XK0-006 Troubleshooting Practice Question
A system is running slowly and the administrator suspects a memory leak. Which THREE commands or tools can be used to analyze memory usage and identify processes consuming excessive memory? (Choose three.)
⚠ Common exam trap
XK0-006 often tests the distinction between memory and I/O monitoring tools, tempting candidates to choose iostat or strace for memory analysis when they are not appropriate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ps aux --sort=-%mem
Option B (ps aux --sort=-%mem) is correct because it lists all processes with their memory usage and sorts them in descending order by the %MEM column, directly revealing which processes consume the most memory. Option D (vmstat 1) is correct because it reports virtual memory statistics (swpd, free, buff, cache, si, so) every second, helping detect memory pressure and swapping indicative of a leak. Option E (free -h) is correct because it displays total, used, free, shared, buff/cache, and available memory in human-readable units, giving a quick overview of overall memory consumption. Option A (strace -p PID) is not appropriate here because strace traces system calls of a single process and does not summarize memory usage across processes. Option C (iostat -x) is incorrect because it reports extended disk I/O statistics, not memory usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
strace -p PID
Why it's wrong here
strace traces system calls made by a process, revealing file, network and signal activity rather than resident memory consumption, so it cannot identify which process is leaking memory. It is tempting because it profiles a running PID, and it would be correct for diagnosing a process stuck on a failing syscall or excessive I/O.
- ✓
ps aux --sort=-%mem
Why this is correct
`ps aux --sort=-%mem` lists every process with its resident memory percentage, sorted descending, so the heaviest consumer appears first. This directly satisfies the stem's need to identify processes consuming excessive memory, letting the administrator confirm a suspected leak by watching a process's RSS climb over successive samples.
- ✗
iostat -x
Why it's wrong here
iostat reports CPU utilisation alongside per-device disk throughput, latency and queue metrics, so it targets storage performance rather than process memory consumption. It is tempting because it is a general performance tool, and it would be correct when investigating slow disk I/O or high await times on a busy server.
- ✓
vmstat 1
Why this is correct
vmstat 1 samples memory statistics every second, showing si/so swap-in and swap-out activity alongside free memory. Sustained si/so values reveal memory pressure caused by a leak, satisfying the requirement to analyse memory usage over time.
- ✓
free -h
Why this is correct
`free -h` reports total, used, free, shared, buffered and cached memory plus swap, in human-readable units. It satisfies the scenario's need to analyse overall memory usage and confirm suspected exhaustion, though it shows no per-process detail, so it complements rather than replaces `top` or `ps` for identifying the offending process.
Go deeper
Related to this question
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.