XK0-006 System Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  find /var/log -mtime +7 -size +100M

  Why it's wrong here

  The +7 qualifier selects files modified more than seven days ago, the opposite of the requirement, so recent files are excluded entirely. It is tempting because -mtime is the correct primary predicate for modification time; the sign is simply inverted. A minus sign (-mtime -7) would correctly match files modified within the last seven days.

• ✗

  find /var/log -atime -7 -size +100M

  Why it's wrong here

  -atime filters on access time, not modification time, so files read recently but unchanged would match while genuinely modified files could be missed. It is tempting because -atime shares find's time-test syntax and looks interchangeable. Where access auditing is the goal, -atime -7 is the right predicate; here -mtime -7 is required.

• ✓

  find /var/log -mtime -7 -size +100M

  Why this is correct

  The `-mtime -7` predicate matches files modified within the last seven days, while `-size +100M` filters those exceeding 100MB, both applied to the `/var/log` path. Combining these tests with implicit AND logic satisfies the stem's dual constraints of recent modification and large size in a single traversal.

• ✗

  find /var/log -mtime -7 -size -100M

  Why it's wrong here

  The -size -100M predicate matches files smaller than 100MB, directly contradicting the larger-than-100MB requirement, so results are inverted. It is tempting because the -mtime -7 half is correct and the syntax mirrors the intended command. The plus sign (-size +100M) selects files exceeding 100MB, which is what the scenario demands.