XK0-006 Troubleshooting Practice Question
A Linux administrator notices that a production server's root filesystem is 100% full, but du reports only 40 GB used on a 100 GB partition. Which command should the administrator use to identify deleted files still held open by running processes?
⚠ Common exam trap
The trap here is assuming that df and du should always match, but deleted files held open by processes cause df to show more usage than du reports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lsof +L1
The discrepancy between df and du indicates deleted files still held open by processes. lsof +L1 specifically lists open files with a link count of zero, which are deleted files still consuming disk space. This allows the administrator to identify the process holding the file and restart it to release the space.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
fuser -mv /
Why it's wrong here
fuser -mv / shows which processes are using the root filesystem and their mount points, but it does not specifically identify deleted files with open file descriptors. It provides a list of processes accessing the filesystem, which could be numerous and not directly point to the deleted files causing the discrepancy. It is not the precise tool for finding deleted-but-open files.
- ✗
df -i
Why it's wrong here
df -i displays inode usage statistics, not block usage. While running out of inodes can cause 'no space left on device' errors, the scenario states the filesystem is 100% full in terms of bytes (40 GB used of 100 GB), which is a block allocation issue. Checking inodes would not reveal deleted files held open by processes, so it fails to address the actual problem.
- ✓
lsof +L1
Why this is correct
lsof +L1 lists all open files whose link count is less than 1, which indicates deleted files still held open by processes. This is exactly the situation where disk space is consumed but du cannot see it because the directory entry is gone. The +L1 filter is specifically designed to find these orphaned inodes, allowing the administrator to identify and restart the offending process.
- ✗
find / -size +1G -exec ls -l {} \;
Why it's wrong here
find / -size +1G locates large files on the filesystem, but deleted files held open by processes no longer have directory entries, so find cannot locate them. This command would only show existing large files, which du already accounts for. It does not address the core issue of orphaned inodes consuming space invisibly to standard directory scans.
Go deeper
Related to this question
Learn chapter
Managing Storage and File Systems
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.