Medium XK0-006 practice questions

You need to add a new vendor package repository to a RHEL 9 server so that packages from it are permanently available to dnf. The vendor provides a repository at https://repo.vendor.example/rhel9/. Which command adds this repository persistently to the system's dnf configuration?

You added a new administrator, jsmith, to the 'wheel' group with 'usermod -aG wheel jsmith' on a RHEL 9 system where wheel is granted sudo access via /etc/sudoers. jsmith is currently logged in via SSH but reports that 'sudo' commands still fail with a 'not in sudoers' error. What is the most likely reason and correct action?

An Ansible playbook runs as the unprivileged user 'deploy' via SSH. One task must install a package with the 'dnf' module, which requires root. The playbook connection succeeds, but the package task fails with a permissions error. Which change to the failing task correctly escalates privileges to root using sudo?

Before applying a large Ansible playbook to 40 production web servers, a DevOps engineer wants to preview exactly which tasks would report a change without actually modifying any managed node. Which ansible-playbook invocation accomplishes this dry run?

You are writing an Ansible playbook that installs the Apache web server on a mixed fleet of servers. RHEL-based hosts need the 'httpd' package while Debian-based hosts need 'apache2'. You want a single task that installs the correct package based on the target host's distribution, using facts automatically collected at the start of the play. Which conditional expression should you attach to the install task?

You are writing an Ansible playbook that deploys an updated Nginx configuration file with the 'template' module. Nginx should only be restarted when the configuration file actually changes, not on every playbook run. Which approach correctly implements this behavior?

An Ansible playbook manages a fleet of web servers. A team member added a task that runs a shell command to regenerate a config cache. Every playbook run reports this task as 'changed', even when nothing was actually modified, which triggers an unnecessary handler that restarts the web service. Which approach BEST makes this task idempotent so it only reports 'changed' when the cache is truly rebuilt?

You maintain an Ansible playbook that deploys a web application. The playbook references a variables file, group_vars/prod/secrets.yml, containing a database password in plaintext. Your security team requires that this file be encrypted at rest in the Git repository but still usable during automated playbook runs. Which approach meets these requirements?

An application confined by AppArmor on an Ubuntu server is being denied access to a legitimate log directory, and users report failures. You need to temporarily allow the application to run while logging what it attempts to access, without fully disabling AppArmor protection for other profiles. Which command accomplishes this for the profile named /usr/sbin/myapp?

A database administrator runs a legacy application that only works with a specific version of the 'libmariadb3' package on a Debian-based server. During routine 'apt upgrade' operations, the package keeps getting updated, breaking the application. Which command should be used to prevent this specific package from being upgraded while allowing all other packages to update normally?

After a suspected brute-force attempt, a security analyst must produce a summary report of all failed authentication events recorded by the Linux audit daemon on a RHEL 9 server. The analyst wants a high-level tally rather than raw event records. Which command produces this summary?

A security analyst configured an audit rule with the key 'passwd-changes' to monitor modifications to /etc/passwd. After a suspected unauthorized change, they need to review only the audit events associated with that rule from the audit logs. Which command should they run?

During a CIS-style security baseline review, you must produce a list of all files on the root filesystem that have the setuid bit set, so the security team can verify each one against an approved allowlist. The scan must not descend into other mounted filesystems. Which command accomplishes this?

A systems administrator is writing a Bash maintenance script that accepts a single argument ($1) representing an action: 'start', 'stop', or 'restart'. Any other value should print an error and exit with status 1. The administrator wants the cleanest, most readable construct that matches the argument against these fixed string patterns. Which snippet correctly implements this behavior?

A colleague wrote a Bash script with a function that computes a value and stores it in a variable named 'result'. After the function runs, the main script uses '$result' but keeps getting the wrong value because an unrelated global variable also named 'result' is being overwritten by the function. What is the BEST way to fix the function so it does not clobber the global variable while still returning its computed value to the caller?

You are writing a provisioning script that must create an application config file. The file needs to embed the value of the shell variable $APP_PORT while writing multiple lines to /etc/myapp/app.conf in a single command. Which construct correctly writes the block, with variable expansion, to the file?

A backup script must process a list of directory paths, some of which contain spaces (e.g., '/data/project files'). The current code fails, treating each word as a separate item: ```bash DIRS="/data/project files /var/log /srv/web root" for d in $DIRS; do tar -czf "/backup/$(basename "$d").tgz" "$d" done ``` Which change correctly handles paths containing spaces?

A DevOps engineer writes a Bash script that must process a list of hostnames from a file called servers.txt. For each host, it should attempt an SSH connection test and print 'UP' only if the connection succeeds. The current loop always prints 'UP' regardless of connectivity: while read host; do ssh -o ConnectTimeout=5 "$host" exit echo "$host UP" done < servers.txt Which modification correctly prints 'UP' only when the SSH command succeeds?

A backup script must use the value of the environment variable BACKUP_DIR if it is set, but fall back to /var/backups if the variable is unset or empty, without permanently assigning the variable. Which line accomplishes this correctly?

You are writing a deployment script that accepts a variable number of hostnames as command-line arguments. After processing the first argument (a flag like --restart), you want to loop through the remaining arguments as hostnames. Which construct correctly removes the first positional parameter so that $@ contains only the remaining hostnames?

A DevOps engineer needs a Bash script to process a file named servers.txt that contains one hostname per line, including some lines with embedded spaces and trailing whitespace. Each hostname must be read exactly as written and passed to a ping check. Which loop construct correctly reads the file line by line while preserving leading/trailing whitespace and avoiding word splitting?

A deployment script silently continues after a failed command in the middle of a pipeline, leaving the system in an inconsistent state. A colleague reports that even when a step like 'curl ... | tar xz' fails at the curl stage, the script still exits 0 and proceeds. You want the script to abort immediately on any command failure, including failures anywhere in a pipeline, and treat unset variables as errors. Which line should you add near the top of the script?

A backup script creates a temporary working directory with mktemp -d and stores its path in the variable WORKDIR. The script may exit at several points due to errors, and each early exit currently leaves behind orphaned temp directories in /tmp. You must guarantee the temp directory is removed whenever the script terminates, regardless of how it exits. Which line should you add near the top of the script?

You are writing a deployment script that must pause until a backend service responds successfully to a health check before continuing. The command 'curl -sf http://localhost:8080/health' returns exit status 0 when the service is healthy and non-zero otherwise. You want the script to keep retrying (with a 2-second pause between attempts) and only proceed once the check succeeds. Which loop construct correctly accomplishes this?

You administer a BIND9 authoritative DNS server for the zone example.com. After adding a new A record to /var/named/example.com.zone and incrementing the SOA serial number, remote resolvers and secondary name servers still return the old data. The service is running and no errors appear in the journal. Which command should you run to have the primary server reload the updated zone file without restarting the entire daemon?