XK0-006 Troubleshooting Practice Question
A Linux administrator is troubleshooting a system that becomes unresponsive under heavy load. They suspect that a process is causing excessive disk I/O. Which command should the administrator use to identify the process performing the most disk writes in real time?
⚠ Common exam trap
The trap here is choosing a tool that shows disk activity but not per-process attribution, or assuming that any I/O monitoring tool provides per-process detail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iotop -o
To identify the process causing heavy disk writes in real time, the administrator needs a tool that shows per-process I/O activity. iotop -o displays only active I/O processes, sorted by I/O usage, making it easy to spot the culprit. While pidstat -d can also show per-process I/O, iotop is specifically designed for interactive real-time monitoring and is more commonly used for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
iotop -o
Why this is correct
iotop -o displays only processes that are actively performing I/O, sorted by I/O usage. It provides real-time monitoring of disk read/write bandwidth per process, making it ideal for identifying the process causing heavy disk writes. The -o option filters out idle processes, focusing on active ones.
- ✗
iostat -x 1
Why it's wrong here
iostat -x 1 shows extended disk statistics per device, including utilization and throughput, but it does not attribute I/O to specific processes. It can indicate which disk is busy, but not which process is responsible. Therefore, it does not directly identify the process causing the I/O.
- ✗
pidstat -d 1
Why it's wrong here
pidstat -d 1 reports I/O statistics per process, including disk read/write rates, and is a valid tool for this purpose. However, it is part of the sysstat package and may not be installed by default, whereas iotop is more commonly used for real-time per-process I/O monitoring. The question asks for the best command, and iotop -o is more direct and interactive.
- ✗
vmstat 1
Why it's wrong here
vmstat 1 provides system-wide statistics on processes, memory, paging, block I/O, and CPU, but it does not show per-process I/O. It can indicate overall disk activity but cannot pinpoint a specific process. Thus, it is not suitable for identifying the process performing the most disk writes.
Go deeper
Related to this question
Learn chapter
Process Management and System Monitoring
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.