XK0-006 Practice Questions

Question 1

Refer to the exhibit. A user reports that the /var directory is not accessible. The system administrator checks the logical volumes and notices that the 'var' logical volume is not activated. Which command should be used to activate it?

Accepted Answer

lvchange -ay vg0/var. The `lvchange -ay vg0/var` command activates the specified logical volume by setting its activation flag to 'y' (yes). This is the correct way to bring an inactive LVM logical volume online so that it can be mounted and accessed.

Answer

lvextend -L+10g vg0/var

Answer

lvscan

Answer

lvcreate -a y vg0/var

Question 2

You are a Linux system administrator for a small company. You have written a BASH script that checks disk usage and sends an email alert if any partition exceeds 90% usage. The script works when run manually but does not produce alerts when run via cron. Which of the following is the most likely cause?

Accepted Answer

The cron job's PATH variable does not include the directory where the mail command is located. When a script runs manually, it inherits the user's interactive shell environment, including the PATH variable that typically includes directories like /usr/bin and /usr/local/bin where the mail command resides. However, cron jobs execute in a minimal environment with a very restricted PATH (often just /usr/bin:/bin). If the mail command is located in a directory not in cron's default PATH, such as /usr/sbin or /opt/bin, the script will fail silently when attempting to send the email, even though the disk usage check itself succeeds. This is the most common cause of scripts working manually but failing under cron.

Answer

The script has incorrect file permissions

Answer

The cron scheduler is disabled

Answer

The script uses relative paths to check partitions

Question 3

A DevOps engineer wants to reduce the size of a Docker image by combining build stages. Which Dockerfile feature should be used?

Accepted Answer

Multi-stage builds (multiple FROM statements). Multi-stage builds, implemented by using multiple FROM statements in a single Dockerfile, allow a DevOps engineer to copy only the necessary artifacts from intermediate build stages into the final image. This eliminates build-time dependencies, tools, and intermediate layers from the final image, significantly reducing its size without sacrificing build functionality.

Answer

RUN --mount=type=cache

Answer

Layer caching

Answer

Using a smaller base image like Alpine

Question 4

A system administrator runs 'umask 027' in a Bash shell. What will be the default permissions for a new directory created in that shell? (Assume no other umask changes.)

Accepted Answer

rwxr-x--- (750). The umask value 027 subtracts permissions from the base 777 for directories. 777 minus 027 equals 750, which translates to rwxr-x---. The owner gets full permissions (rwx), the group gets read and execute (r-x), and others get no permissions (---).

Answer

rwxrwxr-x (775)

Answer

rwxrwxrwx (777)

Answer

rw-rw-r-- (664)

Question 5

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Accepted Answer

Set PermitRootLogin no in /etc/ssh/sshd_config. Option D is correct because setting PermitRootLogin no in /etc/ssh/sshd_config prevents direct root logins over SSH, forcing attackers to compromise a normal user account first and eliminating the most privileged and commonly brute-forced target. Option E is correct because setting PasswordAuthentication no disables password-based authentication entirely, so only SSH key pairs are accepted, which defeats brute-force and credential-guessing attacks since keys cannot be feasibly guessed. The unmarked options do not belong: PermitRootLogin yes (A) explicitly allows direct root SSH access, the opposite of hardening; PasswordAuthentication yes (B) keeps password logins enabled and thus brute-forceable; and disabling the SSH service (C) would block legitimate remote administration rather than secure it, which is not a practical hardening action for a server that must be administered remotely.

Answer

Set PermitRootLogin yes

Answer

Set PasswordAuthentication yes

Answer

Disable the SSH service

Question 6

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

Accepted Answer

aa-enforce /etc/apparmor.d/profile. The aa-enforce command is the AppArmor userspace utility that sets a profile to enforce mode, causing the kernel to actively block operations that violate the profile. Running aa-enforce /etc/apparmor.d/profile transitions the specified profile from complain (or unconfined) to enforce. This is the standard way to harden a service after testing its profile in complain mode.

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-status --enforce /etc/apparmor.d/profile

Answer

aa-complain /etc/apparmor.d/profile

Question 7

An administrator wants to find all files larger than 100MB in the /var directory. Which command should be used?

Accepted Answer

find /var -type f -size +100M. The find command with -size +100M searches for files larger than 100 megabytes, and -type f restricts results to regular files. Running 'find /var -type f -size +100M' correctly locates all regular files under /var exceeding 100MB. This is the standard, precise way to search by size in Linux.

Answer

find /var -size +100kb

Answer

ls -l /var | grep 100M

Answer

du -sh /var/* | grep M

Question 8

A Linux engineer is troubleshooting a cron job that does not execute as expected. The crontab entry reads: '*/5 * * * * /usr/local/bin/backup.sh'. The script runs manually when executed as root. Which of the following is the most likely cause?

Accepted Answer

The script requires environment variables that are not set in cron's shell.. D is correct because cron jobs run in a minimal shell environment (typically /bin/sh) with a very limited set of environment variables. The script /usr/local/bin/backup.sh may rely on variables like PATH, HOME, or custom variables that are not set in cron's shell, causing it to fail even though it runs fine manually as root. This is a classic cron issue where the interactive shell's environment differs from cron's non-interactive environment.

Answer

The cron daemon is not running.

Answer

The script file does not have execute permissions.

Answer

The system clock is incorrect.

Question 9

A company is implementing a security policy that requires all files created in a shared directory /data to be owned by the group 'engineers' and have group read/write permissions, regardless of the user's umask. Which approach should be used?

Accepted Answer

Set the setgid bit and configure ACL default permissions on /data. Setting the setgid bit on /data ensures that new files inherit the group ownership of the directory (engineers), but it does not override the user's umask for permissions. Configuring ACL default permissions on /data explicitly sets the group read/write permissions for new files, overriding the umask. Together, they guarantee both correct group ownership and group rw permissions regardless of the user's umask.

Answer

Set the setgid bit only on /data

Answer

Set the sticky bit on /data

Answer

Configure ACL default permissions only on /data

Question 10

A web server in a remote data center logs timestamps in UTC, but the operations team wants all logs to reflect the local timezone (America/New_York). Which command changes the system timezone?

Accepted Answer

timedatectl set-timezone America/New_York. The `timedatectl set-timezone` command is the correct way to change the system timezone on a Linux system using systemd. By specifying 'America/New_York', the system will adjust all timestamps to Eastern Time, including those generated by the web server, ensuring logs reflect the local timezone.

Answer

timedatectl set-time '2025-03-01 12:00:00'

Answer

timedatectl list-timezones

Answer

timedatectl set-ntp yes

Question 11

A bash script needs to test whether a string variable $NAME is non-empty and equals 'admin'. Which of the following conditionals is correct?

Accepted Answer

if [[ -n $NAME && $NAME == 'admin' ]]; then. In bash, [[ -n $NAME ]] tests if the string is non-empty, and == compares strings. Using double brackets is safer for string comparison.

Answer

if [[ $NAME -ne '' && $NAME -eq 'admin' ]]; then

Answer

if [ $NAME != '' ] && [ $NAME == 'admin' ]; then

Answer

if [ ! -z $NAME -a $NAME = 'admin' ]; then

Question 12

A process is consuming excessive CPU and needs to be terminated immediately. The PID is 1234. Which command will terminate the process with the most forceful signal?

Accepted Answer

kill -9 1234. kill -9 (SIGKILL) forcibly terminates the process. SIGTERM (15) is graceful; SIGHUP (1) reloads config; SIGSTOP (19) suspends.

Answer

kill -15 1234

Answer

kill -1 1234

Answer

kill -19 1234

Question 13

An administrator runs the commands shown in the exhibit. The container is accessible via curl using the container IP. However, the administrator cannot access the web server using the host's IP address on port 80. What is the most likely cause?

Accepted Answer

The container's port 80 is not published to the host.. The administrator ran `docker run -d nginx` without the `-p` or `--publish` flag, which means port 80 inside the container is not mapped to any port on the host. The container is accessible via its own IP because Docker networking allows direct container-to-container communication, but the host's IP on port 80 remains unbound, so curl to the host IP fails. Publishing the port with `-p 80:80` would expose the container's port 80 on the host's interface.

Answer

The container's IP address is incorrect.

Answer

Nginx is configured to listen on a different port.

Answer

The container is not running.

Question 14

Drag and drop the steps to configure SELinux to allow a custom web application to listen on port 8080 in the correct order.

Accepted Answer

List current SELinux port mappings, then add port 8080 to http_port_t, then verify the new mapping, then restart the web service. SELinux requires adding the port to the appropriate context before the service can listen.

Answer

Add port 8080 to http_port_t, then list current mappings, then verify, then restart

Answer

List current mappings, then verify, then add port, then restart

Answer

Add port 8080 to http_port_t, then verify, then list, then restart

Question 15

Which command displays the current SELinux mode?

Accepted Answer

sestatus. The 'sestatus' command displays the current SELinux mode, including whether it is enforcing, permissive, or disabled, along with other SELinux status information.

Answer

selinuxenabled

Answer

getsebool -a

Answer

chcon

CompTIA Linux+ XK0-006 practice test

Three ways to study

Study XK0-006 by domain

Study XK0-006 by topic

Services and User Management practice questions

Automation, Orchestration, and Scripting practice questions

System Management practice questions

Security practice questions

Troubleshooting practice questions

XK0-006 fundamentals practice questions

XK0-006 scenario practice questions

XK0-006 troubleshooting practice questions

Top XK0-006 questions

CompTIA Linux+ (XK0-006) practice questions