XK0-005 System Management — Timed 20 Questions

Question 1

A system administrator needs to determine which process is using the most memory on a Linux server. Which command should be used to display processes sorted by memory usage?

Accepted Answer

ps aux --sort=-%mem. Option C is correct because `ps aux --sort=-%mem` lists all processes with detailed information and sorts them by memory usage in descending order, showing the most memory-intensive process first. The `-%mem` flag specifies sorting by the %MEM column (resident set size as a percentage of total physical memory) in reverse order, which directly answers the requirement to determine which process is using the most memory.

Answer

top -o %MEM

Answer

vmstat 1 5

Answer

free -m

Question 2

A Linux system is experiencing high CPU load. The administrator runs 'top' and sees that the 'kworker' processes are consuming significant CPU time. What is the most likely cause?

Accepted Answer

A hardware interrupt storm caused by a failing disk controller. The 'kworker' processes in the 'top' output indicate kernel workqueue threads that handle deferred work. High CPU usage by kworker is typically caused by a hardware interrupt storm, often from a failing disk controller or other faulty hardware generating excessive interrupts that the kernel must service. This forces the workqueue to constantly process interrupt-related tasks, consuming significant CPU time.

Answer

A kernel module memory leak

Answer

A user process stuck in an infinite loop

Answer

Insufficient memory causing swapping

Question 3

A company requires that all systems be configured to log all authentication attempts, both successful and failed. Which configuration file and directive should be used to ensure all auth messages are logged to /var/log/secure?

Accepted Answer

In /etc/rsyslog.conf: authpriv.* /var/log/secure. In rsyslog, the `authpriv` facility covers authentication and authorization messages, including both successful and failed login attempts. The directive `authpriv.* /var/log/secure` directs all messages from this facility to `/var/log/secure`, which is the standard secure log file on RHEL/CentOS systems. This meets the requirement to log all authentication attempts.

Answer

In /etc/rsyslog.conf: *.info /var/log/secure

Answer

In /etc/rsyslog.conf: auth.* /var/log/secure

Answer

In /etc/rsyslog.conf: kern.* /var/log/secure

Question 4

An administrator needs to update the system time using an NTP server immediately without waiting for the next scheduled sync. Which command should be used?

Accepted Answer

ntpdate pool.ntp.org. The `ntpdate` command is used to immediately synchronize the system clock with an NTP server, bypassing the daemon-based scheduled sync. Option D runs `ntpdate pool.ntp.org`, which performs a one-time query and sets the time instantly, making it the correct choice for an immediate update.

Answer

timedatectl set-ntp true

Answer

systemctl start ntpd

Answer

ntpq -p

Question 5

A Linux server runs a web application that frequently runs out of file descriptors. Which configuration change would permanently increase the maximum number of open files for all users?

Accepted Answer

Edit /etc/security/limits.conf and add 'soft nofile 65536' and 'hard nofile 65536'. Option D is correct because editing /etc/security/limits.conf with both 'soft nofile' and 'hard nofile' entries permanently raises the per-user limit on open file descriptors for all users (or specified users/groups) at login. The soft limit is the current working limit, while the hard limit is the maximum ceiling; setting both ensures the user can reach the desired value without needing to run ulimit with root privileges.

Answer

Set 'fs.file-max = 65536' in /etc/sysctl.conf

Answer

Add 'session required pam_limits.so' to /etc/pam.d/login

Answer

Run 'ulimit -n 65536' in a startup script

Question 6

A system administrator needs to configure a cron job to run a script every Monday at 3:00 AM. Which two cron expressions are correct? (Select TWO).

Accepted Answer

0 3 * * 1. Option C is correct because the cron expression `0 3 * * 1` schedules the script to run at minute 0, hour 3 (3:00 AM), every day of the month (`*`), every month (`*`), and on Monday (day-of-week 1, where 0=Sunday, 1=Monday). Option E is correct because cron also accepts three-letter abbreviations for days of the week, so `Mon` is equivalent to `1`.

Answer

0 3 * * 0

Answer

0 3 1 * 1

Answer

0 3 * * 1-5

Question 7

A Linux system is experiencing kernel panics after a recent update. The administrator wants to boot into a previous kernel version to restore functionality. Which three steps are required to achieve this? (Select THREE).

Accepted Answer

After booting, edit /etc/default/grub and set GRUB_DEFAULT to the saved entry, then run update-grub. Option A is correct because after booting into a working kernel, editing /etc/default/grub to set GRUB_DEFAULT to 'saved' and running update-grub (or grub-mkconfig) ensures that the GRUB bootloader will remember and default to the last successfully booted kernel, which can be the previous version. This step is necessary to make the temporary fix persistent across reboots.

Answer

Run 'yum reinstall kernel' to revert to the previous version

Answer

Edit /etc/fstab to change root filesystem parameters

Question 8

Based on the exhibit, what is the most likely cause of the sshd service failure?

Accepted Answer

Another process is already listening on port 22. The sshd service failed because another process is already listening on port 22, which prevents sshd from binding to that port. This is indicated by the error message in the exhibit (e.g., 'bind: Address already in use'), which is a common symptom when a conflicting service or a previously running instance of sshd occupies the port. The system cannot start a new instance of sshd until the port is freed.

Answer

The firewall is blocking port 22

Answer

The sshd configuration file has incorrect permissions

Answer

The sshd service is not installed

Question 9

Based on the exhibit, the myapp service fails to start. Which troubleshooting step should be taken first?

Accepted Answer

Check that the application's configuration file exists and is readable. The exhibit shows a systemd unit file for the myapp service with `ExecStart=/usr/local/bin/myapp` and `Restart=on-failure`. The service fails to start, and the most common cause for such a failure is a missing or misconfigured application configuration file that the binary expects at launch. Option D is correct because verifying the configuration file's existence and readability is a fundamental prerequisite before investigating deeper issues like permissions or logs.

Answer

Increase the RestartSec value to allow more time for startup

Answer

Verify that /usr/local/bin/myapp has execute permission

Answer

Inspect the system journal for more detailed error messages

Question 10

A system administrator notices that a server's disk space is critically low. Which command should be used to identify the largest files or directories consuming space?

Accepted Answer

du -sh /*. Option D is correct because `du -sh /*` recursively calculates disk usage for each top-level directory and file under root, summarizing sizes in human-readable format. This directly identifies the largest space consumers, which is the stated goal. The `-s` flag provides a total per argument, and `/*` targets all immediate children of `/`.

Answer

ls -la /

Answer

fdisk -l

Answer

df -h

Question 11

A Linux server with systemd is experiencing boot issues after a recent kernel update. Which command sequence should be used to boot into the previous kernel version?

Accepted Answer

Interrupt the boot process, select 'Advanced options' in GRUB, then choose the previous kernel.. Option B is correct because GRUB (Grand Unified Bootloader) stores multiple kernel versions in its menu. By interrupting the boot process and selecting 'Advanced options for Ubuntu' (or similar), you can choose the previous kernel entry, which loads the older kernel and its associated initramfs. This is the standard method to recover from a failed kernel update on systems using systemd and GRUB.

Answer

Boot from a live CD and run 'rpm -Uvh --oldkernel' to revert the kernel.

Answer

Use 'systemctl set-default multi-user.target' and reboot.

Answer

Use 'grub2-set-default' with the previous kernel entry before rebooting.

Question 12

An administrator needs to ensure that a custom script /usr/local/bin/backup.sh runs every day at 2:00 AM and logs output to /var/log/backup.log. How should this be configured using systemd?

Accepted Answer

Create a systemd timer unit that activates a service unit, with OnCalendar=daily and the desired time.. Option C is correct because systemd timer units are the modern, recommended method for scheduling recurring tasks on Linux systems that use systemd. By creating a timer unit with `OnCalendar=daily` and specifying the desired time (e.g., `02:00:00`), the associated service unit will execute `/usr/local/bin/backup.sh` at 2:00 AM daily. The service unit can also redirect output to `/var/log/backup.log` using standard output/error directives, ensuring logging is handled natively within the systemd framework.

Answer

Use anacron with a delay of 0 and a period of 1 day.

Answer

Add a cron job with '0 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1'.

Answer

Place the script in /etc/cron.daily/ and set the time with the 'START_HOURS_RANGE' variable.

Question 13

A systems administrator wants to monitor system performance in real time. Which TWO commands can be used to display live updating information about processes, CPU, and memory usage? (Select TWO.)

Accepted Answer

top. The `top` command provides a real-time, dynamically updating view of system processes, CPU usage, and memory usage. It refreshes by default every few seconds, making it a standard tool for live performance monitoring. Similarly, `htop` is an enhanced interactive process viewer that offers a more user-friendly interface with color-coded, real-time updates on CPU, memory, and process information.

Answer

ps aux

Answer

sar -u 1 5

Answer

vmstat 1

Question 14

A Linux administrator is troubleshooting a service that fails to start. Which THREE files or commands should be checked to diagnose the issue? (Select THREE.)

Accepted Answer

journalctl -u service-name. B is correct because `journalctl -u service-name` displays the systemd journal logs specifically for that service, which includes detailed error messages, timestamps, and status changes that are essential for diagnosing why the service failed to start. This command is the primary tool for viewing service-specific logs in modern systemd-based Linux distributions.

Answer

dmesg

Answer

/etc/rc.local

Question 15

Based on the exhibit, what is the most likely cause of the sshd service failure?

Accepted Answer

The privilege separation directory /var/empty/sshd does not exist.. The error message 'Privilege separation directory /var/empty/sshd does not exist' directly indicates that the required chroot directory for the unprivileged sshd process is missing. Without this directory, sshd cannot drop privileges after authentication, causing it to fail on startup. This is a common issue after a partial installation or cleanup of OpenSSH.

Answer

The SSH configuration file has a syntax error.

Answer

The sshd PID file cannot be written.

Answer

The SSH port is already in use by another service.

Question 16

Based on the exhibit, why does the mv command fail?

Accepted Answer

SELinux is preventing the move due to file context mismatch.. Option C is correct because SELinux enforces mandatory access controls that can prevent file operations even when standard Linux permissions (DAC) allow them. When moving a file from one directory to another, SELinux checks the file context of the source and the target directory; if the context of the file does not match the expected type for the target directory (e.g., moving a file with `unconfined_u:object_r:user_home_t` into `/etc` which expects `etc_t`), the move is denied. The `mv` command fails with a 'Permission denied' error, and the denial is logged in `/var/log/audit/audit.log`.

Answer

The user has exceeded the disk quota on the /etc partition.

Answer

The /etc filesystem is mounted read-only.

Answer

The /etc directory does not have write permissions for root.

Question 17

An administrator configures a new web server with Apache and needs to ensure it starts automatically after a system reboot. The administrator runs 'systemctl enable httpd' but the service still does not start after reboot. What is the most likely reason?

Accepted Answer

The httpd service is masked, preventing it from starting.. The most likely reason the httpd service does not start after reboot despite being enabled is that it is masked. A masked service is symlinked to /dev/null, which prevents systemd from starting it even if it is enabled. The 'systemctl enable' command creates the necessary symlinks for automatic startup, but a mask overrides this by blocking the service unit entirely.

Answer

The service name is incorrect; it should be 'apache2' instead of 'httpd'.

Answer

The administrator forgot to run 'systemctl start httpd' after enabling it.

Answer

The systemd daemon needs to be reloaded with 'systemctl daemon-reload'.

Question 18

A technician needs to find out which port the SSH daemon is listening on. Which command will show this information?

Accepted Answer

ss -tlnp. The `ss -tlnp` command displays listening TCP sockets with numeric addresses and the associated process information. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` prevents DNS resolution, and `-p` reveals the PID and program name. Since SSH daemon (sshd) listens on TCP port 22 by default, this command will show the listening port and the sshd process.

Answer

lsof -i :22

Answer

nmap -p 22 localhost

Answer

netstat -i

Question 19

A systems administrator needs to ensure that a custom service runs with a specific priority on a Linux server. Which command should the administrator use to achieve this?

Accepted Answer

nice -n -10 /usr/local/bin/myservice. Option C is correct because the `nice` command adjusts the CPU scheduling priority of a process at launch time. Using `nice -n -10` sets a higher priority (lower nice value) for the new service, ensuring it runs with the specified priority from the start. This directly meets the requirement to run a custom service with a specific priority.

Answer

renice -10 -p 1234

Answer

ionice -c 2 -n 0 -p 1234

Answer

chrt -r 99 /usr/local/bin/myservice

Question 20

A server is experiencing intermittent high load. The administrator suspects a memory leak in a service. Which sysfs file should the administrator monitor to track memory usage per cgroup?

Accepted Answer

/sys/fs/cgroup/memory/memory.usage_in_bytes. Option C is correct because memory.usage_in_bytes in the cgroup v1 memory hierarchy shows the current memory consumption of processes within a specific cgroup, making it the direct metric to monitor for a suspected memory leak in a service. Unlike system-wide files, this per-cgroup file reflects only the memory used by the service's control group, allowing precise tracking of growth over time.

Answer

/sys/fs/cgroup/memory/memory.limit_in_bytes

Answer

/proc/meminfo

Answer

/sys/fs/cgroup/memory/memory.stat