View Full CompTIA XK0-006 Exam Dumps and Practice Test Dumps.

 

Question 381

Which command can display the current status of a systemd-managed service?

1. service-check
2. systemctl status
3. systemd-status
4. statusctl

Correct Answer: 2

Explanation

The systemctl status command shows the current state of a systemd-managed service. It can display whether the service is active, inactive, failed, or running, along with recent log messages and the process ID. This makes it useful during service troubleshooting. Administrators should check the status before restarting or changing a service because the output may reveal the actual reason for failure. Combining service status with journalctl often provides additional details about configuration or dependency problems.

Question 382

Which command can prevent a systemd service from being started manually or automatically?

1. systemctl disable
2. systemctl block
3. systemctl mask
4. systemctl lock

Correct Answer: 3

Explanation

systemctl mask prevents a systemd unit from being started because it creates a link to /dev/null. This is stronger than simply disabling a service. A disabled service may still be started manually or by another dependency, while a masked service cannot normally be started until it is unmasked. Masking can be useful when an administrator needs to ensure that a problematic or unwanted service cannot run. Administrators should understand the service dependencies before applying a mask.

Question 383

Which command reverses a systemd service mask?

1. systemctl unmask
2. systemctl enable
3. systemctl unlock
4. systemctl release

Correct Answer: 1

Explanation

The systemctl unmask command removes a systemd service mask. After unmasking, the service can normally be started again, assuming its configuration and dependencies are valid. Unmasking does not automatically enable the service at boot, so administrators may need to separately use systemctl enable when automatic startup is required. This distinction is important when restoring a service after troubleshooting. Administrators should check the service status after unmasking to confirm its current state.

Question 384

Which command reloads systemd unit files after an administrator creates or changes a service unit?

1. systemctl refresh
2. systemctl reload-system
3. systemctl daemon-reload
4. systemctl reread

Correct Answer: 3

Explanation

systemctl daemon-reload tells systemd to reload its unit configuration files. It is commonly required after creating or modifying a service unit file. This command does not restart the service itself. If the service needs to use the new configuration immediately, the administrator may need to restart or reload the service separately. Understanding this difference prevents confusion when a configuration file has been changed but the running service continues using its previous settings.

Question 385

Which file contains account information such as usernames, user IDs, and home directories on a typical Linux system?

1. /etc/passwd
2. /etc/users
3. /var/accounts
4. /etc/login.conf

Correct Answer: 1

Explanation

The /etc/passwd file contains basic information about local user accounts. Typical fields include the username, user ID, primary group ID, home directory, and login shell. On modern Linux systems, password hashes are normally stored separately in /etc/shadow for better security. Administrators may inspect /etc/passwd when troubleshooting account or login problems. Changes to account files should be made carefully because incorrect entries can prevent users from logging in correctly.

Question 386

Which command can lock a user’s password so that password-based login is disabled?

1. passwd -l
2. userlock
3. usermod –stop
4. loginctl lock-user

Correct Answer: 1

Explanation

The passwd -l command locks a user’s password by modifying the password information so that the password cannot be used for normal authentication. This can be useful when temporarily disabling an account without deleting it. Locking a password does not necessarily disable every possible authentication method, such as an existing SSH key, depending on the system configuration. Administrators should therefore consider all authentication methods when completely restricting access to an account.

Question 387

Which command can show when a user’s password expires and other password-aging information?

1. passwd –status
2. chage -l
3. userage
4. account-info

Correct Answer: 2

Explanation

The chage -l command displays password-aging information for a user. It can show the last password change, minimum and maximum password age, warning period, and account expiration information. This is useful when troubleshooting login failures caused by expired passwords or account policies. Administrators can use the information to determine whether the user needs to change a password or whether an account has reached an expiration date. Password-aging settings should follow the organization’s security requirements.

Question 388

Which authentication framework provides a common interface for applications to use different authentication methods on Linux?

1. PAM
2. GRUB
3. LVM
4. SELinux

Correct Answer: 1

Explanation

PAM, or Pluggable Authentication Modules, provides a common authentication framework used by many Linux applications and services. It allows administrators to configure authentication-related behavior without changing every application individually. PAM can support password policies, account restrictions, session handling, and other authentication functions. Because PAM configuration directly affects user access, administrators should make changes carefully and test them properly. A bad PAM configuration can potentially prevent users, including administrators, from logging in.

Question 389

Which security technology provides mandatory access control through security labels and policies on many Linux systems?

1. ACL
2. SELinux
3. SSH
4. sudo

Correct Answer: 2

Explanation

SELinux provides mandatory access control using security contexts and policy rules. Unlike traditional Linux permissions, SELinux can restrict what a process is allowed to access even when normal file permissions appear to allow access. This provides an additional security layer for services and applications. When troubleshooting SELinux-related access problems, administrators should examine security contexts and audit messages instead of immediately disabling SELinux. Correctly adjusting policy or contexts is generally safer than removing the security control.

Question 390

Which command can display the current SELinux enforcement mode?

1. selinux-mode
2. getenforce
3. sestatus-mode
4. security-status

Correct Answer: 2

Explanation

The getenforce command displays the current SELinux mode. The result is normally Enforcing, Permissive, or Disabled. In enforcing mode, SELinux policy violations are blocked. In permissive mode, violations are logged but generally not blocked. This command is useful when troubleshooting applications that unexpectedly receive permission errors. Administrators should not disable SELinux simply because an application fails; they should first investigate the security context, policy, and relevant audit logs.

Question 391

Which command can display the AppArmor profiles currently loaded on a Linux system?

1. apparmor-status
2. aa-show-status
3. app-profile-list
4. security-profiles

Correct Answer: 1

Explanation

apparmor-status displays information about loaded AppArmor profiles and their current states. AppArmor uses application-specific security profiles to control what programs are allowed to access. This can help administrators determine whether an application is being restricted by AppArmor. When troubleshooting access problems, administrators should review the relevant profile and logs before disabling the security mechanism. AppArmor and SELinux use different approaches, so the troubleshooting commands and configuration methods also differ.

Question 392

Which command can list the active nftables firewall ruleset?

1. nft show firewall
2. nft list ruleset
3. firewallctl list
4. iptables-nft status

Correct Answer: 2

Explanation

The nft list ruleset command displays the active nftables ruleset. It is useful when troubleshooting firewall behavior because administrators can inspect tables, chains, and rules that are currently configured. If traffic is unexpectedly blocked or allowed, reviewing the actual ruleset can help identify the relevant rule. Administrators should understand rule order and chain behavior before making changes. Firewall troubleshooting should also consider network routes, service listeners, and application-level configuration.

Question 393

Which command can test whether a remote TCP port is reachable without requiring a full application client?

1. nc
2. tcp-test
3. portping
4. socketcheck

Correct Answer: 1

Explanation

The nc command, commonly called netcat, can be used to test TCP or UDP connectivity. For example, it can attempt a connection to a specific host and port to determine whether network traffic can reach that destination. This can help separate network connectivity problems from application-specific problems. If the port is reachable but the application still fails, the administrator can focus on the application or protocol. Firewall rules, routing, DNS, and service listeners should also be checked.

Question 394

Which command can resolve a hostname using the system’s configured name-service sources?

1. host
2. getent hosts
3. resolve-system
4. nameservice

Correct Answer: 2

Explanation

getent hosts queries the system’s configured name-service mechanisms to resolve host information. This can be more useful for troubleshooting than using a DNS-only utility because it follows the system’s configured name-resolution sources, which may include DNS, /etc/hosts, and other mechanisms depending on the configuration. If an application cannot resolve a hostname, administrators can compare getent results with tools such as dig to determine whether the issue is DNS-specific or related to the system’s name-service configuration.

Question 395

Which file controls the order of hostname lookup sources on many Linux systems?

1. /etc/resolv.conf
2. /etc/hosts
3. /etc/nsswitch.conf
4. /etc/nameorder

Correct Answer: 3

Explanation

The /etc/nsswitch.conf file controls how several types of system information are resolved, including hostname lookup. For example, the hosts entry can determine whether the system checks /etc/hosts, DNS, or other sources and in what order. This is important when troubleshooting cases where a hostname resolves differently depending on the tool used. /etc/resolv.conf mainly provides resolver configuration such as DNS servers, while /etc/nsswitch.conf determines the broader lookup mechanism.

Question 396

Which Git command downloads changes from a remote repository without automatically merging them into the current branch?

1. git update
2. git fetch
3. git download
4. git sync

Correct Answer: 2

Explanation

git fetch downloads new commits, branches, and other references from a remote repository without automatically merging those changes into the current working branch. This gives administrators and developers an opportunity to inspect incoming changes before integrating them. It is useful in controlled workflows where changes should be reviewed before merging. After fetching, commands such as git log, git diff, or a merge operation can be used to examine and integrate the new work.

Question 397

Which Ansible option allows an administrator to preview what changes a playbook would make without applying them?

1. –dry-run
2. –check
3. –preview
4. –test-only

Correct Answer: 2

Explanation

The Ansible –check option runs a playbook in check mode so administrators can preview many potential changes without actually applying them. This is useful before making configuration changes across multiple systems. Check mode does not perfectly simulate every module or situation, so the output should still be reviewed carefully. It is especially helpful when combined with version-controlled playbooks and testing environments. Administrators should validate important changes before applying them to production systems.

Question 398

What is the main purpose of an Ansible handler?

1. To store encrypted passwords
2. To run an action when notified by a task
3. To create inventory files
4. To install Ansible itself

Correct Answer: 2

Explanation

An Ansible handler performs an action when it is notified by another task, usually after a configuration change. A common example is restarting or reloading a service only when its configuration file has actually changed. This avoids unnecessary service restarts on every playbook run. Handlers support clean and efficient automation and work well with idempotent playbooks. Administrators should use handlers for actions that should happen as a result of specific changes rather than running them unconditionally.

Question 399

Which container file is commonly used to define instructions for building a Docker image?

1. Containerfile
2. Dockerfile
3. Imagefile
4. DockerConfig

Correct Answer: 2

Explanation

A Dockerfile contains instructions used to build a Docker image. It can specify a base image, install packages, copy application files, define environment settings, expose ports, and specify the command used when a container starts. Keeping Dockerfiles simple and using trusted base images can improve security and maintainability. Administrators should avoid placing sensitive credentials directly inside Dockerfiles because image layers may preserve information even after files are removed in later steps.

Question 400

Which Kubernetes object is designed to store sensitive information such as passwords or API tokens?

1. ConfigMap
2. Service
3. Secret
4. Deployment

Correct Answer: 3

Explanation

A Kubernetes Secret is designed to hold sensitive data such as passwords, tokens, and keys. A ConfigMap is intended for non-sensitive configuration data. Although Kubernetes Secrets provide a dedicated mechanism for sensitive values, administrators should still use appropriate access controls and understand how secrets are stored and protected in their cluster. Applications can consume Secrets through environment variables or mounted files. Proper RBAC permissions are important so that only authorized workloads and users can access sensitive information.