XK0-006 Multiple Select — 10 Questions

Question 1

A system administrator needs to configure a cron job to run a script every Monday at 3:00 AM. Which two cron expressions are correct? (Select TWO).

Accepted Answer

0 3 * * 1. The cron expression `0 3 * * 1` schedules the script to run at minute 0, hour 3 (3:00 AM), every day of the month (`*`), every month (`*`), and on Monday (day-of-week 1, where 0=Sunday, 1=Monday). Option E is correct because cron also accepts three-letter abbreviations for days of the week, so `Mon` is equivalent to `1`.

Answer

0 3 * * 0

Answer

0 3 1 * 1

Answer

0 3 * * 1-5

Question 2

A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)

Accepted Answer

last. The `last` command reads the /var/log/wtmp file to display a list of all user logins and logouts since that file was created, showing timestamps and source IPs. This makes it a primary tool for investigating login history during a breach.

Answer

/var/log/syslog

Answer

/var/log/messages

Question 3

Which TWO of the following are valid methods to enforce disk quota limits on a Linux filesystem? (Select TWO.)

Accepted Answer

Using 'edquota' to set soft and hard limits for users. 'edquota' is the standard interactive command used to set soft and hard disk quota limits for users or groups on a Linux filesystem. It opens the user's quota settings in a text editor, allowing precise configuration of block and inode limits. Option E is correct because 'quotaon' is the command that enables quota enforcement on a specified filesystem, activating the quota subsystem after limits have been defined.

Answer

Using 'setquota' to set limits in a script

Answer

Running 'repquota' to generate reports

Answer

Running 'quotacheck' to update quota files

Question 4

A Linux administrator is hardening an SSH server. Which two of the following settings should be applied to /etc/ssh/sshd_config to improve security?

Accepted Answer

PermitRootLogin no. PermitRootLogin no prevents root login; PasswordAuthentication no forces key-based authentication. Changing the port and enabling X11 forwarding are not necessarily hardening.

Answer

Port 2222

Answer

X11Forwarding yes

Answer

Protocol 1

Question 5

A system fails to boot with a kernel panic. The administrator suspects a corrupt initramfs or missing kernel module. Which three methods could be used to recover the system? (Choose three.)

Accepted Answer

Boot from a live CD/DVD, mount the root filesystem, and chroot. At the GRUB menu, editing boot parameters to add 'rd.break' drops into an emergency shell; adding 'single' boots into single-user mode; booting from a live CD allows chroot and repair.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Use 'systemctl rescue' from the boot prompt

Question 6

Which TWO commands can be used to lock a user account? (Choose two.)

Accepted Answer

usermod -L username. passwd -l locks the password, usermod -L locks the account. Both prevent login.

Answer

passwd -u username

Answer

userdel username

Answer

chage -E 0 username

Question 7

A technician wants to capture network traffic to analyze a web server issue. Using tcpdump, which THREE options are useful for writing the capture to a file and avoiding name resolution? (Choose three.)

Accepted Answer

-n. -w writes to file, -n avoids name resolution, and -i specifies interface.

Answer

-c 100

Answer

-v

Question 8

Which TWO tools are specifically designed to detect rootkits on a Linux system?

Accepted Answer

rkhunter. B is correct because rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors, and possible local exploits by comparing file hashes, checking for hidden processes, and analyzing system binaries for known rootkit signatures. It is specifically designed to detect rootkits on Linux systems.

Answer

lsof

Answer

netstat

Answer

clamav

Question 9

Which TWO commands can be used to immediately synchronize the system time with an NTP server, even if the time difference is large? (Choose two.)

Accepted Answer

ntpd -g. `ntpd -g` allows the NTP daemon to perform a one-time large time jump (even if the offset exceeds the default panic threshold of 1000 seconds) and then continue normal synchronization. Option E is correct because `ntpdate pool.ntp.org` immediately sets the system clock to the time returned by the NTP server, regardless of the current time difference, making it suitable for large corrections.

Answer

chronyd -q

Answer

systemctl restart ntp

Answer

timedatectl set-ntp true

Question 10

Which THREE statements about Ansible are true? (Choose three.)

Accepted Answer

Ansible playbooks are written in YAML. Three statements about Ansible are true. Playbooks are written in YAML (A). Ansible is idempotent, meaning that applying the same configuration multiple times yields the same result (D). Additionally, Ansible requires Python on the control node only (C) because the control node runs the automation; managed nodes can be contacted via SSH or WinRM and may use raw modules that don't require Python, though most modules do expect Python on the managed node. Statement B is false because Ansible is agentless and does not use a centralized master server; it uses a push model from a control node. Statement E is false because Ansible is agentless—no agent is installed on managed nodes.

Answer

Ansible uses a centralized master server

Answer

Ansible requires an agent to be installed on managed nodes