mediumMultiple ChoiceObjective-mapped
XK0-006 Practice Question: A server shows /dev/sda1 mounted at / is 100%…
A server shows /dev/sda1 mounted at / is 100% full in df -h, but du -sh / shows only 50% usage. What is the most likely explanation?
⚠ Common exam trap
Watch out — candidates often assume `du` and `df` should always match, and they overlook the classic Linux behavior where a file deleted while still open consumes space invisible to `du` but visible to `df`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A process is still holding a deleted file open
When a file is deleted but still held open by a running process, the file's inode remains allocated and its disk blocks are not freed until the process closes the file descriptor. The `df` command reports filesystem usage by querying the superblock for total and free blocks, so it still counts the space occupied by the deleted-but-open file. In contrast, `du` traverses the directory tree and sums the sizes of files reachable from the specified path; since the deleted file is no longer linked in the directory, `du` does not include it, leading to the discrepancy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The filesystem is corrupted
Why it's wrong here
Corruption would typically cause errors in both df and du.
- ✗
Hidden files are not counted by du
Why it's wrong here
du counts all files, including hidden, by default.
- ✓
A process is still holding a deleted file open
Why this is correct
Deleted files held open by processes continue to occupy space until the process releases them.
- ✗
The disk has many hard links
Why it's wrong here
Hard links do not consume extra disk space.
Go deeper
Related to this question
Learn chapter
Navigating the Filesystem
Key term
inode
An inode is a data structure in a Unix-like file system that stores metadata about a file, such as its size, permissions, and location on disk, but not its name.
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.