XK0-006 Troubleshooting Practice Question
A Linux administrator needs to check which services are listening on TCP port 22. Which command should be used?
⚠ Common exam trap
XK0-006 often tests the confusion between network diagnostic tools (ping, traceroute) and socket inspection tools (ss, netstat, lsof) — candidates must recognize that only ss/netstat/lsof can show listening services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ss -tlnp | grep :22
The 'ss' command (socket statistics) with the -tlnp flags lists TCP (-t) listening (-l) sockets with numeric ports (-n) and the owning process (-p). Piping to grep :22 filters for port 22, showing which service is listening on SSH. This is the modern replacement for netstat and is available on all current Linux distributions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ss -tlnp | grep :22
Why this is correct
ss -tlnp lists TCP sockets in listening state with numeric ports and the owning process, and the grep filter narrows output to port 22. This satisfies the stem's constraint of identifying services listening on TCP 22, showing the sshd process bound to that port.
- ✗
ping -p 22 localhost
Why it's wrong here
ping sends ICMP echo requests and its -p flag specifies a payload pattern, not a port, so it never inspects TCP listeners. Ping is for reachability testing; enumerating listening sockets requires ss -tlnp or netstat -tlnp, which read the kernel's socket table.
- ✗
ip addr show port 22
Why it's wrong here
ip addr show manages interface addresses and accepts no port argument, so the command errors rather than listing listeners. It is the right tool for inspecting IP configuration; identifying processes bound to TCP port 22 needs ss -tlnp or netstat -tlnp.
- ✗
traceroute -p 22 localhost
Why it's wrong here
traceroute maps the network path to a host using UDP or ICMP probes, and -p sets the destination port of those probes, not local listeners. It diagnoses routing; checking which service listens on port 22 requires ss -tlnp or netstat -tlnp.
Go deeper
Related to this question
Learn chapter
System Services and Startup
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.