XK0-006 System Management Practice Question
A Linux administrator needs to locate all files in the /etc directory that have been modified in the last 24 hours and are not owned by root. Which two commands can be combined to achieve this? (Select TWO.)
⚠ Common exam trap
The trap is confusing -mtime with -ctime and -atime, and mixing up -user with -group — candidates must remember that -mtime is content modification, -ctime is inode change, and -atime is access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
find /etc -mtime 0 -not -user root
Option A is correct because 'find /etc -mtime 0 -not -user root' searches /etc for files whose modification time falls within the last 24 hours (-mtime 0 means modified less than 1 day ago) and excludes files owned by root via -not -user root. Option C is correct because 'find /etc -mmin -1440 -not -user root' uses -mmin -1440, which matches files modified less than 1440 minutes (24 hours) ago, and likewise filters out root-owned files with -not -user root. Option B is wrong because -ctime checks inode change time, not modification time, and -not -group root filters by group ownership rather than user ownership. Option D is wrong because -uid 0 selects files owned by root, the opposite of what is required. Option E is wrong because -atime checks access time, not modification time, so it does not identify recently modified files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
find /etc -mtime 0 -not -user root
Why this is correct
-mtime 0 matches files modified within the last 24 hours, and -not -user root excludes root-owned files, meeting both stem constraints in one pass. The -mtime test counts whole 24-hour periods, so 0 covers the current day.
- ✗
find /etc -ctime 0 -not -group root
Why it's wrong here
Uses -ctime, which filters on inode metadata change time, not content modification, so recently edited files whose metadata is older are missed; and -group root tests group ownership rather than user ownership. It would suit finding files whose permissions or ownership changed recently.
- ✓
find /etc -mmin -1440 -not -user root
Why this is correct
-mmin -1440 matches files modified less than 1440 minutes ago, equivalent to the last 24 hours, while -not -user root filters out root-owned files. Using minutes gives precise control over the 24-hour window the stem requires.
- ✗
find /etc -mtime 0 -uid 0
Why it's wrong here
-uid 0 matches files owned by root, the exact inverse of the requirement, so this returns root-owned files rather than non-root ones. It is tempting because -mtime 0 correctly captures files modified within 24 hours, and that predicate alone would be correct, but the ownership test must be negated.
- ✗
find /etc -atime 0 -not -user root
Why it's wrong here
Uses -atime, which matches last access time, not modification, so files merely read within 24 hours are wrongly included while modified-but-unread files are missed. It would be right for auditing which files have been opened recently.
Go deeper
Related to this question
Learn chapter
File Transfer and Remote Access
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
inode
An inode is a data structure in a Unix-like file system that stores metadata about a file, such as its size, permissions, and location on disk, but not its name.
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.