XK0-006 Troubleshooting Practice Question
A technician suspects a process is leaking file descriptors. Which command can be used to list open files associated with a specific PID?
⚠ Common exam trap
Many exam-takers confuse process-monitoring tools (top) or syscall tracers (strace, ltrace) with file-descriptor inspection tools; candidates must remember that only lsof enumerates open files by PID.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lsof -p PID
The lsof (list open files) command with the -p flag filters output to show all open files associated with a specific process ID. Since Linux treats file descriptors as open files (including sockets, pipes, and regular files), lsof -p PID is the canonical tool for diagnosing file descriptor leaks by revealing exactly what a process has open.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
top -p PID
Why it's wrong here
top shows CPU, memory and process statistics, not the file descriptors a PID holds open. It is tempting because -p PID targets one process, but that flag filters display, not descriptor listing; lsof -p PID performs the required task.
- ✗
strace -p PID
Why it's wrong here
strace traces system calls a process makes, showing open() calls as they happen, but it does not enumerate currently open descriptors. It is tempting because it inspects a running PID, yet lsof -p PID lists the open files directly.
- ✗
ltrace -p PID
Why it's wrong here
ltrace traces library calls made by a process, not its open file descriptors, so it cannot reveal the leak. It is tempting because it does attach to a PID and expose runtime behaviour, and would be the right tool for diagnosing which shared library calls a process makes or where it stalls.
- ✓
lsof -p PID
Why this is correct
lsof lists open files, and the -p flag restricts output to the specified process ID, directly exposing the file descriptors that process holds. This satisfies the stem's constraint of listing open files tied to a specific PID, revealing leaked descriptors such as unclosed sockets or handles.
Go deeper
Related to this question
Learn chapter
Process Management and System Monitoring
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
Output
In IT service management, output is the result or deliverable produced by a process, system, or component, such as data, reports, or services delivered to a customer.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.