XK0-006 Services and User Management Practice Test 3 — 15 Questions

Question 1

A Linux administrator is troubleshooting a systemd service that fails to start with the error 'Failed to start myservice.service: Unit myservice.service not found.' The service file exists at /etc/systemd/system/myservice.service and has correct permissions. Which command should the administrator run to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

systemctl daemon-reload. When a new unit file is added to /etc/systemd/system/, systemd does not automatically detect it. The administrator must run 'systemctl daemon-reload' to reload the systemd manager configuration. This command scans for new or changed unit files and makes them available for starting and enabling.

Answer

systemctl reexec myservice.service

Answer

systemctl start myservice.service

Answer

systemctl enable myservice.service

Question 2

A Linux administrator needs a service to be started automatically at boot and then started immediately without rebooting. The service unit file is located at /etc/systemd/system/myapp.service. Which command should the administrator run to accomplish both tasks?

Accepted Answer

systemctl enable --now myapp.service. The correct command is systemctl enable --now myapp.service. The enable subcommand sets up the unit to start at boot, and --now starts it immediately. This single command satisfies both requirements without requiring a reboot or separate commands. Other options either omit enabling, omit starting, or use commands that do not achieve both goals.

Answer

systemctl start myapp.service && systemctl daemon-reload

Answer

systemctl link /etc/systemd/system/myapp.service

Answer

systemctl enable myapp.service && systemctl restart myapp.service

Question 3

A security policy mandates that user 'alice' must change her password every 60 days and must be warned 7 days before expiration. Which command should be used to enforce this?

Accepted Answer

chage -M 60 -W 7 alice. The chage command directly manipulates the password aging fields in /etc/shadow. Using -M 60 enforces the maximum days a password is valid, and -W 7 provides a warning to the user seven days before expiration. This is the correct and portable method to comply with the stated security policy.

Answer

passwd -x 60 -w 7 alice

Answer

chage -m 60 -I 7 alice

Answer

usermod -e 2025-01-01 -f 7 alice

Question 4

A Linux administrator needs to allow members of the group 'developers' to run all commands as root without being prompted for a password, but only from the host 'build01'. The administrator adds the following line to /etc/sudoers: '%developers build01=(ALL) NOPASSWD: ALL'. After saving, users report that sudo still prompts for a password on build01. Which command should the administrator run to verify the syntax and placement of the rule?

Accepted Answer

visudo -c. The correct command is visudo -c, which parses the sudoers file and reports syntax errors. Because the rule was added manually, a syntax mistake or misplacement could cause sudo to ignore it or fail. Validating with visudo -c ensures the file is well-formed before investigating effective privileges with sudo -l.

Answer

grep developers /etc/sudoers

Answer

sudo -l -U developer1

Answer

sudo -V

Question 5

A Linux administrator is troubleshooting a systemd service that fails to start with the error 'Failed to start myservice.service: Unit myservice.service not found.' The service file exists at /etc/systemd/system/myservice.service and has correct permissions. Which command should the administrator run to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

journalctl -u myservice -b. To see boot-time messages for a specific systemd service, the correct tool is `journalctl` with the `-u` (unit) and `-b` (current boot) options. This filters the journal to show only entries from that unit during the current boot. Other commands either show unit file contents, unit properties, or rely on a non-authoritative log file, and none provide the targeted boot logs needed.

Answer

systemctl cat myservice

Answer

grep myservice /var/log/boot.log

Answer

systemctl show myservice

Question 6

A new employee needs a user account on a Linux server. The administrator runs 'useradd -m jdoe' and then 'passwd jdoe'. After setting the password, the employee reports that they cannot log in via SSH. The administrator verifies the password is correct. Which file should the administrator check to ensure the account is not locked?

Accepted Answer

/etc/shadow. The /etc/shadow file holds the password hash and lock indicator. A locked account often has an exclamation mark or asterisk prepended to the password hash, which prevents authentication. Since the password was set correctly, the next step is to verify the account is not locked in /etc/shadow, for example by checking for a '!' prefix.

Answer

/etc/login.defs

Answer

/etc/group

Answer

/etc/passwd

Question 7

A Linux administrator needs to configure a service to run as a specific user and group, and to restart automatically on failure. The service is managed by systemd. Which directive in the unit file should the administrator use to specify the user and group, and which directive to ensure automatic restart?

Accepted Answer

User= and Group= in the [Service] section; Restart=on-failure. The correct directives are User= and Group= in the [Service] section, and Restart=on-failure. These set the execution context and restart policy. User and Group must be in [Service] because they affect how the service process runs. Restart=on-failure restarts the service when it exits with a non-zero code or is killed by a signal, covering typical failure conditions.

Answer

User= and Group= in the [Service] section; Restart=on-abort

Answer

ExecStart= with su or sudo; Restart=on-abnormal

Answer

User= and Group= in the [Unit] section; Restart=always

Question 8

A Linux administrator needs to configure sudo so that members of the group 'webadmins' can run any command as any user without being prompted for a password, but only on the host 'web01'. Which entry should be added to the sudoers file?

Accepted Answer

%webadmins web01=(ALL) NOPASSWD: ALL. The sudoers syntax allows specifying a group with %, a host, a runas list, and commands. The entry %webadmins web01=(ALL) NOPASSWD: ALL correctly allows group members to run any command as any user on web01 without a password prompt. This is the precise configuration needed.

Answer

%webadmins ALL=(ALL) NOPASSWD: ALL

Answer

webadmins web01=(ALL) NOPASSWD: ALL

Answer

%webadmins web01=(root) NOPASSWD: /usr/bin/apt

Question 9

A Linux administrator needs to ensure that a custom application service, implemented as a oneshot systemd unit, runs only after the network is fully online and the /data filesystem is mounted. The unit file currently has no ordering directives. Which systemd directive should be added to the [Unit] section to define these ordering dependencies?

Accepted Answer

After=network-online.target data.mount. Ordering dependencies in systemd are expressed with After= or Before=. After= ensures that the units listed are fully activated before the service starts. While Requires= or Wants= pull units into the transaction, they do not delay activation. For a oneshot service that must wait for network-online.target and data.mount, After= is the correct directive to add to the [Unit] section.

Answer

Wants=network-online.target data.mount

Answer

Requires=network-online.target data.mount

Answer

Before=network-online.target data.mount

Question 10

A junior Linux administrator needs to run a long-running backup script as the user 'backupuser' but currently has an active SSH session as 'adminuser'. The script should continue running even if the SSH session disconnects, and no output should be sent to the terminal. Which command should the administrator use?

Accepted Answer

sudo -u backupuser nohup /usr/local/bin/backup.sh > /dev/null 2>&1 &. The correct command combines sudo -u to run as backupuser, nohup to ignore hangup signals, and output redirection to /dev/null, with & to background it. This ensures the backup script continues after SSH disconnection and produces no terminal output, meeting both requirements precisely.

Answer

su backupuser -c '/usr/local/bin/backup.sh' &

Answer

screen -dmS backup sudo -u backupuser /usr/local/bin/backup.sh

Answer

at now + 0 minutes <<< 'sudo -u backupuser /usr/local/bin/backup.sh'

Question 11

A Linux administrator needs to schedule a script to run every Monday at 3:00 AM. The script is located at /usr/local/bin/backup.sh. The administrator wants to use a systemd timer instead of cron. Which pair of files is required to implement this?

Accepted Answer

A .service unit and a .timer unit. To schedule a task with systemd, you need a .timer unit that specifies the schedule using OnCalendar, and a .service unit that contains the ExecStart command. The timer activates the service at the defined times. Other unit types like .socket, .path, or .target serve different purposes and cannot replace the .service unit for executing the script.

Answer

A .service unit and a .socket unit

Answer

A .timer unit and a .path unit

Answer

A .timer unit and a .target unit

Question 12

A Linux administrator needs to schedule a backup script to run every day at 2:30 AM. The script is located at `/usr/local/bin/backup.sh` and must run as the user `backupuser`. Which entry in the crontab for `backupuser` will accomplish this?

Accepted Answer

30 2 * * * /usr/local/bin/backup.sh. The correct cron syntax for 2:30 AM daily is `30 2 * * *`. The minute field is 30, hour is 2, and the remaining fields are wildcards to indicate every day. The other options either have invalid time values or restrict execution to specific days, failing the daily requirement.

Answer

30 2 * * 1 /usr/local/bin/backup.sh

Answer

30 2 1 * * /usr/local/bin/backup.sh

Answer

2 30 * * * /usr/local/bin/backup.sh

Question 13

A Linux administrator is configuring sudo for a team of developers. The developers need to run commands as the user 'webadmin' without being prompted for a password, but only for commands located in /usr/local/bin. Which sudoers entry correctly implements this?

Accepted Answer

%developers ALL=(webadmin) NOPASSWD: /usr/local/bin/*. The sudoers entry must specify the group, the target user (webadmin), the NOPASSWD tag, and the command path with a wildcard to allow all commands in /usr/local/bin. The correct syntax uses (webadmin) and NOPASSWD: followed by the path with /*. Other options either target the wrong user, use the wrong tag, or incorrectly specify a directory without a wildcard.

Answer

%developers ALL=(ALL) NOPASSWD: /usr/local/bin/*

Answer

%developers ALL=(webadmin) PASSWD: /usr/local/bin/*

Answer

%developers ALL=(webadmin) NOPASSWD: /usr/local/bin/

Question 14

A user reports that they cannot log in to a Linux server via SSH. The administrator checks /etc/passwd and sees the user's shell is set to /sbin/nologin. What is the most likely reason for the login failure?

Accepted Answer

The user is not allowed to have an interactive shell.. The shell /sbin/nologin is designed to prevent interactive logins. When a user with this shell attempts to log in via SSH, the shell is executed and immediately exits, denying access. This is the most likely reason for the failure, as it directly matches the observed configuration.

Answer

The SSH service is not running.

Answer

The user's account is locked.

Answer

The user's password has expired.

Question 15

A Linux administrator is troubleshooting a systemd service that fails to start with the error 'Failed to start myservice.service: Unit myservice.service not found.' The service file exists at /etc/systemd/system/myservice.service and has correct permissions. Which command should the administrator run to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

systemctl daemon-reload. After editing a unit file, the administrator must run systemctl daemon-reload to make systemd aware of the changes. Then, systemctl restart myapp.service stops and starts the service with the new configuration. The other commands either do not reload the manager configuration, are invalid, or serve a different purpose such as enabling at boot.

Answer

systemctl reload myapp.service

Answer

systemctl enable myapp.service

Answer

systemctl reexec myapp.service