this purpose.

Answer

journalctl -b -p err

Answer

lsmod

Answer

cat /var/log/boot.log

Question 6

A Linux server intermittently loses its default route after several hours of uptime, and users cannot reach external networks until the route is manually restored. The administrator suspects that a second default route is being installed and removed by a network management daemon. Which command should the administrator use to monitor route changes in real time?

Accepted Answer

ip monitor route. Intermittent route loss requires observing events as they happen rather than sampling the table. ip monitor route taps the kernel's routing netlink multicast group and prints each add, delete, and change with details, so the flapping default route and its timing become visible. A one-time table dump, interface counters, and indirect daemon logs cannot provide that event stream.

Answer

ip route show table main

Answer

ip -s link show

Answer

journalctl -u NetworkManager --since "1 hour ago"

Question 7

A Linux administrator is troubleshooting a server that is unresponsive. They suspect a process is consuming excessive CPU. Which TWO commands can be used to identify the process with the highest CPU usage? (Choose two.)

Accepted Answer

ps aux --sort=-%cpu | head -n 5. To identify a process consuming excessive CPU, the administrator needs tools that display per-process CPU usage. `top` provides a real-time, sorted list of processes by CPU usage. `ps aux --sort=-%cpu | head -n 5` gives a snapshot of the top CPU-consuming processes. Other commands like `free`, `vmstat`, and `iostat` show system-wide metrics but not per-process details.

Answer

vmstat 1

Answer

free -m

Answer

iostat -c

Question 8

A Linux server's clock drifts by several minutes each day. The administrator runs `timedatectl` and sees that NTP synchronization is enabled but the system clock is not synchronized. The server can reach the internet, and `chronyd` is running. Which command should the administrator use to verify which NTP sources are currently reachable and their stratum levels?

Accepted Answer

chronyc sources -v. With chronyd running, the correct tool to inspect configured time sources, their reachability, and stratum is `chronyc sources -v`. It queries the daemon directly and provides verbose per-source details, enabling the administrator to identify unreachable or high-stratum servers. Other commands target different NTP implementations or only report service status without source-level diagnostics.

Answer

systemctl status chronyd

Answer

timedatectl show-timesync

Answer

ntpq -p

Question 9

An administrator notices that a critical application server has become extremely slow, and load average has climbed above 40 on a 4-core system. The administrator wants to identify whether the bottleneck is CPU contention or processes stuck in uninterruptible sleep. (Choose two.)

Accepted Answer

Run vmstat 1 and observe the r and b columns.. Load average counts both runnable and uninterruptible-sleep tasks, so a high value alone does not reveal the cause. top exposes per-process state letters alongside load averages, and vmstat's r and b columns quantify runnable versus blocked tasks over time. Memory, CPU topology, and filesystem checks do not separate the two candidate bottlenecks.

Answer

Run df -h and check whether any filesystem is at 100 percent utilization.

Answer

Run lscpu and verify the number of logical CPUs and their current frequency.

Answer

Run free -m and compare the total and used memory values.

Question 10

A Linux administrator is troubleshooting a server that intermittently loses network connectivity. They suspect duplicate IP address conflicts on the local subnet. Which TWO commands can be used to detect whether another host is using the same IP address as the server? (Choose two.)

Accepted Answer

arping -D -I eth0 192.168.1.50. Duplicate IP detection requires either actively probing with ARP, as `arping -D` does, or passively observing ARP traffic for conflicting MAC-to-IP mappings, which `tcpdump -i eth0 arp` provides. Both methods operate at layer 2 where the conflict manifests. Commands that merely list hosts or interface settings cannot reveal two hosts claiming the same address.

Answer

ip neigh show

Answer

nmap -sn 192.168.1.0/24

Answer

ethtool eth0

Question 11

A Linux administrator is investigating why a user cannot log in via SSH. The SSH service is running, and the network is reachable. The administrator suspects that the user's account is locked or expired. Which command should they use to check the account status and expiration details for the user 'jdoe'?

Accepted Answer

chage -l jdoe. The chage -l command displays detailed account aging information, including expiration dates for the password and the account itself. In this scenario, it would reveal if the account is expired or if the password has expired, which are common reasons for SSH login failure despite the service running. This makes it the correct diagnostic tool.

Answer

passwd -S jdoe

Answer

usermod -L jdoe

Answer

id jdoe

Question 12

After applying a kernel update, a Linux server boots but the root filesystem is mounted read-only, and dmesg shows I/O errors on /dev/sda2. The administrator needs to determine whether the filesystem is corrupted and, if so, repair it safely. Which sequence of actions should the administrator take?

Accepted Answer

Boot into rescue mode, run fsck -n on /dev/sda2 first, then run fsck -y if errors are reported.. A read-only root mount after I/O errors usually means the kernel detected filesystem problems and remounted defensively. Repair requires the filesystem to be offline, so rescue mode is appropriate. fsck -n first confirms and characterizes the damage without risk; if it reports errors, fsck -y applies repairs. Running fsck on a mounted filesystem, forcing a read-write remount, or reformatting are all unsafe or premature.

Answer

Recreate the filesystem with mkfs.ext4 /dev/sda2 and restore from the most recent backup.

Answer

Remount the root filesystem read-write with mount -o remount,rw / and continue using the server.

Answer

From the running system, run fsck -y /dev/sda2 immediately to repair the errors.

Question 13

A Linux administrator is troubleshooting a service that fails to start. The service's unit file has a dependency on another service, but the dependent service is not running. The administrator wants to view the dependency tree of the failing service to understand the ordering and requirements. Which command should be used?

Accepted Answer

systemctl list-dependencies failing.service. systemctl list-dependencies is specifically designed to show the dependency tree of a unit, including which units are required or wanted and their current states. It provides a clear hierarchical view that helps diagnose why a service fails due to unmet dependencies. Other commands show status or logs but not the dependency structure.

Answer

systemctl cat failing.service

Answer

journalctl -u failing.service

Answer

systemctl status failing.service

Question 14

A user reports that a shell script fails with a 'Permission denied' error when executed, even though the file has the execute bit set for the owner. The administrator runs `ls -l script.sh` and sees `-rwxr-xr-x`. Which command should the administrator use to determine whether the filesystem is mounted with the `noexec` option?

Accepted Answer

mount | grep noexec. A filesystem mounted with `noexec` prohibits execution of binaries and scripts regardless of file permissions. Checking the mount options with `mount | grep noexec` directly confirms whether this is the cause. Other commands inspect file attributes, ACLs, or metadata, none of which can reveal a filesystem-level execution restriction.

Answer

lsattr script.sh

Answer

getfacl script.sh

Answer

stat script.sh

Question 15

A Linux administrator is troubleshooting a server that has lost network connectivity. They need to verify the current IP configuration and check the default gateway. Which TWO commands can be used to display the IP address and routing table? (Choose two.)

Accepted Answer

ip addr show. The ip addr show command reveals interface IP addresses, and ip route show displays the routing table including the default gateway. Together they provide the necessary information to diagnose network connectivity loss. These are the modern, recommended tools for network configuration inspection on Linux.

Answer

route -n

Answer

ifconfig -a

Answer

netstat -rn