XK0-005 Scripting, Containers and Automation Practice Test 2 — 15 Questions

Question 1

After building and running the container as shown in the exhibit, the administrator tries to access http://localhost:8080 but receives a connection refused error. What is the most likely cause?

Accepted Answer

The container exited immediately after starting.. The most likely cause is that the container exited immediately after starting. When a container runs a command that finishes quickly (e.g., a shell script that exits), the container stops, and no process listens on port 8080. This results in a 'connection refused' error because the container is no longer running to accept connections.

Answer

The port mapping is incorrect.

Answer

The base image is not compatible.

Answer

The CMD syntax is incorrect.

Question 2

Based on the exhibit, how often does the healthcheck.sh script run?

Accepted Answer

Every 5 minutes. The cron expression `*/5 * * * *` in the crontab file means the script runs every 5 minutes. The `*/5` in the minute field triggers execution every 5 minutes, while the asterisks in the hour, day, month, and weekday fields mean every hour, every day, every month, and every day of the week, respectively.

Answer

Every 5 days

Answer

Every 5 hours

Answer

Every 5 seconds

Question 3

A company runs a critical web application on a single Linux server. The application consists of a Node.js backend and a PostgreSQL database. The server is running out of disk space frequently due to application logs. The administrator wants to implement a log rotation solution that is automated, minimizes data loss, and compresses old logs. The administrator has root access and wants to use built-in tools. Currently, logs are written to /var/log/app/access.log and /var/log/app/error.log. The application never closes its log files. Which of the following is the best course of action?

Accepted Answer

Configure logrotate with daily rotation, compression, and the copytruncate option.. Option C is correct because logrotate with the copytruncate option allows the log file to be rotated without requiring the application to close or reopen its file handles. This is essential since the application never closes its log files. Daily rotation with compression addresses the frequent disk space issue while minimizing data loss, and logrotate is a built-in Linux tool that runs automatically via cron.

Answer

Configure the systemd journal to capture the application logs and set MaxRetentionSec.

Answer

Create a cron job that runs every hour to move the logs to a backup directory and restart the application.

Answer

Configure logrotate with a weekly rotation and no copytruncate, since the application will eventually close the log files.

Question 4

A development team uses Git for version control and wants to automate the testing of every commit pushed to the repository. They have a Jenkins server running on a Linux machine. The team wants to automatically trigger a Jenkins pipeline job whenever a push is made to the main branch of their Git repository. The Jenkins server is behind a firewall and cannot be accessed from the internet. The Git repository is hosted on a private GitHub repository. Which of the following is the best approach to trigger the Jenkins job automatically?

Accepted Answer

Configure Jenkins to poll the Git repository every minute for changes.. Option B is correct because Jenkins' polling mechanism allows it to periodically check the Git repository for changes, which works even when the Jenkins server is behind a firewall and cannot receive inbound webhooks. Polling every minute provides near-real-time automation without requiring internet access to the Jenkins server, making it the only viable option given the network constraint.

Answer

Have developers manually click 'Build Now' in Jenkins after each push.

Answer

Configure a GitHub webhook to send a POST request to the Jenkins server.

Answer

Set up a cron job on the Git server to execute a script that triggers Jenkins.

Question 5

An administrator needs to deploy a containerized web application on a Linux server. The application requires port 8080 to be mapped to host port 80. Which command will run the container in detached mode with this port mapping?

Accepted Answer

docker run -d -p 80:8080 webapp. Option D is correct because the `-d` flag runs the container in detached mode, and `-p 80:8080` maps host port 80 to container port 8080, which matches the requirement. The syntax is `-p host_port:container_port`, so `-p 80:8080` correctly exposes the application's container port 8080 on the host's port 80.

Answer

docker run -p 80:8080 webapp

Answer

docker run -d -p 8080:80 webapp

Answer

docker run -d -p 8080:80 webapp

Question 6

A Linux system experiences high CPU usage from a process that appears to be a fork bomb. The administrator wants to prevent such attacks in the future by limiting the number of processes a user can create. Which configuration file should be modified, and what parameter should be set?

Accepted Answer

Add 'username hard nproc 100' in /etc/security/limits.conf. Option C is correct because /etc/security/limits.conf is the PAM-based configuration file used to set per-user resource limits via the 'nproc' parameter. Adding 'username hard nproc 100' enforces a hard limit of 100 processes for that user, preventing a fork bomb from exhausting system resources.

Answer

Set 'kernel.pid_max=100' in /etc/sysctl.conf

Answer

Set 'DefaultLimitNPROC=100' in /etc/systemd/system.conf

Answer

Add 'ulimit -u 100' to /etc/profile

Question 7

A DevOps engineer needs to automate the deployment of a microservice using Ansible. The playbook should install the latest version of nginx on all web servers. Which Ansible module should be used in the playbook?

Accepted Answer

apt: name=nginx state=latest. Option C is correct because the `apt` module is the proper Ansible module for managing packages on Debian-based systems, and `state=latest` ensures the most recent version of nginx is installed. This aligns with the requirement to automate deployment using Ansible's declarative package management rather than imperative shell commands.

Answer

service: name=nginx state=started

Answer

command: apt install nginx

Answer

yum: name=nginx state=latest

Question 8

A container is running a database service that requires persistent storage. The administrator wants to ensure that data persists even if the container is removed. Which volume mount type should be used in the Docker run command?

Accepted Answer

--mount type=bind. Option B is correct because a bind mount directly maps a host directory into the container, ensuring that data written to that mount point persists on the host filesystem even after the container is removed. This is ideal for database services that require persistent storage independent of the container lifecycle.

Answer

--mount type=volume

Answer

COPY in Dockerfile

Answer

--mount type=tmpfs

Question 9

A system administrator notices that a cron job runs every 5 minutes but should run only on weekdays. The current crontab entry is: */5 * * * * /usr/local/bin/script.sh. Which change to the time fields will restrict execution to Monday through Friday?

Accepted Answer

*/5 * * * 1-5 /usr/local/bin/script.sh. Option C is correct because the fifth field in a crontab entry specifies the day of the week, where 1 represents Monday and 5 represents Friday. By setting this field to `1-5`, the cron job will only execute on weekdays, while the `*/5` in the minute field ensures it still runs every 5 minutes. The other fields remain as `*` to allow execution at any hour and any day of the month.

Answer

*/5 9-17 * * 1-5 /usr/local/bin/script.sh

Answer

*/5 * * * 1-6 /usr/local/bin/script.sh

Answer

5 * * * 1-5 /usr/local/bin/script.sh

Question 10

Which TWO statements about container security are correct when using Docker? (Choose two.)

Accepted Answer

Using --cap-drop=ALL removes all capabilities, making the container more secure.. Option C is correct because using `--cap-drop=ALL` removes all Linux capabilities from the container, which eliminates any privileged operations the container could perform. This forces the container to run with the absolute minimum privileges, significantly reducing the attack surface and making it more secure.

Answer

SELinux is automatically enabled inside containers.

Answer

Containers have their own kernel, isolated from the host.

Answer

Using --network=host increases container isolation.

Question 11

Which THREE conditions must be met for a Linux container to run with user namespaces enabled? (Choose three.)

Accepted Answer

The container runtime must be configured to use user namespaces.. Option B is correct because user namespaces must be explicitly enabled in the container runtime configuration (e.g., `--userns=host` or `userns-remap` in Docker/Podman) to isolate the container's UID/GID mappings from the host. Without this configuration, the container will run in the default host namespace, negating the security benefits of user namespaces.

Answer

The container image must have a user with UID 0.

Answer

The container must be started with root privileges.

Question 12

An administrator runs the commands shown in the exhibit. The container is accessible via curl using the container IP. However, the administrator cannot access the web server using the host's IP address on port 80. What is the most likely cause?

Accepted Answer

The container's port 80 is not published to the host.. Option B is correct because the administrator ran `docker run -d nginx` without the `-p` or `--publish` flag, which means port 80 inside the container is not mapped to any port on the host. The container is accessible via its own IP because Docker networking allows direct container-to-container communication, but the host's IP on port 80 remains unbound, so curl to the host IP fails. Publishing the port with `-p 80:80` would expose the container's port 80 on the host's interface.

Answer

The container's IP address is incorrect.

Answer

Nginx is configured to listen on a different port.

Answer

The container is not running.

Question 13

An administrator configures Docker as shown in the exhibit. After starting a container, the warning about the 'user' directive appears. What is the most likely cause?

Accepted Answer

The cgroup driver configured in daemon.json does not match the actual driver in use.. The warning about the 'user' directive indicates a mismatch between the cgroup driver configured in Docker's daemon.json and the cgroup driver actually in use by the system (e.g., systemd vs. cgroupfs). Docker expects the configured driver to match the system's init system; when they differ, Docker emits warnings because cgroup management may behave inconsistently, affecting resource limits and container isolation.

Answer

The storage driver overlay2 is not compatible with the systemd cgroup driver.

Answer

The container is running with reduced privileges, and nginx cannot use the 'user' directive.

Answer

The log driver configuration is causing nginx to log warnings.

Question 14

A company is deploying a new web application using Docker containers. The application requires configuration values that vary between environments (development, staging, production). Which approach ensures the configuration is securely managed and applied without modifying the container image?

Accepted Answer

Pass configuration via environment variables and use Docker secrets for sensitive data.. Option A is correct because Docker supports passing configuration via environment variables at runtime without altering the image, and Docker secrets securely manage sensitive data (e.g., passwords, API keys) by storing them in encrypted memory and mounting them as temporary files in `/run/secrets/`. This decouples configuration from the immutable image, adhering to the twelve-factor app methodology and ensuring environment-specific values are applied without rebuilding.

Answer

Build separate images for each environment with the configuration baked in.

Answer

Store configuration in a JSON file within the base image and override it at runtime.

Answer

Use a Dockerfile to copy the configuration file from the host at build time.

Question 15

A Linux administrator is writing a Bash script to automate the backup of a database. The script must run a pre-backup command, check its exit status, and if successful, proceed with the backup; otherwise, log an error and exit. Which code snippet correctly implements this logic?

Accepted Answer

pre_backup_cmd
if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi
backup_cmd. Option C correctly runs the pre-backup command, then checks its exit status with `$?`. If the exit status is not zero (indicating failure), it logs an error to stderr and exits with code 1. Only if the pre-backup command succeeds does the script proceed to the backup command. This matches the requirement exactly: check exit status, log error on failure, and exit.

Answer

set -e
pre_backup_cmd
backup_cmd

Answer

pre_backup_cmd && backup_cmd || echo 'Error' >&2

Answer

(pre_backup_cmd; if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi) && backup_cmd

XK0-005 Scripting, Containers and Automation Practice Test 2 — 15 Questions

Exhibit

XK0-005 Scripting, Containers and Automation Practice Test 2 — 15 Questions

Exhibit