XK0-006 Troubleshooting Practice Question
A Linux server's root filesystem was accidentally filled to 100% capacity by runaway application logs. After the administrator deletes several large log files with rm, df -h still reports the filesystem at 100% usage. Which command should the administrator use to identify the process that is holding these deleted files open?
⚠ Common exam trap
The trap here is assuming that deleting a file immediately frees disk space, when in fact the space remains allocated until all file descriptors referencing it are closed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lsof +L1
The correct tool is lsof +L1, which specifically lists open files with a link count less than one, indicating deleted files still held open by a process. In this scenario, the deleted log files are still consuming disk space because a process has them open. Identifying and restarting that process will release the space, resolving the 100% usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
df -i
Why it's wrong here
df -i displays inode usage rather than block usage. While running out of inodes can cause 'No space left on device' errors, this scenario is about block space being consumed by deleted but open files. Checking inodes will not reveal the process holding the deleted files.
- ✗
fuser -m /
Why it's wrong here
fuser -m / lists processes that have the root filesystem mounted or are using it, but it does not specifically show deleted files held open. It may show many processes and not pinpoint the one holding deleted logs. It is not the correct tool for identifying deleted open files.
- ✗
du -sh /var/log
Why it's wrong here
du -sh /var/log shows the disk usage of the /var/log directory based on directory entries. Since the files have been deleted, they no longer appear in the directory, so du will not account for the space still held open by the process. It cannot identify which process is holding the deleted files.
- ✓
lsof +L1
Why this is correct
lsof +L1 lists all open files that have a link count less than 1, which indicates deleted files still held open by a process. This directly identifies the process preventing space from being reclaimed, allowing the administrator to restart or kill it to free the space. It is the precise tool for this scenario.
Visual reference
Go deeper
Related to this question
Learn chapter
Process Management and System Monitoring
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.