XK0-006 Troubleshooting Practice Question
A Linux administrator notices that a server's root filesystem is filling up rapidly. After running `df -h`, the root filesystem shows 100% usage. However, when the administrator runs `du -sh /*` from the root directory, the total size is only about 40% of the filesystem. The administrator suspects that a deleted file is still being held open by a process. Which command should the administrator use to identify the process holding the deleted file?
⚠ Common exam trap
The trap here is assuming that `du` and `df` should always match, but they can differ when a process holds a deleted file open, and only `lsof +L1` directly reveals this condition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lsof +L1
The `lsof +L1` command is specifically designed to list open files with a link count less than 1, meaning they have been deleted but are still held open by a process. This is the most direct and reliable way to identify the process causing the disk space discrepancy. Other commands may show open files but do not target deleted files specifically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ls -l /proc/*/fd | grep deleted
Why it's wrong here
While this command can find deleted files held open by scanning /proc, it is not the standard or efficient method. It may miss some file descriptors or produce false positives, and it requires parsing output. The `lsof +L1` command is purpose-built for this exact scenario and provides clearer, more reliable output.
- ✗
fuser -mv /
Why it's wrong here
The `fuser -mv /` command shows which processes are using the root filesystem, but it does not specifically identify deleted files that are still open. It lists all processes with open files on that mount point, which would be overwhelming and not pinpoint the deleted file issue. It is more useful for identifying processes preventing unmount.
- ✓
lsof +L1
Why this is correct
The `lsof +L1` command lists open files with a link count less than 1, which indicates files that have been unlinked (deleted) but are still held open by a process. This directly addresses the scenario where deleted files consume space. It will show the process name and PID, allowing the administrator to restart the process and free the space.
- ✗
find / -inum 0 -print
Why it's wrong here
The `find / -inum 0 -print` command searches for files with inode number 0, which is not a valid inode for regular files and will not find deleted files held open. Deleted files retain their original inode number but have a link count of 0. This command is ineffective for the task and may produce errors or no output.
Go deeper
Related to this question
Learn chapter
File Transfer and Remote Access
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.