XK0-006 Services and User Management — 25 Questions

Question 1

A Linux administrator needs to add a new user account 'jdoe' with UID 1500, primary group 'developers', home directory /home/jdoe, and login shell /bin/bash. Which command will accomplish this?

Accepted Answer

useradd -u 1500 -g developers -d /home/jdoe -s /bin/bash jdoe. The useradd command is the standard low-level utility for creating new user accounts on Linux. Options -u, -g, -d, and -s respectively set the UID, primary group, home directory, and login shell. This command is available across all major Linux distributions and is the correct choice for non-interactive account creation.

Answer

adduser -u 1500 -g developers -d /home/jdoe -s /bin/bash jdoe

Answer

usermod -u 1500 -g developers -d /home/jdoe -s /bin/bash jdoe

Answer

passwd -u 1500 -g developers -d /home/jdoe -s /bin/bash jdoe

Question 2

A Linux administrator needs to create a new user account for a contractor who will start next month. The account must be locked until the contractor's start date, but it must have a valid home directory and default shell. Which sequence of commands best accomplishes this?

Accepted Answer

useradd -m -s /bin/bash contractor && passwd -l contractor. Creating a user with useradd -m ensures the home directory is created, and -s /bin/bash sets the default shell. Locking the password immediately with passwd -l prevents the contractor from logging in until the start date. This combination meets all stated requirements without relying on system defaults.

Answer

useradd -m -s /bin/bash contractor && usermod -L contractor

Answer

adduser contractor --disabled-password && usermod -s /bin/bash contractor

Answer

useradd contractor && passwd -l contractor

Question 3

A junior Linux administrator needs to add a new user account named 'dba' with a home directory '/home/dba' and the Bash shell. The account should be created with the next available UID, and a group with the same name should also be created. Which command should the administrator run?

Accepted Answer

useradd -m -s /bin/bash dba. The useradd command with -m and -s /bin/bash creates the account, home directory, and sets the shell. By default, a group with the same name is created when USERGROUPS_ENAB is enabled, so no separate groupadd is needed. This is the standard, non-interactive way to provision a user account on most Linux distributions.

Answer

usermod -m -s /bin/bash -U dba

Answer

adduser dba

Answer

groupadd dba && useradd -g dba -d /home/dba -s /bin/bash dba

Question 4

A user reports that they cannot run sudo commands. The administrator checks and finds the user is not in the sudoers file. Which command should the administrator use to add the user to the sudo group on a Debian-based system?

Accepted Answer

usermod -aG sudo username. The usermod -aG sudo username command adds the user to the sudo group while preserving existing group memberships. On Debian-based systems, members of the sudo group are granted sudo privileges by default. This is the standard method to grant sudo access.

Answer

gpasswd -a username sudo

Answer

adduser username sudo

Answer

usermod -G sudo username

Question 5

A user reports that they cannot run `sudo` commands and receive the error: `user is not in the sudoers file. This incident will be reported.` The administrator needs to grant this user full sudo privileges. Which command should the administrator use?

Accepted Answer

usermod -aG sudo username. The error indicates the user is not authorized to use sudo. On Debian-based systems, the standard way to grant full sudo privileges is to add the user to the `sudo` group, which is preconfigured in `/etc/sudoers`. Using `usermod -aG sudo username` appends the user to that group without altering other group memberships. Other options use incorrect group names, unsafe file editing, or invalid commands.

Answer

echo "username ALL=(ALL) ALL" >> /etc/sudoers

Answer

passwd -a username sudo

Answer

usermod -aG wheel username

Question 6

A Linux administrator is troubleshooting a service that fails to start. The service unit file contains the line `ExecStart=/usr/bin/myservice --config /etc/myservice.conf`. After modifying the configuration file, the administrator runs `systemctl daemon-reload` and then `systemctl restart myservice`. However, the service still uses the old configuration. Which command should the administrator run to ensure the new configuration is applied?

Accepted Answer

systemctl kill -s HUP myservice. Sending SIGHUP with `systemctl kill -s HUP myservice` can force the service to reload its configuration if it supports that signal. Since the administrator already restarted the service and it still uses old config, the service might require a signal to re-read files. Other options either don't apply changes or are not appropriate for this scenario.

Answer

systemctl edit myservice

Answer

systemctl reload myservice

Answer

systemctl restart myservice

Question 7

A Linux administrator is configuring a systemd timer to run a backup script daily. The administrator creates a timer unit `backup.timer` and a service unit `backup.service`. Which two directives are required in the timer unit to schedule the job to run every day at 2:00 AM? (Choose two.)

Accepted Answer

Unit=backup.service. To schedule a daily backup at 2:00 AM, the timer unit must include `OnCalendar` to define the schedule and `Unit` to specify the service to activate. Other directives like `Persistent` and `WantedBy` are useful for enabling and catch-up but are not required for the core scheduling functionality.

Answer

WantedBy=timers.target

Answer

Requires=backup.service

Answer

Persistent=true

Question 8

A Linux administrator needs a service to start automatically at boot and be manageable with systemctl. The unit file is currently stored at /etc/systemd/system/myapp.service. After running 'systemctl daemon-reload', the administrator runs 'systemctl enable myapp.service' and receives the error 'Failed to enable unit: Unit file myapp.service does not exist.' Which command should the administrator run to resolve this?

Accepted Answer

systemctl daemon-reload. After placing a new unit file in /etc/systemd/system, systemd must re-read its configuration before the unit becomes known. Although the administrator ran daemon-reload earlier, the unit file was likely added afterward, so systemd's cache is stale. Running systemctl daemon-reload again refreshes the manager's unit list, after which systemctl enable can create the symlink and the service will start at boot.

Answer

systemctl link /etc/systemd/system/myapp.service

Answer

systemctl reset-failed myapp.service

Answer

systemctl unmask myapp.service

Question 9

A Linux administrator needs to create a new user account `alice` with a home directory `/home/alice`, a specific shell `/bin/bash`, and an expiration date of `2025-12-31`. The administrator also wants to ensure that a group with the same name is created. Which two commands can be used to achieve this? (Choose two.)

Accepted Answer

useradd -m -s /bin/bash -e 2025-12-31 alice. Both `useradd` with appropriate options and `adduser` can create the user with the specified home directory, shell, expiration date, and automatically create a group with the same name. The `useradd` command uses `-m` for home, `-s` for shell, and `-e` for expiration. The `adduser` command provides equivalent functionality with more user-friendly option names. The other options either use incorrect flags, attempt to modify a non-existent user, or require multiple steps.

Answer

useradd -d /home/alice -s /bin/bash -f 2025-12-31 alice

Answer

usermod -m -d /home/alice -s /bin/bash -e 2025-12-31 alice

Answer

groupadd alice && useradd -g alice -m -s /bin/bash -e 2025-12-31 alice

Question 10

A Linux administrator needs to grant a developer named 'alex' the ability to run the command '/usr/sbin/reboot' as root without entering a password, but must not allow any other command. The system uses sudo. Which of the following is the correct way to configure this?

Accepted Answer

Add 'alex ALL=(ALL) NOPASSWD: /usr/sbin/reboot' to /etc/sudoers using visudo.. The correct configuration must allow alex to run only the specified command without a password. Using visudo to edit /etc/sudoers with the entry 'alex ALL=(ALL) NOPASSWD: /usr/sbin/reboot' achieves this. The NOPASSWD tag removes the password prompt, and the command path restricts execution to that single binary. Other options either omit NOPASSWD or use an incorrect command path, failing the requirement.

Answer

Add 'alex ALL=(ALL) /usr/sbin/reboot' to /etc/sudoers.d/alex using visudo -f /etc/sudoers.d/alex.

Answer

Add 'alex ALL=(ALL) /usr/sbin/reboot' to /etc/sudoers using visudo.

Answer

Add 'alex ALL=(root) NOPASSWD: /usr/sbin/reboot' to /etc/sudoers using visudo.

Question 11

A Linux administrator is configuring a new server and needs to ensure that user accounts are created with specific defaults, such as a default shell of `/bin/bash` and a default home directory under `/home`. Which two files should the administrator modify to set these system-wide defaults for new users? (Choose two.)

Accepted Answer

/etc/default/useradd. To set system-wide defaults for new users, the administrator should modify `/etc/default/useradd` for the default shell and home directory base, and `/etc/login.defs` for related settings like home directory creation and UID/GID ranges. These files are consulted by `useradd` during account creation. The other files do not control these defaults.

Answer

/etc/passwd

Answer

/etc/skel

Answer

/etc/shadow

Question 12

A Linux administrator is configuring a system to mount an NFS share from server 'nfs01' at /mnt/data. The administrator wants the mount to be automatically available at boot and to allow users to mount it manually when needed. Which entry in /etc/fstab correctly achieves this?

Accepted Answer

nfs01:/export/data /mnt/data nfs defaults 0 0. The correct fstab entry for an NFS share that mounts automatically at boot uses the format server:/export/path, mount point, nfs, and defaults. The defaults option includes auto, allowing boot-time mounting. Other options like noauto or user would prevent automatic mounting, and _netdev, while sometimes useful, is not necessary here.

Answer

nfs01:/export/data /mnt/data nfs defaults,_netdev 0 0

Answer

nfs01:/export/data /mnt/data nfs4 defaults,user 0 0

Answer

nfs01:/export/data /mnt/data nfs defaults,noauto 0 0

Question 13

A Linux administrator needs to schedule a script /usr/local/bin/backup.sh to run every day at 2:30 AM. The script must run as the user 'backup' and the schedule should persist across reboots. Which method should the administrator use?

Accepted Answer

Create a file /etc/cron.d/backup with the line '30 2 * * * backup /usr/local/bin/backup.sh'. Placing a file in /etc/cron.d with the correct system crontab syntax, including the user field, is the standard way to schedule a system-wide job that runs as a specific user. This method persists across reboots and is managed by the cron daemon, ensuring the backup script runs daily at 2:30 AM as 'backup'.

Answer

Create a systemd timer unit that runs daily at 2:30 AM and enable it with systemctl enable.

Answer

Add the line '30 2 * * * /usr/local/bin/backup.sh' to /etc/crontab and specify the user 'backup' in the sixth field.

Answer

Run 'crontab -u backup -e' and add the line '30 2 * * * /usr/local/bin/backup.sh'

Question 14

A Linux administrator needs to grant a user named 'alice' the ability to run all commands as root without a password prompt, but only from the local console. Which entry in the sudoers file accomplishes this?

Accepted Answer

alice localhost=(ALL) NOPASSWD: ALL. The correct entry is alice localhost=(ALL) NOPASSWD: ALL. The host field 'localhost' restricts the rule to the local machine, matching the requirement of only from the local console. The NOPASSWD tag allows running commands without a password, and (ALL) allows running as any user, including root.

Answer

alice LOCAL=(ALL) NOPASSWD: ALL

Answer

alice ALL=(ALL) NOPASSWD: ALL

Answer

alice 127.0.0.1=(ALL) NOPASSWD: ALL

Question 15

A junior Linux administrator needs to create a new user account named 'deploy' with a home directory /home/deploy, a default shell of /bin/bash, and add the user to the supplementary group 'docker'. Which command should be used?

Accepted Answer

useradd -m -s /bin/bash -G docker deploy. The useradd command with -m, -s, and -G creates a user with a home directory, a specific shell, and supplementary group membership. It is the correct low-level utility available on all Linux distributions. The other commands either modify existing users or create groups, and some use non-portable syntax. Therefore, useradd is the right choice.

Answer

groupadd -m -s /bin/bash -G docker deploy

Answer

usermod -m -s /bin/bash -G docker deploy

Answer

adduser -m -s /bin/bash -G docker deploy

Question 16

A developer reports that a scheduled backup script, /usr/local/bin/backup.sh, runs successfully when executed manually as root but fails with 'Permission denied' when triggered by a systemd timer. The unit file backup.service contains ExecStart=/usr/local/bin/backup.sh. What is the most likely cause?

Accepted Answer

The script does not have the execute permission bit set, so systemd cannot run it directly.. systemd does not invoke ExecStart through a shell, so it cannot rely on the shebang line or shell interpretation. If the script file lacks execute permission for the user running the service, systemd fails immediately with 'Permission denied'. Manual execution as root often works because root can bypass some permission checks or because the user runs it with an explicit interpreter. Setting the execute bit with chmod +x makes the script runnable by systemd.

Answer

The backup.service unit lacks the User=root directive, so systemd runs it as an unprivileged user.

Answer

systemd requires the full path to be specified in ExecStart, and a relative path is being used.

Answer

The timer unit is missing the Persistent=true directive, causing the service to run with restricted privileges.

Question 17

A Linux administrator is configuring a new system and needs to ensure that the user 'devops' has a specific umask of 027 and a custom PATH that includes /opt/tools/bin. The changes must apply to all future login shells for that user. Which two files should the administrator modify? (Choose two.)

Accepted Answer

~devops/.bash_profile. The correct files are ~devops/.bash_profile and ~devops/.bashrc. .bash_profile is executed for login shells, and .bashrc for interactive non-login shells. Often .bash_profile sources .bashrc, so changes in either can take effect. Together, they ensure the umask and PATH are set for all future login shells for devops.

Answer

~devops/.profile

Answer

/etc/profile

Answer

/etc/skel/.bashrc

Question 18

A Linux administrator needs to configure a system so that a specific user `bob` can run only the command `/usr/bin/systemctl restart httpd` with sudo privileges, without being prompted for a password. Which entry should be added to the sudoers file?

Accepted Answer

bob ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd. The sudoers entry must allow `bob` to run only the specified command without a password. The correct syntax includes the user, host, runas user, the `NOPASSWD:` tag, and the full command path with arguments. Using `(ALL)` is standard and grants flexibility to run as any user, though root is typical. The other options either allow too many commands, omit the password exemption, or unnecessarily restrict the runas user.

Answer

bob ALL=(ALL) /usr/bin/systemctl restart httpd

Answer

bob ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd

Answer

bob ALL=(ALL) NOPASSWD: /usr/bin/systemctl

Question 19

A Linux administrator is configuring a systemd service unit for a custom application. The service should start automatically at boot, after the network is online, and should restart automatically if it fails. The administrator writes the unit file and places it in /etc/systemd/system/. Which of the following directives should be included in the [Unit] and [Service] sections to meet these requirements? (Choose two.)

Accepted Answer

After=network-online.target in the [Unit] section.. To ensure the service starts at boot, the [Install] section must include WantedBy=multi-user.target, which allows systemctl enable to create the proper symlinks. To restart automatically on failure, the [Service] section must include Restart=on-failure (or always). For network ordering, After=network-online.target alone is insufficient because it does not pull in the target; Wants=network-online.target is also needed. Thus, the two correct directives are WantedBy and Restart=on-failure.

Answer

Restart=on-failure in the [Service] section.

Answer

Requires=network-online.target in the [Unit] section.

Answer

Type=simple in the [Service] section.

Question 20

A Linux administrator is troubleshooting a systemd service that fails to start. The administrator runs 'systemctl status myservice.service' and sees that the service is in a failed state. Which two commands will provide additional details about the failure? (Choose two.)

Accepted Answer

systemctl status myservice.service -l. The two commands that provide additional failure details are journalctl -u myservice.service and systemctl status myservice.service -l. The journalctl command shows the unit's logs, including error output. The status command with -l displays the full, untruncated log lines. Together, they give comprehensive information about why the service failed.

Answer

systemctl list-dependencies myservice.service

Answer

systemctl cat myservice.service

Answer

systemctl show myservice.service