XK0-006 Troubleshooting Practice Question
A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?
⚠ Common exam trap
The trap here is assuming that any command that can list network information (like nmap or ip) is a valid replacement for netstat, but only `ss` is designed as its direct successor with similar syntax and output.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ss -tlnp
The `ss` command is the modern replacement for `netstat`, providing socket statistics. The flags `-tlnp` specifically show TCP (`-t`) listening (`-l`) sockets with numeric ports (`-n`) and the process (`-p`) using them, which directly answers the administrator's need to see listening TCP ports and associated services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ss -tlnp
Why this is correct
The `ss -tlnp` command uses the `-t` flag to filter only TCP sockets, `-l` to show only listening sockets, `-n` to display numeric addresses and ports without DNS resolution, and `-p` to reveal the process identifier and name. This directly replaces `netstat -tlnp` by reading socket information from the kernel’s `/proc/net/tcp` and `/proc/net/tcp6` files, satisfying the stem’s requirement to check services listening on TCP ports.
- ✗
nmap localhost
Why it's wrong here
nmap localhost scans the local host's ports from outside the socket table, requiring the scanner to be installed and inferring listeners rather than reading them directly. It is tempting because it enumerates open ports, but it is designed for network reconnaissance, whereas ss queries the kernel's listening sockets.
- ✗
ip link show
Why it's wrong here
ip link show manages layer-2 interface state and MAC addressing; it never enumerates sockets, so no listening TCP port or owning process appears. It is tempting because iproute2 replaced netstat's interface statistics, and ip link would be right for checking link up/down or interface errors, not port listeners.
- ✗
dig -t any localhost
Why it's wrong here
dig queries DNS records, so it returns name-resolution data for localhost rather than any socket table. It is tempting because dig replaced netstat's DNS-adjacent lookups, and it would be correct for verifying A, MX or PTR records — not for identifying processes bound to TCP ports.
Go deeper
Related to this question
Learn chapter
System Services and Startup
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.