XK0-006 Multiple Select — 40 Questions

Question 1

A system administrator needs to configure a cron job to run a script every Monday at 3:00 AM. Which two cron expressions are correct? (Select TWO).

Accepted Answer

0 3 * * 1. The cron expression `0 3 * * 1` schedules the script to run at minute 0, hour 3 (3:00 AM), every day of the month (`*`), every month (`*`), and on Monday (day-of-week 1, where 0=Sunday, 1=Monday). Option E is correct because cron also accepts three-letter abbreviations for days of the week, so `Mon` is equivalent to `1`.

Answer

0 3 * * 0

Answer

0 3 1 * 1

Answer

0 3 * * 1-5

Question 2

A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)

Accepted Answer

last. The `last` command reads the /var/log/wtmp file to display a list of all user logins and logouts since that file was created, showing timestamps and source IPs. This makes it a primary tool for investigating login history during a breach.

Answer

/var/log/syslog

Answer

/var/log/messages

Question 3

Which TWO of the following are valid methods to enforce disk quota limits on a Linux filesystem? (Select TWO.)

Accepted Answer

Using 'edquota' to set soft and hard limits for users. 'edquota' is the standard interactive command used to set soft and hard disk quota limits for users or groups on a Linux filesystem. It opens the user's quota settings in a text editor, allowing precise configuration of block and inode limits. Option E is correct because 'quotaon' is the command that enables quota enforcement on a specified filesystem, activating the quota subsystem after limits have been defined.

Answer

Using 'setquota' to set limits in a script

Answer

Running 'repquota' to generate reports

Answer

Running 'quotacheck' to update quota files

Question 4

A Linux administrator is hardening an SSH server. Which two of the following settings should be applied to /etc/ssh/sshd_config to improve security?

Accepted Answer

PermitRootLogin no. PermitRootLogin no prevents root login; PasswordAuthentication no forces key-based authentication. Changing the port and enabling X11 forwarding are not necessarily hardening.

Answer

Port 2222

Answer

X11Forwarding yes

Answer

Protocol 1

Question 5

A system fails to boot with a kernel panic. The administrator suspects a corrupt initramfs or missing kernel module. Which three methods could be used to recover the system? (Choose three.)

Accepted Answer

Boot from a live CD/DVD, mount the root filesystem, and chroot. At the GRUB menu, editing boot parameters to add 'rd.break' drops into an emergency shell; adding 'single' boots into single-user mode; booting from a live CD allows chroot and repair.

Answer

Run 'fsck /dev/sda1' from the GRUB command line

Answer

Use 'systemctl rescue' from the boot prompt

Question 6

Which TWO commands can be used to lock a user account? (Choose two.)

Accepted Answer

usermod -L username. passwd -l locks the password, usermod -L locks the account. Both prevent login.

Answer

passwd -u username

Answer

userdel username

Answer

chage -E 0 username

Question 7

A technician wants to capture network traffic to analyze a web server issue. Using tcpdump, which THREE options are useful for writing the capture to a file and avoiding name resolution? (Choose three.)

Accepted Answer

-n. -w writes to file, -n avoids name resolution, and -i specifies interface.

Answer

-c 100

Answer

-v

Question 8

Which TWO tools are specifically designed to detect rootkits on a Linux system?

Accepted Answer

rkhunter. B is correct because rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors, and possible local exploits by comparing file hashes, checking for hidden processes, and analyzing system binaries for known rootkit signatures. It is specifically designed to detect rootkits on Linux systems.

Answer

lsof

Answer

netstat

Answer

clamav

Question 9

Which TWO commands can be used to immediately synchronize the system time with an NTP server, even if the time difference is large? (Choose two.)

Accepted Answer

ntpd -g. `ntpd -g` allows the NTP daemon to perform a one-time large time jump (even if the offset exceeds the default panic threshold of 1000 seconds) and then continue normal synchronization. Option E is correct because `ntpdate pool.ntp.org` immediately sets the system clock to the time returned by the NTP server, regardless of the current time difference, making it suitable for large corrections.

Answer

chronyd -q

Answer

systemctl restart ntp

Answer

timedatectl set-ntp true

Question 10

Which THREE statements about Ansible are true? (Choose three.)

Accepted Answer

Ansible playbooks are written in YAML. Three statements about Ansible are true. Playbooks are written in YAML (A). Ansible is idempotent, meaning that applying the same configuration multiple times yields the same result (D). Additionally, Ansible requires Python on the control node only (C) because the control node runs the automation; managed nodes can be contacted via SSH or WinRM and may use raw modules that don't require Python, though most modules do expect Python on the managed node. Statement B is false because Ansible is agentless and does not use a centralized master server; it uses a push model from a control node. Statement E is false because Ansible is agentless—no agent is installed on managed nodes.

Answer

Ansible uses a centralized master server

Answer

Ansible requires an agent to be installed on managed nodes

Question 11

An administrator needs to create a hard link to an existing file. Which two statements are true about hard links? (Choose two.)

Accepted Answer

Hard links are indistinguishable from the original file. Hard links share the same inode and cannot span filesystems. They cannot link to directories.

Answer

Hard links can be created for directories

Answer

Hard links can be created across different filesystems

Answer

Deleting the original file removes the hard link

Question 12

An administrator wants to change the runlevel/target to a state where only a minimal set of processes is running, and network services are disabled. Which two systemd targets achieve this? (Choose two.)

Accepted Answer

rescue.target. (rescue.target) is correct because it boots the system into a single-user mode with a minimal set of processes and no network services, allowing administrative tasks like filesystem repairs. Option E (emergency.target) is correct because it starts an even more minimal environment with only a root shell on the console, also disabling network services. Both targets satisfy the requirement of minimal processes and disabled networking.

Answer

graphical.target

Answer

poweroff.target

Answer

multi-user.target

Question 13

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Accepted Answer

Set PermitRootLogin no in /etc/ssh/sshd_config. Setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct root login via SSH, forcing administrators to log in as a regular user and then use `su` or `sudo` for privilege escalation. This reduces the attack surface by eliminating the ability to brute-force the root password directly over SSH.

Answer

Set PermitRootLogin yes

Answer

Set PasswordAuthentication yes

Answer

Disable the SSH service

Question 14

A Linux administrator needs to implement a cron job that runs a script every day at 2:30 PM. Which TWO cron schedule expressions are equivalent?

Accepted Answer

30 14 * * *. In cron syntax, the first field is minute (0-59), the second is hour (0-23) in 24-hour format. 2:30 PM corresponds to hour 14 in 24-hour time. Therefore, '30 14 * * *' correctly specifies the job runs at minute 30 of hour 14 every day. Option A and E are identical and both use the correct 24-hour representation.

Answer

30 2 * * * PM

Answer

30 2 * * *

Answer

30 2 * * *

Question 15

An administrator wants to view the contents of a compressed log file /var/log/syslog.2.gz without decompressing it to disk. Which two commands can be used to display the file contents? (Select TWO).

Accepted Answer

zcat /var/log/syslog.2.gz. zcat and gzcat (if available) decompress to stdout; some systems use zcat or gzip -dc.

Answer

gzcat /var/log/syslog.2.gz

Answer

less /var/log/syslog.2.gz

Answer

cat /var/log/syslog.2.gz

Question 16

An administrator wants to monitor real-time system resource usage to identify performance bottlenecks. Which two commands are suitable? (Choose two.)

Accepted Answer

top. top and htop provide real-time process and resource monitoring.

Answer

vmstat

Answer

iostat

Answer

sar

Question 17

Which TWO statements are true regarding the use of Ansible for automation? (Choose TWO.)

Accepted Answer

Ansible playbooks are written in YAML.. Ansible playbooks are written in YAML (YAML Ain't Markup Language), which is a human-readable data serialization standard. YAML allows for simple, declarative syntax to define automation tasks, variables, and handlers, making playbooks easy to write and maintain without requiring programming expertise.

Answer

Ansible requires a dedicated master server to manage nodes.

Answer

Ansible uses a pull-based model where nodes fetch configurations from a central server.

Answer

Ansible modules are written in Ruby.

Question 18

An administrator wants to locate files that have the SUID or SGID special permission set. Which three find commands can accomplish this? (Choose three.)

Accepted Answer

find / -perm /6000. The find command with -perm can search for permissions in symbolic or octal modes, and using -4000 or -2000 finds SUID or SGID respectively.

Answer

find / -perm 2000

Answer

find / -perm 4000

Question 19

A system administrator is configuring a new disk partition for a database server. The disk has been partitioned as /dev/sdb1. Which three steps are necessary to make the filesystem available for use? (Choose three.)

Accepted Answer

Mount the partition with mount. To use a new partition, you must create a filesystem (mkfs), mount it (mount), and add an entry to /etc/fstab for persistent mounting.

Answer

Run fsck to check the filesystem

Answer

Set a label with e2label

Question 20

A Linux system is experiencing kernel panics after a recent update. The administrator wants to boot into a previous kernel version to restore functionality. Which three steps are required to achieve this? (Select THREE).

Accepted Answer

After booting, edit /etc/default/grub and set GRUB_DEFAULT to the saved entry, then run update-grub. After booting into a working kernel, editing /etc/default/grub to set GRUB_DEFAULT to 'saved' and running update-grub (or grub-mkconfig) ensures that the GRUB bootloader will remember and default to the last successfully booted kernel, which can be the previous version. This step is necessary to make the temporary fix persistent across reboots.

Answer

Run 'yum reinstall kernel' to revert to the previous version

Answer

Edit /etc/fstab to change root filesystem parameters