mediumMultiple Choice
XK0-006 Practice Question: A Linux administrator is troubleshooting a server…
A Linux administrator is troubleshooting a server that intermittently becomes unresponsive. The administrator suspects a memory leak. Which command should be used to monitor memory usage over time and identify the consuming process?
⚠ Common exam trap
Watch out — candidates often confuse system-wide memory reporting (`free -h`) with per-process monitoring (`top`), or mistake disk usage commands (`df -h`) or network tools (`ss`) for memory diagnostics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
top
The `top` command provides a real-time, dynamic view of system processes, including memory usage (RES, VIRT, %MEM) and can be sorted by memory consumption. It updates continuously, making it ideal for monitoring memory usage over time and identifying the specific process responsible for a suspected memory leak.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
free -h
Why it's wrong here
free -h prints a single snapshot of total, used and available RAM with no per-process breakdown, so it cannot identify the leaking process over time. It is tempting as the quickest memory overview, and would be correct for confirming overall memory pressure before drilling down.
- ✓
top
Why this is correct
top refreshes periodically and sorts processes by CPU and memory, letting the administrator watch resident memory grow over time and pinpoint the leaking process by PID. It satisfies the need for continuous monitoring rather than a single snapshot, which free alone cannot provide.
- ✗
ss -tuln
Why it's wrong here
ss -tuln lists listening TCP and UDP sockets with no memory data, so it cannot track a leak. It is tempting because unresponsiveness suggests network trouble, and it would be correct for verifying which ports a service is bound to or diagnosing connection issues.
- ✗
df -h
Why it's wrong here
df reports filesystem block and inode usage, not RAM, so it cannot expose a leaking process. It is tempting because it is the standard tool for capacity checks, and would be correct when diagnosing a full disk or partition causing writes to fail.
Go deeper
Related to this question
Learn chapter
Installing Linux and Package Management
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.