XK0-005 Troubleshooting — Timed 20 Questions

Question 1

A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?

Accepted Answer

ss -tlnp. The ss command is the modern replacement for netstat, and ss -tlnp shows listening TCP ports with process information.

Answer

nmap localhost

Answer

ip link show

Answer

dig -t any localhost

Question 2

A user reports that they cannot reach a website. The administrator wants to check the path that packets take to the destination server. Which command should be used?

Accepted Answer

traceroute. The `traceroute` command is used to trace the path packets take from the source to a destination host, showing each hop (router) along the way. It uses ICMP echo requests (or UDP packets on Linux) with incrementing TTL values to elicit ICMP Time Exceeded messages from intermediate routers, which reveals the network path. This directly addresses the administrator's need to check the path to the destination server.

Answer

ip addr

Answer

ss

Answer

ping

Question 3

A Linux engineer is investigating high disk I/O on a server. Which command provides disk I/O statistics including %util, await, r/s, and w/s?

Accepted Answer

iostat -x 1. iostat reports CPU and disk I/O statistics, with columns like %util, await, r/s, and w/s.

Answer

sar -b

Answer

vmstat 1 5

Answer

free -h

Question 4

During boot, a Linux system displays a kernel panic with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

Corrupt initramfs missing a necessary kernel module for the root device. This error indicates that the root filesystem cannot be found, often due to a missing driver for the storage device in the initramfs.

Answer

Incorrect time configuration in the BIOS

Answer

The /etc/fstab file has an invalid filesystem type for the root partition

Answer

A defective network cable

Question 5

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

Accepted Answer

strace -p <PID>. strace can attach to a running process with -p PID and display all system calls made by the process.

Answer

tcpdump -i any

Answer

ltrace -p <PID>

Answer

lsof -p <PID>

Question 6

A user wants to look up the mail exchange (MX) records for a domain. Which command should be used?

Accepted Answer

dig domain.com MX. The `dig` command is a flexible DNS lookup utility that can query any record type by specifying it after the domain name. `dig domain.com MX` directly queries the DNS for mail exchange records, which specify the mail servers responsible for receiving email for the domain. This is the most straightforward and commonly used command for this purpose in Linux.

Answer

ping domain.com

Answer

host -t mx domain.com

Answer

nslookup -type=mx domain.com

Question 7

An administrator wants to capture network traffic on interface eth0, writing the output to a file for later analysis, without resolving hostnames. Which command accomplishes this?

Accepted Answer

tcpdump -i eth0 -w capture.pcap -n. tcpdump -i eth0 -w file.pcap -n captures packets without name resolution and writes to a file.

Answer

tcpdump -i eth0 -r capture.pcap

Answer

tcpdump -i any -w capture.pcap

Answer

tcpdump -n -w eth0 capture.pcap

Question 8

A system administrator needs to check the kernel ring buffer for hardware error messages. Which command should be used?

Accepted Answer

dmesg. The `dmesg` command is the standard tool for printing the kernel ring buffer, which contains messages from the kernel, including hardware error messages, device driver initialization, and system boot logs. It directly reads from `/dev/kmsg` or the syslog system call, making it the correct choice for diagnosing hardware issues at the kernel level.

Answer

journalctl -k

Answer

vmstat

Answer

lsof

Question 9

After modifying the network configuration on a RHEL 8 system, the administrator wants to bring up the interface without rebooting. Which command sequence should be used?

Accepted Answer

nmcli con up eth0. nmcli con up ifcfg-eth0 activates the connection. If using legacy scripts, ifup eth0 would work, but nmcli is the modern method for NetworkManager.

Answer

ip link set eth0 up

Answer

systemctl restart network && nmcli dev connect eth0

Answer

ifconfig eth0 up

Question 10

A technician needs to check the current memory usage on a Linux system, including buffers and cache. Which command provides the most user-friendly output?

Accepted Answer

free -h. The `free -h` command displays memory usage in a human-readable format (e.g., KiB, MiB, GiB) and explicitly breaks down total, used, free, shared, buffers/cache, and available memory. This makes it the most user-friendly option for quickly assessing current memory usage including buffers and cache.

Answer

cat /proc/meminfo

Answer

iostat -m

Answer

vmstat -s

Question 11

A server is experiencing intermittent network connectivity issues. The administrator wants to run a continuous test that combines ping and traceroute to monitor the path and packet loss to a target host. Which command should be used?

Accepted Answer

mtr target. mtr combines ping and traceroute functionality, continuously showing each hop and packet loss statistics.

Answer

tcpdump -i any host target

Answer

ping -f target

Answer

traceroute -n target

Question 12

An administrator needs to check the current routing table on a Linux system. Which command should be used?

Accepted Answer

ip route. The `ip route` command displays the kernel routing table, showing the paths that packets take to reach network destinations. This is the standard tool on modern Linux systems for viewing and manipulating routing entries, replacing the older `route -n` command.

Answer

dig -t A

Answer

ss -r

Answer

ip neigh

Question 13

A Linux administrator is troubleshooting a DNS resolution issue. The system uses /etc/resolv.conf. Which two of the following directives are commonly found in this file? (Choose two.)

Accepted Answer

nameserver 8.8.8.8. /etc/resolv.conf typically contains nameserver entries and optionally search and domain directives.

Answer

domain localdomain

Answer

options timeout:2

Answer

hosts: files dns

Question 14

A system fails to boot with a kernel panic. The administrator suspects a corrupt initramfs or missing kernel module. Which three methods could be used to recover the system? (Choose three.)

Accepted Answer

Boot from a live CD/DVD, mount the root filesystem, and chroot. At the GRUB menu, editing boot parameters to add 'rd.break' drops into an emergency shell; adding 'single' boots into single-user mode; booting from a live CD allows chroot and repair.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Use 'systemctl rescue' from the boot prompt

Question 15

An administrator needs to identify which processes are consuming the most CPU and memory resources. Which two commands can provide this information? (Choose two.)

Accepted Answer

top. The `top` command provides a real-time, dynamic view of running processes, displaying CPU and memory usage by default and allowing sorting by resource consumption. The `ps aux --sort=-%mem` command lists all processes with detailed memory and CPU statistics, sorted by memory usage in descending order, making it easy to identify the most resource-intensive processes.

Answer

free -h

Answer

iostat -x

Answer

vmstat 1 5

Question 16

A Linux administrator needs to view all current IPv4 addresses assigned to network interfaces on a system. Which command should be used?

Accepted Answer

ip addr. The 'ip addr' command displays all IP addresses assigned to network interfaces. 'ifconfig' is deprecated, 'ip link' shows link-layer info, and 'hostname -I' only shows primary IPs.

Answer

ip link show

Answer

ifconfig -a

Answer

hostname -I

Question 17

A user reports that they cannot access a web server at 192.168.1.100. The administrator wants to check if the server is reachable and measure round-trip time. Which command is most appropriate?

Accepted Answer

ping 192.168.1.100. The `ping` command sends ICMP Echo Request packets to the target host and waits for ICMP Echo Reply packets, which directly tests reachability and measures round-trip time (RTT). This is the most appropriate tool for the administrator's stated goal of checking if the server is reachable and measuring RTT.

Answer

nmap -sn 192.168.1.100

Answer

traceroute 192.168.1.100

Answer

ss -tlnp | grep 192.168.1.100

Question 18

An administrator is troubleshooting a DNS issue and needs to query the authoritative name servers for example.com. Which dig command should be used?

Accepted Answer

dig example.com NS. dig example.com NS queries the name servers (NS records). A asks for IPv4, MX for mail, and ANY is often blocked.

Answer

dig example.com MX

Answer

dig example.com A

Answer

dig example.com ANY

Question 19

A system administrator notices that a web server is running but users cannot connect to port 443. Which ss command will show if the server is listening on that port?

Accepted Answer

ss -tlnp. ss -tlnp shows listening TCP sockets with numeric ports and process info. -t for TCP, -l listening, -n numeric, -p process.

Answer

ss -s

Answer

ss -tuln

Answer

ss -tan

Question 20

An administrator needs to capture network traffic on interface eth0 to a file for later analysis. Which tcpdump command is correct?

Accepted Answer

tcpdump -i eth0 -w capture.pcap. tcpdump -i eth0 -w capture.pcap captures packets from eth0 and writes to file. -n disables name resolution, not needed for capture.

Answer

tcpdump -w capture.pcap -i eth0

Answer

tcpdump -i eth0 -f capture.pcap

Answer

tcpdump -w eth0 capture.pcap