CompTIA Linux+ XK0-005 (XK0-005) — Questions 1–75

Why this answer

How to eliminate wrong answers

Option B is wrong because `apt-get update` only refreshes the package repository metadata, not the runtime linker cache; it does not fix missing shared library references. Option C is wrong because the error is a missing library dependency, not a corrupted Samba binary; reinstalling Samba would not resolve the underlying library path issue. Option D is wrong because the service is already failing to start due to the library error; restarting it without fixing the library path will produce the same error.

Why this answer

How to eliminate wrong answers

Option A is wrong because exceeding the pod's memory limit causes an OOMKill (Out of Memory Kill) error, not ImagePullBackOff; the pod would be terminated with a CrashLoopBackOff or OOM status. Option B is wrong because a container port already in use results in a port conflict error during pod startup, typically manifesting as a 'port already allocated' or 'bind: address already in use' error, not an image pull failure. Option C is wrong because a node running out of disk space leads to an EvictionThreshold or ImageGCFailure, which may prevent pod scheduling or cause pod eviction, but the specific error for image pull failures due to disk space is usually 'ImagePullBackOff' only if the image cannot be downloaded, though the primary symptom of disk pressure is node-level eviction, not a registry-related pull error.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `badblocks` scans for physical bad sectors on the disk, not filesystem metadata corruption; it does not repair filesystem inconsistencies. Option C is wrong because `xfs_repair` is used for XFS filesystems, but /dev/sda2 is likely an ext4 filesystem (common on Linux) and the question does not specify XFS; using the wrong repair tool can cause further damage. Option D is wrong because `mount -o remount,ro /` only remounts the root filesystem as read-only to prevent further writes, but it does not repair the underlying filesystem corruption.

Why this answer

How to eliminate wrong answers

Option B is wrong because `user ALL=(ALL) !ALL` uses the negation operator `!` to deny all commands, effectively preventing the user from running any command via sudo. Option C is wrong because `user ALL=(ALL) PASSWD: ALL` explicitly requires a password (the default behavior), so the user would still be prompted for a password. Option D is wrong because `user ALL=(ALL) ALL` is the standard sudoers entry that allows all commands but still requires the user to enter their own password (unless the `NOPASSWD` tag is present).

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `which package` is not a POSIX-standard command and its behavior can vary across distributions; it may not be installed by default or may produce different exit codes, reducing portability. Option C is wrong because `dpkg -l package` is specific to Debian-based distributions (e.g., Ubuntu) and will fail or be unavailable on Red Hat-based or other distributions. Option D is wrong because `rpm -q package` is specific to Red Hat-based distributions (e.g., CentOS, Fedora) and will not work on Debian-based or other package management systems.

Why this answer

How to eliminate wrong answers

Option B is wrong because `aa-enforce` activates enforcement mode, which actively blocks denied actions and logs them, not allowing all actions as required. Option C is wrong because `aa-disable` completely disables the AppArmor profile, removing all logging and access controls, which does not meet the requirement to log denials. Option D is wrong because `aa-status` only displays the current status of AppArmor profiles (e.g., which are in enforce or complain mode) and does not change the profile mode.

Why this answer

How to eliminate wrong answers

Option A is wrong because httpd_can_network_connect controls network access, not file write permissions to /var/log. Option B is wrong because changing file ownership to apache does not affect SELinux type enforcement; the AVC denial is based on the file's SELinux context (var_log_t), not its Unix owner. Option C is wrong because chcon makes a non-persistent context change that will be lost after a file system relabel or restorecon operation; it does not create a default rule in the SELinux policy.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because if the port mapping were incorrect, the container would still be running but inaccessible on the specified host port; the error would be 'connection timeout' or 'no route to host', not 'connection refused'. Option C is wrong because an incompatible base image would cause a build failure or runtime crash, not a clean exit with a 'connection refused' error. Option D is wrong because incorrect CMD syntax would cause a build error or a container that fails to start, not one that runs and then exits immediately.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the rule does not specify a particular file path; it monitors the open syscall system-wide, not on a specific file. Option B is wrong because the rule uses `uid>=1000`, which excludes the root user (UID 0) from being monitored; root's open syscalls are not captured. Option D is wrong because the rule includes users with UID 1000 or higher, not excludes them; the `>=` operator means 'greater than or equal to', so it matches those UIDs.

Why this answer

How to eliminate wrong answers

Option A is wrong because filesystem corruption typically causes inconsistent or erroneous output from both `df` and `du`, not a consistent discrepancy where `df` shows 100% and `du` shows 50%; corruption would likely produce errors or unmountable filesystems. Option B is wrong because `du -sh /` by default counts all files, including hidden files (those starting with a dot), as it traverses the entire directory tree; hidden files are not excluded unless specific exclusions are used. Option D is wrong because hard links do not consume additional disk space beyond the original inode; `du` counts the file's size once per inode, and `df` reports total allocated blocks, so hard links would not cause a 50% discrepancy between the two commands.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `exec-opts` is used to pass options to the container runtime (e.g., native.cgroupdriver=systemd), not to configure registry security. Option C is wrong because `storage-driver` defines the storage backend (e.g., overlay2, aufs) for container layers, not registry TLS settings. Option D is wrong because `log-driver` configures the logging driver for containers (e.g., json-file, syslog), and has no role in registry TLS enforcement.

Why this answer

How to eliminate wrong answers

Option A is wrong because `forking` is used for daemons that fork into the background after startup, and systemd tracks the parent process; a one-time script that exits does not fork, so this type is inappropriate. Option B is wrong because `exec` is not a valid systemd service type; the correct types are `simple`, `forking`, `oneshot`, `dbus`, `notify`, and `idle`. Option C is wrong because `simple` is for services that start and remain running in the foreground, which does not match a one-time script that exits after execution.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling the OOM killer does not proactively free memory; it only kills processes when the system is completely out of memory, which may kill Apache or other critical services unpredictably. Option B is wrong because increasing swap space would only mask the problem by moving more data to disk, worsening performance and not freeing RAM for Apache. Option D is wrong because reducing MaxClients limits Apache's concurrency but does not reclaim the 40% of memory consumed by 'databased'; the web server would still be starved for RAM.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B (`nomodeset`) is wrong because it disables kernel mode-setting for video drivers, which can help with display issues but does not affect the display or retention of kernel panic messages. Option C (`quiet`) is wrong because it suppresses most kernel log messages, including panic details, making it counterproductive for capturing panic output. Option D (`single`) is wrong because it boots the system into single-user mode (runlevel 1) for maintenance, which does not alter the behavior of kernel panic handling or message display.

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS resolution failures would produce a 'Name or service not known' error, not a TCP-level 'connection refused'. Option B is wrong because a firewall blocking port 3306 would cause the connection to time out (no response) or be silently dropped, not produce an immediate 'connection refused' which requires a TCP RST from the target host. Option D is wrong because incorrect credentials result in an authentication failure after the TCP connection is established, typically returning 'Access denied for user' from the database server, not a transport-layer refusal.

Why this answer

How to eliminate wrong answers

Option A is wrong because `--device` is used to expose host devices (e.g., `/dev/sda`) to a container, not regular files or sockets; it does not handle Unix socket bind mounts. Option B is wrong because `--bind` is not a valid Podman or Docker flag; the correct syntax for a bind mount uses `--volume`, `--mount`, or `-v`. Option D is wrong because the `--mount` flag requires a comma-separated list of key=value pairs (e.g., `type=bind,source=/run/host-service.sock,target=/run/host-service.sock`), but the given syntax is missing the `type=bind` key and uses incorrect formatting; it would be rejected by Podman.

Why this answer

How to eliminate wrong answers

Option B is wrong because `taskset -c 0 PID` binds the process to CPU core 0, which does not change its scheduling priority or reduce CPU consumption; it only restricts which CPU the process can run on. Option C is wrong because `nice -n -20 PID` would start a new process with a very high priority (low nice value), which is the opposite of what is needed and does not apply to an already running process. Option D is wrong because `chrt -r 99 PID` sets the process to real-time FIFO scheduling with the highest priority (99), which would increase its CPU priority, not reduce it.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `set -u` causes the script to exit when an unset variable is referenced, but it does nothing to handle pipeline failures or exit on command errors. Option B is wrong because `shopt -s extglob` enables extended pattern matching in bash (e.g., `?(pattern)`, `*(pattern)`), which is unrelated to error handling or pipeline exit behavior. Option C is wrong because `set -e` alone causes the script to exit on a command failure, but it does not apply to pipelines; by default, only the last command in a pipeline determines the exit status, so a failure in an earlier command would not trigger `set -e`.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `single` is a legacy SysVinit parameter that boots into single-user mode, but on modern systemd-based distributions, it is often mapped to `rescue.target`; however, it is not the correct GRUB kernel parameter for systemd rescue environments and may not work reliably with kernel panics. Option B is wrong because `init=/bin/bash` bypasses the init system entirely and drops directly into a Bash shell without mounting the root filesystem properly or starting any services, which can lead to a read-only root filesystem and lack of necessary tools for recovery. Option D is wrong because `quiet splash` are kernel parameters that suppress boot messages and show a splash screen; they do not change the boot target and will not prevent a kernel panic or provide a rescue environment.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing RestartSec only affects the delay between restart attempts, not the root cause of the startup failure; it would merely slow down retries without fixing the underlying issue. Option B is wrong because if the binary lacked execute permission, systemd would typically report a specific 'Permission denied' error in the journal, and the exhibit does not indicate that; also, the binary path is hardcoded in ExecStart, and execute permission is a secondary check after ensuring the configuration file is valid. Option C is wrong because while inspecting the system journal is a valid troubleshooting step, it is not the first step; the question asks for the first step, and checking the configuration file is a quicker, more direct check that often reveals the problem without needing to parse logs.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the filesystem block size can improve throughput for large sequential I/O but may waste space and degrade performance for small random I/O; it does not address the root cause of slow disk I/O from excessive metadata writes. Option B is wrong because enabling write-back caching with hdparm on a drive that does not support it or without proper power-loss protection can cause data corruption; it is a risky hardware-level change, not a safe filesystem tuning step. Option D is wrong because changing the I/O scheduler to 'deadline' may help with latency for certain workloads, but it does not reduce the volume of I/O operations; the exhibit points to unnecessary metadata updates, which the scheduler cannot mitigate.

Why this answer

How to eliminate wrong answers

Option B is wrong because Ansible playbooks are not executable Python scripts; they are YAML declarative files that invoke Python modules on the control node, not scripts that run directly on managed nodes. Option C is wrong because inventory files, not playbooks, list managed hosts; playbooks define tasks and desired states. Option D is wrong because playbooks are not shell scripts; they are structured YAML files that orchestrate idempotent tasks, while ad-hoc commands are run via the `ansible` command, not playbooks.

Why this answer

How to eliminate wrong answers

Option B is wrong because building separate images for each environment violates immutability and defeats the purpose of a single deployable artifact, leading to configuration drift and increased maintenance overhead. Option C is wrong because storing configuration in a JSON file within the base image requires modifying the image or using a bind mount at runtime, which either breaks immutability or relies on host filesystem access, not a secure or portable approach. Option D is wrong because using a Dockerfile to copy a configuration file from the host at build time bakes the configuration into the image, making it environment-specific and requiring separate builds for each environment, which is inefficient and insecure.

Why this answer

How to eliminate wrong answers

Option A is wrong because adding a new volume only postpones the problem by increasing capacity, but does not automate cleanup of logs or unused images, so disk space will eventually run out again. Option B is wrong because stopping all containers disrupts the critical web application, violating the requirement to not disrupt running containers. Option C is wrong because `docker system prune -a -f` removes all unused images, containers, networks, and volumes, including those that might be needed for running containers (e.g., intermediate layers), and it does not address log rotation, so logs will continue to grow unchecked.

Why this answer

Why these pairings

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because running the container in privileged mode grants all capabilities and bypasses most security restrictions, but it does not automatically resolve SELinux denials; in fact, privileged mode may still be blocked by SELinux unless SELinux is disabled or the context is set. Option B is wrong because the Docker daemon typically runs as root, and even if it did not, the permission error from a bind mount is more likely related to SELinux or filesystem permissions, not the daemon's user ID. Option D is wrong because if the volume path on the host did not exist, Docker would create it as a directory (unless a file is expected), and the error would be a 'no such file or directory' message, not a permission error.

Why this answer

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because `*.info` selects all messages with severity info or higher, which would flood `/var/log/secure` with non-authentication messages (e.g., cron, mail, daemon logs), not specifically auth messages. Option B is wrong because `auth.*` uses the `auth` facility, which is typically used for legacy or non-privileged authentication; on modern Linux systems, authentication logs are generated under the `authpriv` facility, so `auth.*` would miss many auth-related messages. Option D is wrong because `kern.*` selects kernel messages only, which are unrelated to authentication attempts and are typically logged to `/var/log/kern.log` or `/var/log/messages`.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `ls -l` only shows the permissions of the final file or directory, not the intermediate directories in the path, so it cannot detect a missing execute permission on a parent directory that causes the 'Permission denied' error. Option C is wrong because `getfacl` displays only the ACL entries for a single file or directory, not the recursive path permissions, and ACLs are an extended permission mechanism that may not be the root cause if standard Unix permissions are misconfigured on a parent directory. Option D is wrong because `stat` provides detailed metadata (inode, timestamps, permissions) for a single file or directory but, like `ls -l`, does not traverse and display permissions for each component in the path, missing the common scenario where a parent directory lacks the execute bit.

Why this answer

How to eliminate wrong answers

Option B is wrong because `chgrp user file` changes the group owner of the file to the user's primary group, but the user may not be in that group (or the group may still not grant read access if the group permissions are insufficient). Option C is wrong because `setfacl -m u:user:r file` would work to grant read access via an ACL, but the question asks for a command to allow the user to read the file, and while this is technically valid, it is not the most direct or standard answer; the exam expects the simpler `chmod` solution. Option D is wrong because `chown user file` changes the file owner to the user, which would grant the user owner permissions (read/write), but this is overly permissive and unnecessary when only read access is needed; it also violates the principle of least privilege.

Why this answer

How to eliminate wrong answers

Option A is wrong because `--mount type=volume` creates a Docker-managed volume that persists data, but the question specifies the administrator wants data to persist even if the container is removed; while volumes also persist, the correct answer for the given scenario is bind mount, as the question implies a direct host path mapping. Option C is wrong because `COPY` in a Dockerfile only copies files into the image at build time, not at runtime, and does not provide persistent storage that survives container removal. Option D is wrong because `--mount type=tmpfs` mounts a temporary filesystem stored in memory, which is volatile and data is lost when the container stops or is removed.

Why this answer

How to eliminate wrong answers

Option B is wrong because `docker start` only starts an existing stopped container; it cannot pull or run a new image from a registry, and `--rm` is not a valid flag for `docker start`. Option C is wrong because `docker run -d` runs the container in detached mode (background) and does not automatically remove it after exit; the container would remain as a stopped container. Option D is wrong because `docker exec` runs a command inside an already running container, not a new container from an image, and `--rm` is not a valid flag for `docker exec`.

Why this answer

How to eliminate wrong answers

Option A is wrong because a syntax error in the SSH configuration file would typically produce a specific parse error message (e.g., 'Bad configuration option' or 'line X: syntax error'), not a missing directory error. Option C is wrong because the inability to write the PID file would generate a 'Could not create PID file' or 'Permission denied' message, not a privilege separation directory error. Option D is wrong because if the SSH port were already in use, the error would be 'Address already in use' or 'bind: Address in use', which is a socket binding failure, not a missing directory.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because while a container that runs a task and completes will also exit with status 0, the question states the container was 'stopped manually with docker stop', which is the most likely reason given the explicit action. Option B is wrong because if the container's entrypoint crashed, it would typically exit with a non-zero status (e.g., 1, 2, or 139 for a segfault), not 0. Option D is wrong because running out of memory causes the container to be killed by the OOM killer, which results in exit code 137 (128 + 9, where 9 is SIGKILL), not 0.

Why this answer

How to eliminate wrong answers

Option A is wrong because `fdisk -l /dev/sda` is used to list partition tables, not to identify which files or directories are consuming disk space; it provides no insight into filesystem usage. Option B is wrong because `fsck /dev/sda1` checks and repairs filesystem integrity, but running it on a mounted, full filesystem can cause data corruption and does not address the root cause of capacity exhaustion. Option C is wrong because `ls -la /` lists the contents of the root directory with metadata but does not aggregate sizes recursively, so it cannot show which subdirectories are using the most space.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it states only SSH traffic to 192.168.1.10 is allowed, but the rules also permit ICMP echo-request, not just SSH. Option B is wrong because it claims loopback traffic is allowed, but the rules do not include any explicit allow rule for loopback (lo) interface traffic; only SSH and ICMP echo-request are permitted. Option C is wrong because it says all traffic on eth0 is allowed, but the rules include a default drop rule that denies all traffic not matching the SSH or ICMP echo-request allow rules.

Why this answer

How to eliminate wrong answers

Option A is wrong because it omits the `-d` flag, so the container runs in the foreground (attached mode), not detached. Option B is wrong because it uses `-p 8080:80`, which maps host port 8080 to container port 80, reversing the required mapping (the application listens on container port 8080, not 80). Option C is identical to Option B and is wrong for the same reason: it incorrectly maps host port 8080 to container port 80.

Why this answer

How to eliminate wrong answers

Option A is wrong because it adds a range `9-17` in the hour field, which restricts execution to business hours (9 AM to 5 PM) instead of only weekdays, and this is not required by the question. Option B is wrong because it uses `1-6` for the day-of-week field, which includes Saturday (6) in addition to weekdays, causing the job to run on Saturdays as well. Option D is wrong because it changes the minute field from `*/5` to `5`, meaning the job would run only at minute 5 of every hour, not every 5 minutes, thus altering the frequency requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the script were not marked executable, it would also fail when run manually from the command line (unless invoked with 'bash script.sh'), but the question states it runs manually. Option B is wrong because cron jobs themselves are not files with permissions; the cron table (crontab) is a configuration file, and its permissions (typically 600 owned by the user) are not the issue—the script's permissions or cron's environment are. Option C is wrong because a missing shebang line would cause the script to fail regardless of how it is invoked (manual or cron), but the script runs manually, so a shebang is present or the shell is explicitly specified.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `--net=host` removes network isolation entirely, making the container share the host's network stack, which is overly permissive and not a targeted solution for hostname resolution. Option B is wrong because `--link` is a legacy feature that provides name resolution between containers, not between a container and the host machine. Option C is wrong because creating a custom bridge network enables automatic DNS resolution for container names, but it does not automatically provide a hostname for the host machine; you would still need to use `--add-host` or similar to resolve the host by name.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `service httpd status` is a legacy SysVinit command that only shows the service's running state (e.g., 'httpd is running') without displaying recent log entries or detailed status information. Option C is wrong because `journalctl -u httpd` shows only the log entries for the httpd unit but does not display the current running status or process details; it requires a separate command to verify if the service is active. Option D is wrong because `systemctl list-units --type=service` lists all loaded service units and their states but does not filter to httpd specifically, nor does it show recent log entries or detailed status for a single service.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the service is `loaded`, not `masked`; a masked service would show `masked` in the Loaded line and cannot be started directly. Option B is wrong because while the service is currently `inactive (dead)`, the question asks for a true statement about the service overall, and the key fact is its disabled boot status, not just its current runtime state. Option C is wrong because `exited` is a specific active state for services that run and terminate (e.g., oneshot type), but this service shows `inactive (dead)`, not `exited`; `exited` would appear as `Active: active (exited)`.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `systemctl status httpd --full` shows the current status and recent log lines of the service, but it does not provide the detailed failure reason from the journal; it only truncates output lines to full width, not the cause. Option C is wrong because `tail -f /var/log/httpd/access_log` tails the HTTP access log, which records client requests, not service failure reasons; the relevant log for failures is typically `/var/log/httpd/error_log`. Option D is wrong because `dmesg | grep httpd` searches kernel ring buffer messages, which are for hardware/driver issues and kernel panics, not for user-space service failures like an httpd crash.

Why this answer

How to eliminate wrong answers

Option A is wrong because modprobe loads a module at runtime, but the issue occurs during boot before the root filesystem is mounted; the module must be present in the initramfs to be loaded early. Option C is wrong because udev rules handle device naming and permissions after the kernel has detected the hardware, but they do not cause the kernel to fail to detect the NIC; the problem is that the module is not loaded at all. Option D is wrong because reinstalling the kernel package would simply reapply the same kernel files; it does not rebuild the initramfs, which is the specific step needed to include the updated module.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `systemctl status sshd.service` shows the current state and recent log tail, but it may not show the full historical log output needed to diagnose a failure that occurred earlier. Option B is wrong because `systemctl restart sshd.service` attempts to restart the service without first understanding why it failed, which could mask the underlying issue or cause repeated failures. Option D is wrong because `systemctl list-units` lists all loaded units and their states, but it does not provide any diagnostic details about why a specific service like sshd failed.

Why this answer

How to eliminate wrong answers

Option A is wrong because `kernel.panic_on_warn` controls whether the kernel panics on a warning (WARN()), not the reboot behavior after a panic; setting it to 10 would be invalid as it expects 0 or 1. Option B is wrong because `kernel.panic_on_oops` determines if the kernel panics on an oops (a non-fatal error), not the timeout before reboot; it also expects a boolean value (0 or 1), not 10. Option C is wrong because `kernel.panic_print` controls the verbosity of kernel messages printed during a panic, not the reboot action or delay.

Why this answer

How to eliminate wrong answers

Option B is wrong because SSH rules (typically port 22) do not block HTTP traffic; iptables rules are evaluated sequentially, and an SSH rule would only affect SSH packets, not HTTP packets on port 80. Option C is wrong because the loopback interface (lo) is used for local communication within the host, not for external internet traffic; its ACCEPT or DROP status does not affect inbound HTTP connections from the internet. Option D is wrong because the default INPUT policy being DROP would only apply to packets that do not match any existing rule; if the HTTP rule were correctly allowing all sources, the default policy would not block internet traffic, but here the HTTP rule itself restricts the source, so the issue is the rule's source limitation, not the default policy.