XK0-006 Services and User Management Practice Test 2 — 15 Questions

Question 1

A developer reports that a scheduled backup script, /usr/local/bin/backup.sh, runs successfully when executed manually as root but fails with 'Permission denied' when triggered by a systemd timer. The unit file backup.service contains ExecStart=/usr/local/bin/backup.sh. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The script does not have the execute permission bit set, so systemd cannot run it directly.. systemd does not invoke ExecStart through a shell, so it cannot rely on the shebang line or shell interpretation. If the script file lacks execute permission for the user running the service, systemd fails immediately with 'Permission denied'. Manual execution as root often works because root can bypass some permission checks or because the user runs it with an explicit interpreter. Setting the execute bit with chmod +x makes the script runnable by systemd.

Answer

The backup.service unit lacks the User=root directive, so systemd runs it as an unprivileged user.

Answer

systemd requires the full path to be specified in ExecStart, and a relative path is being used.

Answer

The timer unit is missing the Persistent=true directive, causing the service to run with restricted privileges.

Question 2

A Linux administrator is configuring a new system and needs to ensure that the user 'devops' has a specific umask of 027 and a custom PATH that includes /opt/tools/bin. The changes must apply to all future login shells for that user. Which two files should the administrator modify? (Choose two.)

Accepted Answer

~devops/.bash_profile. The correct files are ~devops/.bash_profile and ~devops/.bashrc. .bash_profile is executed for login shells, and .bashrc for interactive non-login shells. Often .bash_profile sources .bashrc, so changes in either can take effect. Together, they ensure the umask and PATH are set for all future login shells for devops.

Answer

~devops/.profile

Answer

/etc/profile

Answer

/etc/skel/.bashrc

Question 3

A Linux administrator needs to configure a system so that a specific user `bob` can run only the command `/usr/bin/systemctl restart httpd` with sudo privileges, without being prompted for a password. Which entry should be added to the sudoers file?

Accepted Answer

bob ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd. The sudoers entry must allow `bob` to run only the specified command without a password. The correct syntax includes the user, host, runas user, the `NOPASSWD:` tag, and the full command path with arguments. Using `(ALL)` is standard and grants flexibility to run as any user, though root is typical. The other options either allow too many commands, omit the password exemption, or unnecessarily restrict the runas user.

Answer

bob ALL=(ALL) /usr/bin/systemctl restart httpd

Answer

bob ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd

Answer

bob ALL=(ALL) NOPASSWD: /usr/bin/systemctl

Question 4

A Linux administrator is configuring a systemd service unit for a custom application. The service should start automatically at boot, after the network is online, and should restart automatically if it fails. The administrator writes the unit file and places it in /etc/systemd/system/. Which of the following directives should be included in the [Unit] and [Service] sections to meet these requirements? (Choose two.)

Accepted Answer

After=network-online.target in the [Unit] section.. To ensure the service starts at boot, the [Install] section must include WantedBy=multi-user.target, which allows systemctl enable to create the proper symlinks. To restart automatically on failure, the [Service] section must include Restart=on-failure (or always). For network ordering, After=network-online.target alone is insufficient because it does not pull in the target; Wants=network-online.target is also needed. Thus, the two correct directives are WantedBy and Restart=on-failure.

Answer

Restart=on-failure in the [Service] section.

Answer

Requires=network-online.target in the [Unit] section.

Answer

Type=simple in the [Service] section.

Question 5

A Linux administrator is troubleshooting a systemd service that fails to start. The administrator runs 'systemctl status myservice.service' and sees that the service is in a failed state. Which two commands will provide additional details about the failure? (Choose two.)

Accepted Answer

systemctl status myservice.service -l. The two commands that provide additional failure details are journalctl -u myservice.service and systemctl status myservice.service -l. The journalctl command shows the unit's logs, including error output. The status command with -l displays the full, untruncated log lines. Together, they give comprehensive information about why the service failed.

Answer

systemctl list-dependencies myservice.service

Answer

systemctl cat myservice.service

Answer

systemctl show myservice.service

Question 6

A junior administrator needs to create a new user account named 'analyst' with a home directory and a default shell of /bin/bash. The administrator runs 'useradd -m -s /bin/bash analyst' but later notices the home directory is missing. What is the most likely reason?

Accepted Answer

The command was run without root privileges, so useradd could not create the home directory.. Creating a user and home directory requires root privileges because useradd must write to /etc/passwd, /etc/shadow, and /home. A non-root user typically receives a permission denied error or, depending on the system, may create the account entry but fail to create the home directory. Running the command with sudo or as root ensures the home directory is created correctly.

Answer

The /etc/skel directory is missing, causing useradd to fail silently when creating the home directory.

Answer

The -m option was ignored because /etc/login.defs has CREATE_HOME set to no.

Answer

The -s option conflicts with -m, preventing home directory creation.

Question 7

A security auditor discovers that a user account 'contractor' has a valid password but should not be able to log in interactively. The administrator needs to lock the account without deleting it or removing its home directory. Which command should the administrator use?

Accepted Answer

usermod -s /sbin/nologin contractor. The most reliable way to prevent interactive logins while keeping the account and home directory intact is to set the shell to /sbin/nologin. This blocks shell access even if the user authenticates via SSH key or other means. Locking the password with passwd -l or usermod -L only blocks password-based logins and leaves key-based access open, which does not meet the auditor's requirement.

Answer

passwd -l contractor

Answer

chage -E 0 contractor

Answer

usermod -L contractor

Question 8

A Linux administrator needs to create a system account named backup that will run a scheduled rsync job via cron. The account must not be able to log in interactively and should not have a home directory created. Which command accomplishes this?

Accepted Answer

sudo useradd -r -s /sbin/nologin backup. The -r option on useradd creates a system account, typically with a UID in the system range and no home directory unless -m is also given. Setting the shell to /sbin/nologin prevents interactive logins while still permitting the account to run scheduled tasks and own files. This is the conventional way to provision a service account for cron-driven jobs such as rsync.

Answer

sudo useradd -M -s /usr/sbin/nologin backup && sudo passwd -l backup

Answer

sudo adduser --system --shell /bin/bash backup

Answer

sudo useradd -m -s /bin/false backup

Question 9

An administrator notices that a user's scheduled backup script, run from the user's crontab, fails with 'Permission denied' when writing to /var/backups/userdata, even though the user can write to that directory when logged in interactively. The directory has mode 770 and group ownership backup. The user is a member of the backup group. Which is the most likely cause?

Accepted Answer

The user's crontab does not load the login shell environment, so the umask or group context differs from the interactive session.. Cron executes jobs with a deliberately minimal environment and does not source the user's interactive shell startup files. As a result, umask settings, environment variables, and sometimes supplementary group context can differ from an interactive login. When a write to a group-writable directory fails only under cron, the usual fix is to set an explicit umask in the job, ensure the directory permissions are correct, and verify that group membership is applied in the cron context, for example by using a wrapper that invokes sg or newgrp.

Answer

The directory's setgid bit is missing, so new files are not group-owned by backup.

Answer

The user's primary group is not backup, so cron uses only the primary group for permission checks.

Answer

The cron daemon runs with a restrictive SELinux context that blocks all writes to /var/backups regardless of Unix permissions.

Question 10

A Linux administrator needs to ensure that a new service, myapp.service, starts automatically at boot and is currently running. The administrator runs 'systemctl enable --now myapp.service' and receives no errors, but after a reboot the service is not running. Which of the following is the most likely cause?

Accepted Answer

The service unit file is missing the [Install] section with WantedBy=multi-user.target.. The [Install] section defines how a unit integrates with systemd's boot targets. WantedBy=multi-user.target is what allows enable to create the symlink that pulls the service into the boot transaction. Without it, enable --now starts the unit but does not configure it for automatic startup, so after reboot the service remains inactive.

Answer

The systemctl daemon-reload command was not run after creating the unit file.

Answer

The service is masked by another unit with the same name in /etc/systemd/system.

Answer

The service was started with systemctl start instead of systemctl enable --now.

Question 11

A Linux administrator is troubleshooting a service that fails to start. The service unit file contains 'User=appuser' and 'Group=appgroup'. The administrator runs 'systemctl start app.service' and sees the error 'Failed to determine user credentials: No such process'. Which of the following is the most likely cause?

Accepted Answer

The user appuser does not exist on the system.. systemd resolves User= and Group= before launching the process. If the specified account cannot be found in the user database, systemd aborts with a credential resolution error. The fix is to create the missing user or correct the unit file to reference an existing account, then reload systemd and restart the service.

Answer

The service unit file has a syntax error in the [Service] section.

Answer

The service binary does not have the execute permission for appuser.

Answer

The appgroup group exists but appuser is not a member of it.

Question 12

A Linux administrator needs to configure a system so that the service `httpd` starts automatically when the system boots into the default target. Which command should the administrator use?

Accepted Answer

systemctl enable httpd. Enabling a service with `systemctl enable httpd` sets up the proper symlinks so that systemd starts the service when the default target is reached during boot. Starting the service only affects the current runtime, while enabling ensures persistence across reboots. Other commands like `chkconfig` are for older init systems and `daemon-reload` only refreshes unit definitions.

Answer

systemctl daemon-reload

Answer

systemctl start httpd

Answer

chkconfig httpd on

Question 13

A Linux administrator needs to ensure that a new service, `myapp.service`, starts automatically at boot and is also started immediately, without rebooting. The service unit file is already installed in `/etc/systemd/system/`. Which sequence of commands should the administrator run?

Accepted Answer

systemctl enable --now myapp.service. The administrator must both enable the service for automatic startup at boot and start it immediately. The `systemctl enable --now` command accomplishes both tasks in one step, making it the correct choice. Other options either omit the immediate start, omit enabling, or use unnecessary commands like `daemon-reload` or `link` that do not address the requirements.

Answer

systemctl start myapp.service && systemctl enable myapp.service

Answer

systemctl link /etc/systemd/system/myapp.service && systemctl start myapp.service

Answer

systemctl daemon-reload && systemctl enable myapp.service

Question 14

A user reports that they cannot run the command `sudo` to perform administrative tasks. The administrator checks and finds that the user is not listed in the `/etc/sudoers` file. Which command should the administrator use to safely edit the sudoers file and add the user?

Accepted Answer

visudo. Using `visudo` is the correct approach because it provides a safe editing environment with syntax validation and file locking. Directly editing the sudoers file or appending to it can introduce errors that break sudo. Adding a user to a group like sudo is an alternative but does not address the specific need to edit the sudoers file safely.

Answer

echo 'username ALL=(ALL) ALL' >> /etc/sudoers

Answer

usermod -aG sudo username

Answer

nano /etc/sudoers

Question 15

A Linux administrator needs to grant the user 'alice' the ability to run all commands as root without being prompted for a password, but only from the host 'server1'. Which entry in /etc/sudoers accomplishes this?

Accepted Answer

alice server1=(ALL) NOPASSWD: ALL. The sudoers file uses the format user host=(runas) command. To allow alice to run all commands as root without a password only on server1, the correct entry is 'alice server1=(ALL) NOPASSWD: ALL'. The host field restricts the rule to server1, and NOPASSWD: ALL removes the password requirement for all commands.

Answer

alice server1=(root) NOPASSWD: /bin/bash

Answer

alice ALL=(server1) NOPASSWD: ALL

Answer

alice ALL=(ALL) NOPASSWD: server1