Free XK0-005 Practice Test

In Linux iptables, the -j REJECT target is used to refuse a connection request actively. Unlike the -j DROP target, which silently drops incoming packets without sending any response to the sender, -j REJECT sends an explicit error packet (such as an ICMP destination-unreachable message or TCP RST) back to the originating IP address (2.2.2.2). This informs the sender immediately that the connection attempt was rejected by packet filtering policies. In this scenario, the administrator specifically requires the originating host to receive notification that the firewall is blocking the connection to the SSH port (--dport ssh), making -j REJECT the appropriate target command option.

A: The DROP target silently discards incoming packets, causing the originating IP address to time out without receiving an explicit firewall response notification. B: The RETURN target causes execution to stop traversing the current chain and resume at the calling chain, failing to block or respond to the connection. D: The QUEUE target passes the packet to user-space applications for inspection, rather than directly blocking the connection and returning a rejection response.

Linux man-pages project: iptables-extensions(8) man page, REJECT section.

Red Hat Enterprise Linux 8: Securing Networks, Chapter 5 "Using iptables".

A zombie process (defunct process) occurs when a child process terminates, but its parent process has not yet executed the wait() system call to read its exit status. Because zombie processes are already dead, signals cannot be delivered directly to them. To clear zombie processes, the administrator must address the parent process (PPID). Sending SIGTERM (Signal 15) requests a graceful termination of the parent process. Once the parent terminates, any remaining zombie processes become orphans and are immediately inherited by init or systemd (PID 1). PID 1 periodically executes wait(), which cleans up and removes all inherited zombie processes from the kernel process table.

B. SIGHUP (Signal 1) notifies a process of terminal disconnect or requests daemon configuration reloading, which does not guarantee process termination or orphan reaping.
C. SIGQUIT (Signal 3) instructs a process to quit and produce a core dump, which is unneeded and less suitable than standard termination via SIGTERM.
D. SIGSTOP (Signal 19) pauses process execution without terminating the parent, preventing the parent process from executing wait() to clean up zombie entries.

Bovet, D. P., & Cesati, M. "Understanding the Linux Kernel," 3rd Edition. O'Reilly Media, Chapter 3: Processes.

IEEE Std 1003.1-2017 (POSIX.1). "Signal Concepts and Process Lifecycle." The Open Group Base Specifications Issue 7.

In systemd-managed Linux environments, configuration modifications made to network interface profiles or network daemon files do not automatically alter the runtime state of active interfaces. To apply newly defined configurations, the system administrator must restart the associated management daemon. Running the systemctl restart networkd command stops the running service instance and immediately starts a fresh instance, forcing the network management daemon to re-read its configuration files from disk and reapply the updated network settings to system network interfaces without requiring a full system reboot.

B: Running systemctl enable configures the service to start automatically during system boot but does not restart or apply new settings to running daemons. C: Running systemctl status only displays runtime state and diagnostic logs of a unit without applying any configuration changes. D: Running systemctl isolate changes the active system target state to a specified target rather than reloading a network service configuration.

systemd Project Documentation, systemctl(1) Manual Page: "Service Management Commands: restart, reload".

Red Hat Enterprise Linux 8 System Administrator's Guide, Chapter 3: "Managing System Services with systemctl".

Attack surface area reduction involves minimizing the total number of exposed vulnerabilities and entry points that an attacker can exploit to gain unauthorized access. Enforcing strong password strength and complexity policies via Pluggable Authentication Modules (PAM) systematically reduces the efficacy of automated dictionary attacks, credential stuffing, and brute-force authentication vectors against local and remote user accounts. By strengthening authentication rules (e.g., minimum length, character diversity, dictionary checks), the set of viable authentication pathways available to adversaries is dramatically constrained. This directly fortifies account access controls, thereby decreasing the system's operational attack surface and securing critical administrative entry points across the Linux operating environment.

A: Customizing login banners deters unauthorized access warnings or hides software versions, but does not remove or reduce functional entry points or authentication attack vectors. B: Directory count does not intrinsically affect system exposure or network entry points, as file system layout does not define service or credential attack vectors. C: Extending SSH connection timeouts increases potential resource consumption and exposure windows to denial-of-service or slow-rate brute-force connection attempts.

NIST Special Publication 800-123, "Guide to General Server Security", Section 3.1 "Securing the Operating System".

CIS Red Hat Enterprise Linux 8 Benchmark v1.0.0, Section 5.3 "Configure PAM Password Requirements".

In Linux systems, getfacl (Get File Access Control Lists) is the utility used to view extended permissions and Access Control Lists (ACLs) assigned to files and directories. Standard Linux file permissions only allow specifying access rights for a single owner, a single group, and others. POSIX ACLs extend this model by allowing administrators to grant explicit read, write, and execute permissions to multiple specific users and groups. Running getfacl test/ displays the file name, owner, group, and all extended permission entries associated with the test/ directory, providing visibility into complex security configurations that standard permission checking utilities cannot fully reveal.

A. getsebool reports the current status of SELinux boolean settings, not directory-level Access Control Lists or extended file permissions.
B. getenforce displays the current global operating mode of SELinux (Enforcing, Permissive, or Disabled), not specific file system directory permissions.
D. ls -al test/ displays standard file permissions and an indicator (+) for ACLs, but does not detail the specific extended ACL assignments.

Red Hat Enterprise Linux Documentation. "Managing File Access Control Lists (ACLs)." Red Hat System Administrator's Guide, 2023.

Linux Man-pages Project. "getfacl(1) - get file access control lists." Linux Programmer's Manual, man7.org.

In Git version control management, developers frequently generate local configuration files, build artifacts, or secret files that should not be committed or shared publicly in source code repositories. The .gitignore file is a special text file placed in the repository root directory (or subdirectories) that specifies patterns for files and directories that Git must deliberately ignore. When code updates are published via commits and pushes, Git excludes any files matching rules defined inside .gitignore. Configuring .gitignore ensures sensitive configuration files remain on the administrator's local machine while allowing updated source code to be published cleanly. This represents standard operational best practices for maintaining code privacy and security across software deployment lifecycles.

A. git clone creates a copy of an existing remote Git repository onto a local system and does not manage file exclusion when publishing updates.
B. git - is an incomplete CLI syntax command and is not a valid Git operation or file configuration utility.
D. git fetch downloads objects and refs from another repository to update local tracking branches, rather than controlling file exclusion during code publication.

Pro Git, 2nd Edition (Scott Chacon and Ben Straub), Chapter 2: Git Basics - Ignoring Files.

Git Official Documentation, gitignore Manual Page (git-scm.com/docs/gitignore).

The docker run command initializes and starts a container from a specified image using provided configurations. The -d flag runs the container in detached mode in the background. The --restart always flag ensures the container restarts automatically upon system reboot or container exit. Port forwarding from the host OS to the container is specified via -p 5432:5432, binding host port 5432 to container port 5432. Volume mounting uses the syntax -v :, which correctly maps the host directory /home/db to /var/lib/postgresql inside the container. Combining these parameters allows the PostgreSQL service to run persistently, retain persistent database storage on the host, and accept network connections on host port 5432.

B. Option B reverses the host and container volume paths and lacks a valid restart policy argument required by the --restart flag.
C. Option C incorrectly uses --platform for port binding and combines --attach with -d, which conflict with detached operation.
D. Option D misuses --workdir instead of volume flags to bind directories and omits the mandatory restart policy for --restart.

Docker Documentation, "docker run reference", Section: "Restart policies (--restart)", "Bind mounts (-v, --mount)". https://docs.docker.com/engine/reference/commandline/run/

Red Hat Enterprise Linux 8, "Building, running, and managing containers", Section 3.2: Managing Container Lifecycle.

The tr (translate) utility reads characters from standard input and replaces or deletes them before writing the results to standard output. To convert lowercase ASCII characters to uppercase, tr requires the source character set [a-z] as its first argument and the target replacement set [A-Z] as its second argument. The syntax tr '[a-z]' '[A-Z]' properly specifies this translation mapping. Redirection operators (such as outputfile) direct standard input from testfile and standard output to uppercase. Among the provided choices, option D specifies the correct tr command syntax and character range order required to perform lowercase-to-uppercase translation across all text input.

A. tr '(A-Z}' '{a-z}' uppercase: Uses incorrect character ranges and reverses translation order, mapping uppercase characters into lowercase instead of converting lowercase to uppercase.
B. echo testfile | tr "[Z-A]" "[z-a]" uppercase: Passes only the string literal "testfile" rather than file contents, and specifies invalid reverse character ranges [Z-A] and [z-a].
C. cat testfile | tr '{z-a)' '{Z-A}' uppercase: Uses invalid reverse character ranges (z-a) and improper brace syntax, which prevents valid character translation by tr.

GNU Coreutils Manual: Section 11.2 tr: Translate characters. https://www.gnu.org/software/coreutils/manual/html_node/tr-invocation.html

IEEE Std 1003.1-2017 (POSIX.1): tr utility specification. https://pubs.opengroup.org/onlinepubs/9699919799/utilities/tr.html

Cron daemon security and user execution privileges on Linux systems are governed by the access control files cron.allow and cron.deny, typically located in /etc/. When /etc/cron.allow exists on a system, only user accounts explicitly listed within that file are permitted to submit, edit, or execute scheduled jobs via the crontab spool service. If the user cron encounters a permission denied error when accessing /var/spool/cron/crontab/cron, it indicates that user-level access to the cron subsystem is restricted. Creating the cron.allow file and adding the username cron to it explicitly authorizes the user account to access the spool directory and execute scheduled crontab jobs successfully.

B. Changing ownership of /usr/bin/crontab breaks system security permissions; crontab must remain owned by root with setuid/setgid bits intact.
C. Restarting the cron daemon does not resolve permission denied errors caused by access control restrictions on user accounts.
D. Editing another user's crontab with sudo bypasses editing restrictions once, but does not grant the cron user execution permission for running scheduled jobs.

IEEE Std 1003.1-2017 (POSIX.1-2017) Standard Shell & Utilities: crontab.

Linux man-pages project: crontab(1) - maintain crontab files for individual users.

The nslookup utility queries DNS servers directly via port 53 and bypasses local hostname resolution files such as /etc/hosts. The response "Can't find www.comptia.org: No answer" indicates that the DNS server responded successfully without an error code (NOERROR), but contained zero answer records for the requested AAAA (IPv6 address) query type. This result confirms that the DNS resolution pipeline is functioning properly, but the target domain name does not have configured IPv6 AAAA resource records. Consequently, the workstation cannot resolve an IPv6 address for the website because the remote web domain does not support IPv6 resolution.

A. nslookup queries configured DNS servers directly and ignores local entries in /etc/hosts, making the local static mapping irrelevant to DNS query results.
C. A firewall blocking HTTP/HTTPS traffic affects TCP network transport on ports 80/443, not DNS queries which returned a valid response from the DNS server.
D. The nameserver successfully responded with a valid "No answer" DNS reply, confirming the current server is reachable and functioning correctly without requiring server changes.

IETF RFC 3596: "DNS Extensions to Support IP Version 6" (https://doi.org/10.17487/RFC3596).

Red Hat Enterprise Linux 9 Networking Guide, Chapter 3: "DNS and Name Resolution Utilities".

BIND 9 Administrator Reference Manual, Section 6.2: "DNS Query Types and Resource Records".