hardMultiple Choice
XK0-006 Practice Question: A container started with the above Compose…
Exhibit
Refer to the exhibit.
Exhibit:
{
"compose": {
"version": "3.8",
"services": {
"app": {
"image": "myapp:latest",
"cap_add": ["NET_ADMIN"],
"cap_drop": ["ALL"]
}
}
}
}A container started with the above Compose configuration fails to set the system time (clock_settime syscall). Which additional capability is required?
⚠ Common exam trap
CompTIA often tests the distinction between `SYS_TIME` and the non-existent `SYS_CLOCK` to trap candidates who assume a capability name must match the syscall name exactly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYS_TIME
The `clock_settime` syscall requires the `SYS_TIME` capability to modify the system clock. In Docker Compose, capabilities are added via the `cap_add` directive, and without `SYS_TIME`, the container lacks the privilege to change the system time, resulting in a failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SYS_NICE
Why it's wrong here
SYS_NICE governs process priority and scheduling adjustments, not the system clock, so clock_settime still fails. The required capability is CAP_SYS_TIME. SYS_NICE would be correct when a container must raise its own scheduling priority or nice value for latency-sensitive workloads.
- ✓
SYS_TIME
Why this is correct
SYS_TIME grants the clock_settime syscall directly, satisfying the container's need to set system time. Docker's default capability set excludes it, so the Compose service must add it explicitly. Unlike SYS_ADMIN, which is broader, SYS_TIME targets only time-setting operations, matching the stem's specific failure.
- ✗
SYS_RESOURCE
Why it's wrong here
SYS_RESOURCE controls resource limits such as setrlimit and memory overcommit, it has no bearing on clock_settime. CAP_SYS_TIME is the capability that permits setting the system clock. SYS_RESOURCE suits containers needing to adjust their own resource ceilings at runtime.
- ✗
SYS_CLOCK
Why it's wrong here
SYS_CLOCK does not exist in the Linux capability set; the capability governing clock_settime is CAP_SYS_TIME. SYS_NICE, SYS_RESOURCE and similar names tempt because they follow the CAP_SYS_ prefix pattern, but no SYS_CLOCK capability is defined, so adding it changes nothing.
Go deeper
Related to this question
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.