CompTIA CompTIA Certifications XK0-005 Questions & Answers

• Question 111:

  A user created the following script file:

  # ! /bin/bash

  # FILENAME: /home/user/ script . sh

  echo "hello world"

  exit 1

  However, when the user tried to run the script file using the command "script . sh, an error returned indicating permission was denied. Which of the follow-ing should the user execute in

  order for the script to run properly?

  A. chmod u+x /home/user/script . sh

  B. chmod 600 /home/user/script . sh

  C. chmod /home/user/script . sh

  D. chmod 0+r /horne/user/script. sh

  Correct Answer: A

  To run a script file, the user needs to have execute permission on the file. The command chmod u+x /home/user/script.sh (A) will grant execute permission to the owner of the file, which is the user who created it. The other commands will not

  give execute permission to the user, and therefore will not allow the script to run properly. References:

  [CompTIA Linux+ Study Guide], Chapter 3: Working with Files, Section: Changing File Permissions

  [How to Make a Bash Script Executable]

• Question 112:

  Which of the following will prevent non-root SSH access to a Linux server?

  A. Creating the /etc/nologin file

  B. Creating the /etc/nologin.allow file containing only a single line root

  C. Creating the /etc/nologin/login.deny file containing a single line +all

  D. Ensuring that /etc/pam.d/sshd includes account sufficient pam_nologin.so

  Correct Answer: A

  This file prevents any non-root user from logging in to the system, regardless of the authentication method. The contents of the file are displayed to the user before the login is terminated. This can be useful for system maintenance or security reasons12. References: 1: Creating the /etc/nologin File - Oracle 2: How to Restrict Log In Capabilities of Users on Ubuntu

• Question 113:

  A Linux engineer has been notified about the possible deletion of logs from the file /opt/app/logs. The engineer needs to ensure the log file can only be written into without removing previous entries.

  

  Which of the following commands would be BEST to use to accomplish this task?

  A. chattr +a /opt/app/logs

  B. chattr +d /opt/app/logs

  C. chattr +i /opt/app/logs

  D. chattr +c /opt/app/logs

  Correct Answer: A

  Explanation: The command chattr +a /opt/app/logs will ensure the log file can only be written into without removing previous entries. The chattr command is a tool for changing file attributes on Linux file systems. The +a option sets the append-only attribute, which means that the file can only be opened in append mode for writing. This prevents the file from being modified, deleted, or renamed. This is the best command to use to accomplish the task. The other options are incorrect because they either set the wrong attributes (+d, +i, or +c) or do not affect the file at all (-a). References: CompTIA Linux+ (XK0-005) Certification Study Guide, Chapter 11: Managing Files and Directories, page 357.

• Question 114:

  A Linux administrator needs to determine whether a hostname is in the DNS. Which of the following would supply the information that is needed?

  A. nslookup

  B. rsyn

  C. netstat

  D. host

  Correct Answer: A

  Explanation: The commands nslookup or host can be used to determine whether a hostname is in the DNS. The DNS is the domain name system, which is a service that translates domain names into IP addresses and vice versa. The nslookup command is a tool for querying the DNS and obtaining information about a domain name or an IP address. The host command is a similar tool that performs DNS lookups. Both commands can be used to check if a hostname is in the DNS by providing the hostname as an argument and seeing if the command returns a valid IP address or an error message. For example, the command nslookup www.google.com or host www.google.com will return the IP address of the Google website, while the command nslookup www.nosuchdomain.com or host www.nosuchdomain.com will return an error message indicating that the hostname does not exist. These commands will supply the information that is needed to determine whether a hostname is in the DNS. These are the correct commands to use for this task. The other options are incorrect because they do not query the DNS or obtain information about a hostname (rsync or netstat). References: CompTIA Linux+ (XK0-005) Certification Study Guide, Chapter 12: Managing Network Connections, page 378.

• Question 115:

  What is the main objective when using Application Control?

  A. To filter out specific content.

  B. To assist the firewall blade with handling traffic.

  C. To see what users are doing.

  D. Ensure security and privacy of information.

  Correct Answer: D

  Explanation: The main objective when using Application Control is to ensure the security and privacy of information. Application Control is a security practice that blocks or restricts unauthorized applications from executing in ways that put data at risk. The control functions vary based on the business purpose of the specific application, but the main objective is to help ensure the privacy and security of data used by and transmitted between applications1. Application Control can also prevent malware, untrusted, or unwanted applications from running on the network, reducing the risks and costs associated with data breaches1. Application Control can also improve the overall network stability and performance by eliminating unnecessary or harmful applications1. Application Control is not mainly used to filter out specific content, although it can be combined with other technologies such as URL filtering or content filtering to achieve that goal. Application Control is not mainly used to assist the firewall blade with handling traffic, although it can be integrated with firewall policies to enforce granular access rules based on applications. Application Control is not mainly used to see what users are doing, although it can provide visibility and reporting on application usage and activity.

• Question 116:

  An administrator attempts to connect to a remote server by running the following command:

  $ nmap 192.168.10.36

  Starting Nmap 7.60 ( https://nmap.org ) at 2022-03-29 20:20 UTC

  Nmap scan report for www1 (192.168.10.36)

  Host is up (0.000091s latency).

  Not shown: 979 closed ports

  PORT STATE SERVICE

  21/tcp open ftp

  22/tcp filtered ssh

  631/tcp open ipp

  Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

  Which of the following can be said about the remote server?

  A. A firewall is blocking access to the SSH server.

  B. The SSH server is not running on the remote server.

  C. The remote SSH server is using SSH protocol version 1.

  D. The SSH host key on the remote server has expired.

  Correct Answer: A

  This is because the port 22/tcp is shown as filtered by nmap, which means that nmap cannot determine whether the port is open or closed because a firewall or other device is blocking its probes. If the SSH server was not running on the remote server, the port would be shown as closed, which means that nmap received a TCP RST packet in response to its probe. If the remote SSH server was using SSH protocol version 1, the port would be shown as open, which means that nmap received a TCP SYN/ACK packet in response to its probe. If the SSH host key on the remote server had expired, the port would also be shown as open, but the SSH client would display a warning message about the host key verification failure. Therefore, the best explanation for the filtered state of the port 22/tcp is that a firewall is preventing nmap from reaching the SSH server. You can find more information about nmap port states and how to interpret them in the following web search results: Nmap scan what does STATE=filtered mean? How to find ports marked as filtered by nmap Technical Tip: NMAP scan shows ports as filtered

• Question 117:

  Due to low disk space, a Linux administrator finding and removing all log files that were modified more than 180 days ago. Which of the following commands will accomplish this task?

  A. find /var/log -type d -mtime +180 -print -exec rm {} \;

  B. find /var/log -type f -modified +180 -rm

  C. find /var/log -type f -mtime +180 -exec rm {} \

  D. find /var/log -type c -atime +180 璻emove

  Correct Answer: C

  Explanation: The command that will accomplish the task of finding and removing all log files that were modified more than 180 days ago is find /var/log -type f -mtime +180 -exec rm {} ;. This command will use find to search for files (-type f)

  under /var/log directory that have a modification time (-mtime) older than 180 days (+180). For each matching file, it will execute (-exec) the rm command to delete it, passing the file name as an argument ({}). The command will end with a

  semicolon (;), which is escaped with a backslash to prevent shell interpretation.

  The other options are not correct commands for accomplishing the task. The find /var/log - type d -mtime +180 -print -exec rm {} ; command will search for directories (-type d) instead of files, and print their names (-print) before deleting them.

  This is not what the task requires. The find /var/log -type f -modified +180 -rm command is invalid because there is no such option as -modified or -rm for find. The correct options are -mtime and -delete, respectively. The find /var/log -type c atime +180 璻emove command is also invalid because there is no such option as 璻emove for find. Moreover, it will search for character special files (-type c) instead of regular files, and use access time (-atime) instead of modification time.

  References: find(1) - Linux manual page; Find and delete files older than n days in Linux

• Question 118:

  A systems administrator notices the process list on a mission-critical server has a large number of processes that are in state "Z" and marked as "defunct." Which of the following should the administrator do in an attempt to safely remove these entries from the process list?

  A. Kill the process with PID 1.

  B. Kill the PID of the processes.

  C. Kill the parent PID of the processes.

  D. Reboot the server.

  Correct Answer: C

  Explanation: As the web search results show, processes in state Z are defunct or zombie processes, which means they have terminated but their parent process has not reaped them properly. They do not consume any resources, but they occupy a slot in the process table. To remove them from the process list, the administrator needs to kill the parent process of the zombies, which will cause them to be reaped by the init process (PID 1). Killing the zombies themselves or the init process will not have any effect, as they are already dead. Rebooting the server may work, but it is not a safe or efficient option, as it may cause unnecessary downtime or data loss for a mission-critical server.

  References Processes in a Zombie (Z) or Defunct State | Support | SUSE, paragraph 3 linux - Zombie vs Defunct processes? - Stack Overflow, answer by admirableadmin How To Kill Zombie Processes on Linux | Linux Journal, paragraph 4

• Question 119:

  Users are unable to create new files on the company's FTP server, and an administrator is troubleshooting the issue. The administrator runs the following commands:

  

  Which of the following is the cause of the issue based on the output above?

  A. The users do not have the correct permissions to create files on the FTP server.

  B. The ftpusers filesystem does not have enough space.

  C. The inodes is at full capacity and would affect file creation for users.

  D. ftpusers is mounted as read only.

  Correct Answer: C

  The cause of the issue based on the output above is C. The inodes is at full capacity and would affect file creation for users.

  An inode is a data structure that stores information about a file or directory, such as its name, size, permissions, owner, timestamps, and location on the disk. Each file or directory has a unique inode number that identifies it. The number of

  inodes on a filesystem is fixed when the filesystem is created, and it determines how many files and directories can be created on that filesystem. If the inodes are exhausted, no new files or directories can be created, even if there is enough

  disk space available. The output for the second command shows that the /ftpusers/ filesystem has 0% of inodes available, which means that all the inodes have been used up. This would prevent users from creating new files on the FTP

  server. The administrator should either delete some unused files or directories to free up some inodes, or resize the filesystem to increase the number of inodes.

  The other options are incorrect because:

  A. The users do not have the correct permissions to create files on the FTP server. This is not true, because the output for the first command shows that the /ftpusers/ filesystem has 26% of disk space available, which means that there is

  enough space for users to create files. The permissions of the files and directories are not shown in the output, but they are not relevant to the issue of inode exhaustion. B. The ftpusers filesystem does not have enough space. This is not true,

  because the output for the first command shows that the /ftpusers/ filesystem has 26% of disk space available, which means that there is enough space for users to create files. The issue is not related to disk space, but to inode capacity.

  D. ftpusers is mounted as read only.

  This is not true, because the output for the first command does not show any indication that the /ftpusers/ filesystem is mounted as read only. If it was, it would have an (ro) flag next to the mounted on column. A read only filesystem would

  prevent users from creating or modifying files on the FTP server, but it would not affect the inode usage.

• Question 120:

  An administrator deployed a Linux server that is running a web application on port 6379/tcp.

  SELinux is in enforcing mode based on organization policies.

  The port is open on the firewall.

  Users who are trying to connect to a local instance of the web application receive Error 13, Permission denied.

  The administrator ran some commands that resulted in the following output:

  

  Which of the following commands should be used to resolve the issue?

  A. semanage port -d -t http_port_t -p tcp 6379

  B. semanage port -a -t http_port_t -p tcp 6379

  C. semanage port -a http_port_t -p top 6379

  D. semanage port -l -t http_port_tcp 6379

  Correct Answer: B

  Explanation: The command semanage port -a -t http_port_t -p tcp 6379 adds a new port definition to the SELinux policy and assigns the type http_port_t to the port 6379/tcp. This allows the web application to run on this port and accept connections from users. This is the correct way to resolve the issue. The other options are incorrect because they either delete a port definition (-d), use the wrong protocol (top instead of tcp), or list the existing port definitions (-l). References: CompTIA Linux+ (XK0-005) Certification Study Guide, Chapter 18: Securing Linux Systems, page 535.