Courseiva

CompTIA Linux+ (XK0-006) (XK0-006) — Questions 1–75

979 questions total · 14pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 14

Page 2
1
MCQeasy

A junior administrator reports that users cannot connect to a file server running Samba. The server is reachable via ping. Logs from the Samba service show: 'smbd: error while loading shared libraries: libgnutls.so.30: cannot open shared object file: No such file or directory'. The administrator confirms the package 'libgnutls' is installed. Which of the following is the most likely cause and solution?

A.The library path is not set; run ldconfig.
B.The system libraries are out of sync; run apt-get update.
C.The Samba package is corrupted; reinstall Samba.
D.The Samba service is not running; restart it.
AnswerA

Correct: ldconfig updates the shared library cache, resolving the missing library error.

Why this answer

The error 'cannot open shared object file' indicates that the dynamic linker cannot find the libgnutls.so.30 library at runtime, even though the libgnutls package is installed. Running `ldconfig` updates the linker cache, which rebuilds the mapping of shared library names to their actual file paths, resolving the missing library reference for Samba.

Exam trap

The trap here is that candidates see 'package is installed' and assume the library is available, overlooking the need to update the linker cache with `ldconfig` after installation.

How to eliminate wrong answers

Option B is wrong because `apt-get update` only refreshes the package repository metadata, not the runtime linker cache; it does not fix missing shared library references. Option C is wrong because the error is a missing library dependency, not a corrupted Samba binary; reinstalling Samba would not resolve the underlying library path issue. Option D is wrong because the service is already failing to start due to the library error; restarting it without fixing the library path will produce the same error.

Full explanation →
2
MCQhard

An administrator is managing a Kubernetes cluster. A pod is running but not responding as expected. The administrator wants to view the standard output logs from the pod's main container. Which kubectl command should be used?

A.kubectl exec <pod-name> -- cat /var/log/app.log
B.kubectl get pod <pod-name> -o yaml
C.kubectl describe pod <pod-name>
D.kubectl logs <pod-name>
AnswerD

This command fetches the logs from the pod.

Why this answer

kubectl logs <pod-name> retrieves the logs from the specified pod.

Full explanation →
3
MCQmedium

An administrator wants to monitor disk I/O performance in real-time, focusing on metrics like wait time and I/O queue size. Which tool is best suited for this?

A.vmstat
B.sar -b
C.free -h
D.iostat -x 1
AnswerD

iostat -x extended statistics every 1 second.

Why this answer

iostat provides detailed disk I/O statistics including await, svctime, %util, and queue size.

Full explanation →
4
Multi-Selectmedium

A Linux administrator needs to display the amount of disk space used by each mounted filesystem. Which two commands can be used? (Choose two.)

Select 2 answers
A.du -h /
B.mount | column -t
C.lsblk
D.fdisk -l
E.df -h
AnswersA, E

du -h / displays the disk usage of the root directory, which corresponds to the root filesystem, thus showing the amount of disk space used by a mounted filesystem.

Why this answer

The question asks for two commands that display the amount of disk space used by each mounted filesystem. Both df -h (option E) and du -h / (option A) serve this purpose. df -h shows disk space usage for all mounted filesystems in human-readable format. du -h / shows disk usage for the root directory, which is a mounted filesystem; while du is typically used for directory-level usage, the root directory corresponds to the root filesystem, so it effectively displays the disk space used by that filesystem. mount | column -t (option B) lists mount points and options, not space usage. lsblk (option C) lists block devices, not filesystem space. fdisk -l (option D) displays partition tables, not filesystem usage. Therefore, options A and E are correct.

Full explanation →
5
MCQmedium

A technician needs to check the kernel ring buffer for hardware errors detected during system boot. Which command should be used?

A.journalctl -k
B.lspci
C.dmesg
D.cat /var/log/boot.log
AnswerC

Correct.

Why this answer

dmesg displays kernel ring buffer messages, which include hardware detection and errors.

Full explanation →
6
MCQmedium

An organization uses Kubernetes to deploy containerized applications. A pod fails to start with an ImagePullBackOff error. What is the most likely cause?

A.The pod exceeded its memory limit
B.The container port is already in use
C.The node is out of disk space
D.The image name is misspelled or does not exist in the registry
AnswerD

This is the most common cause of ImagePullBackOff.

Why this answer

The ImagePullBackOff error in Kubernetes indicates that the kubelet is unable to pull the container image from the specified registry. The most common cause is a misspelled image name or a non-existent image in the registry, which prevents the container runtime from fetching the image. This triggers a back-off mechanism where the kubelet retries the pull with increasing delays.

Exam trap

CompTIA often tests the distinction between ImagePullBackOff and CrashLoopBackOff, where candidates mistakenly attribute a pull failure to resource limits or port conflicts instead of recognizing it as a registry/image name issue.

How to eliminate wrong answers

Option A is wrong because exceeding the pod's memory limit causes an OOMKill (Out of Memory Kill) error, not ImagePullBackOff; the pod would be terminated with a CrashLoopBackOff or OOM status. Option B is wrong because a container port already in use results in a port conflict error during pod startup, typically manifesting as a 'port already allocated' or 'bind: address already in use' error, not an image pull failure. Option C is wrong because a node running out of disk space leads to an EvictionThreshold or ImageGCFailure, which may prevent pod scheduling or cause pod eviction, but the specific error for image pull failures due to disk space is usually 'ImagePullBackOff' only if the image cannot be downloaded, though the primary symptom of disk pressure is node-level eviction, not a registry-related pull error.

Full explanation →
7
Multi-Selectmedium

A system administrator is troubleshooting a custom systemd service that fails to start. Which of the following commands should be used to diagnose the issue? (Choose two.)

Select 2 answers
A.systemctl daemon-reload
B.systemctl status myservice
C.systemctl enable myservice
D.systemctl list-units
E.journalctl -u myservice
AnswersB, E

Displays service status and recent log entries.

Why this answer

The `systemctl status myservice` command (B) is correct because it shows the current state of the service, including whether it is active, failed, or inactive, along with recent log entries and the exit code. The `journalctl -u myservice` command (E) is correct because it retrieves the full systemd journal logs specifically for that unit, which is essential for diagnosing why the service failed to start, such as missing dependencies or configuration errors.

Exam trap

The trap here is that candidates often pick `systemctl daemon-reload` (A) thinking it will fix the issue by reloading unit files, but it does not provide diagnostic output; the exam tests the distinction between reloading configuration and retrieving failure logs.

Full explanation →
8
Multi-Selectmedium

A Kubernetes administrator needs to expose a deployment externally using a Service. Which THREE of the following Service types can be used? (Select THREE).

Select 3 answers
A.ClusterIP
B.LoadBalancer
C.ExternalName
D.NodePort
E.Ingress
AnswersA, B, D

ClusterIP is correct because when used with an Ingress resource, it can expose the deployment externally. Ingress routes external traffic to the ClusterIP Service.

Why this answer

ClusterIP, LoadBalancer, and NodePort are the three Kubernetes Service types that can be used to expose a deployment externally. ClusterIP alone is internal, but when combined with an Ingress controller, it provides external access by routing traffic from outside the cluster to the Service. LoadBalancer provisions an external load balancer with a public IP.

NodePort opens a static port on every node's IP, allowing external traffic. ExternalName (option C) does not expose the deployment; it only maps a Service to an external DNS name, so it is not a valid choice for exposing a deployment externally.

Exam trap

The Linux+ exam often tests the distinction between Service types that provide external exposure. Candidates may mistakenly select ExternalName, which only provides a DNS alias and does not actually route traffic to the deployment, or choose Ingress, which is not a Service type but a separate API object.

Full explanation →
9
Multi-Selectmedium

A system administrator is writing a Bash script that must check if a file exists and is readable. Which two test expressions can be used to achieve this? (Choose two.)

Select 2 answers
A.-e /path/to/file
B.-s /path/to/file
C.-r /path/to/file
D.-x /path/to/file
E.-f /path/to/file
AnswersA, C

Correct. -e checks if the file exists.

Why this answer

The -e test checks if a file exists, and -r checks if it is readable. The -f test checks if it is a regular file, which also implies existence but not necessarily readable. The question asks for existence and readability, so -e and -r are correct.

Full explanation →
10
MCQmedium

An Ansible playbook includes a handler that restarts a service when a configuration file is changed. Which directive in a task triggers the handler?

A.register:
B.when:
C.handlers:
D.notify:
AnswerD

Correct. notify tells a handler to run if the task has changed.

Why this answer

The 'notify' directive is used to call a handler when a task makes a change (i.e., when the task's state is changed).

Full explanation →
11
MCQmedium

After a power failure, a Linux server boots into emergency mode. The system logs indicate an unclean filesystem on /dev/sda2. Which command should the administrator run to repair the filesystem?

A.fsck -f /dev/sda2
B.badblocks /dev/sda2
C.xfs_repair /dev/sda2
D.mount -o remount,ro /
AnswerA

Correct: Forces filesystem check and repair.

Why this answer

After a power failure, the system logs indicate an unclean filesystem on /dev/sda2, meaning the filesystem was not properly unmounted and may contain inconsistencies. The `fsck -f /dev/sda2` command forces a filesystem check even if the filesystem appears clean, which is necessary to repair corruption on ext2/ext3/ext4 filesystems. This is the standard tool for checking and repairing such filesystems after an unclean shutdown.

Exam trap

The trap here is that candidates may confuse filesystem repair tools (fsck vs. xfs_repair) or mistake a disk surface scan (badblocks) for a filesystem consistency check, leading them to choose an inappropriate command for the specific filesystem type.

How to eliminate wrong answers

Option B is wrong because `badblocks` scans for physical bad sectors on the disk, not filesystem metadata corruption; it does not repair filesystem inconsistencies. Option C is wrong because `xfs_repair` is used for XFS filesystems, but /dev/sda2 is likely an ext4 filesystem (common on Linux) and the question does not specify XFS; using the wrong repair tool can cause further damage. Option D is wrong because `mount -o remount,ro /` only remounts the root filesystem as read-only to prevent further writes, but it does not repair the underlying filesystem corruption.

Full explanation →
12
Multi-Selecteasy

Which TWO commands can be used to lock a user account? (Choose two.)

Select 2 answers
A.passwd -u username
B.userdel username
C.usermod -L username
D.chage -E 0 username
E.passwd -l username
AnswersC, E

Locks account.

Why this answer

passwd -l locks the password, usermod -L locks the account. Both prevent login.

Full explanation →
13
MCQeasy

An administrator needs to allow a user to run all commands as root without a password. Which sudoers entry accomplishes this?

A.user ALL=(ALL) NOPASSWD: ALL
B.user ALL=(ALL) !ALL
C.user ALL=(ALL) PASSWD: ALL
D.user ALL=(ALL) ALL
AnswerA

This entry allows passwordless execution of all commands.

Why this answer

The sudoers entry `user ALL=(ALL) NOPASSWD: ALL` grants the user permission to run any command as any user (including root) without being prompted for a password. The `NOPASSWD` tag overrides the default password requirement, and the `ALL` specifications cover the host list, target user list, and command list.

Exam trap

The trap here is that candidates often confuse the default behavior of `ALL` (which still requires a password) with the `NOPASSWD` tag, leading them to select option D thinking it allows passwordless execution.

How to eliminate wrong answers

Option B is wrong because `user ALL=(ALL) !ALL` uses the negation operator `!` to deny all commands, effectively preventing the user from running any command via sudo. Option C is wrong because `user ALL=(ALL) PASSWD: ALL` explicitly requires a password (the default behavior), so the user would still be prompted for a password. Option D is wrong because `user ALL=(ALL) ALL` is the standard sudoers entry that allows all commands but still requires the user to enter their own password (unless the `NOPASSWD` tag is present).

Full explanation →
14
MCQmedium

A container is running a web server on port 8080 internally, and the administrator wants to access it on the host on port 80. Which Docker run option accomplishes this?

A.-p 80:8080
B.-P
C.-p 8080:80
D.--expose 8080
AnswerA

Correct. Maps host port 80 to container port 8080.

Why this answer

Port mapping is done using -p host_port:container_port. So -p 80:8080 maps host port 80 to container port 8080.

Full explanation →
15
MCQhard

A system administrator wants to create a bind mount in Docker to share a host directory `/data` with a container at `/mnt/data`. Which of the following docker run options should be used?

A.-v /data:/mnt/data
B.--mount type=volume,source=/data,target=/mnt/data
C.-v /data:ro
D.-v /mnt/data:/data
AnswerA

This creates a bind mount from /data to /mnt/data.

Why this answer

Bind mounts are specified with -v or --mount. The -v syntax is host-path:container-path.

Full explanation →
16
MCQmedium

An administrator wants to replace all occurrences of 'oldstring' with 'newstring' in a configuration file named config.cfg, and save the changes. Which sed command should be used?

A.sed -i 's/oldstring/newstring/' config.cfg
B.sed -i 's/oldstring/newstring/g' config.cfg
C.sed -i 's/oldstring/newstring/gi' config.cfg
D.sed 's/oldstring/newstring/' config.cfg
AnswerB

Correct: in-place global substitution.

Why this answer

It uses -i for in-place editing and g to replace all occurrences on each line. Option A has -i but lacks g, so it replaces only the first occurrence per line. Option C adds an unnecessary i flag for case-insensitive matching, which deviates from the requirement to replace 'oldstring' exactly as given.

Option D lacks -i, so changes are only printed to stdout and not saved.

Full explanation →
17
MCQeasy

A user wants to run a Docker container in detached mode, remove it automatically after it stops, and map host port 8080 to container port 80. Which command accomplishes this?

A.docker run -d --rm -p 8080:80 image
B.docker run -it --rm -p 80:8080 image
C.docker create --rm -p 8080:80 image
D.docker start -d -p 8080:80 image
AnswerA

Correct flags for detached mode, auto-remove, and port mapping.

Why this answer

docker run --rm -d -p 8080:80 image runs in detached mode (-d), auto-removes (--rm), and maps port 8080 to 80.

Full explanation →
18
MCQmedium

A system administrator wants to change the priority of a running process with PID 1234 to a lower priority (higher nice value). Which command should be used?

A.renice -n 10 -p 1234
B.renice -n -10 -p 1234
C.chrt -p 10 1234
D.nice -n 10 -p 1234
AnswerA

renice changes the priority of a running process.

Why this answer

renice is used to change the nice value of an existing process. A higher nice value means lower priority.

Full explanation →
19
Multi-Selectmedium

A security administrator is reviewing file permissions on a Linux system. They want to ensure that the /etc/shadow file is only readable by the root user. Which two commands can be used to set the correct permissions?

Select 2 answers
A.chown root:root /etc/shadow
B.chmod 444 /etc/shadow
C.chmod 600 /etc/shadow
D.chmod 640 /etc/shadow
E.chown root:shadow /etc/shadow
AnswersA, C

Ensures owner and group are root.

Why this answer

The chown root:root /etc/shadow command changes both the owner and group of the /etc/shadow file to root. This ensures that only the root user has ownership, which is a prerequisite for setting restrictive permissions. However, the question asks for commands to set the correct permissions, and while ownership change is important, the primary requirement is that the file is only readable by root, which is achieved by setting permissions to 600 (owner read/write, no access for group or others).

Thus, chmod 600 /etc/shadow (Option C) is also correct, making A and C the two commands that together ensure the file is only readable by root.

Exam trap

The trap here is that candidates often confuse the purpose of chown and chmod, thinking that changing ownership alone (Option A) is sufficient to restrict access, when in fact the permission bits (like 600) must also be set to deny group and others access, or they mistakenly choose chmod 640 (Option D) assuming the shadow group is acceptable, but the question explicitly requires only root to have read access.

Full explanation →
20
MCQhard

Based on the exhibit, what is the most likely cause of the 'PV Status: not available'?

A.The volume group is corrupted.
B.The logical volume is not mounted.
C.LVM metadata is damaged.
D.The physical volume is missing or disconnected.
AnswerD

PV status 'not available' indicates the PV cannot be accessed.

Why this answer

The 'PV Status: not available' message in LVM indicates that the system cannot access the physical volume. This typically occurs when the underlying disk or partition is missing, disconnected, or has failed. Since LVM relies on the physical volume being present for volume group and logical volume operations, a missing or disconnected physical volume is the most direct cause.

Exam trap

The trap here is that candidates often confuse 'PV Status: not available' with LVM metadata corruption, but the status specifically indicates the device is inaccessible, not that its metadata is damaged.

How to eliminate wrong answers

Option A is wrong because a corrupted volume group would typically show errors related to the volume group itself (e.g., 'VG not found' or 'VG metadata missing'), not a per-physical-volume status of 'not available'. Option B is wrong because the mount status of a logical volume is unrelated to the physical volume's availability; a logical volume can be unmounted while its PV status remains 'available'. Option C is wrong because damaged LVM metadata would likely produce errors during LVM commands (e.g., 'metadata inconsistency' or 'failed to read metadata'), not a simple 'PV Status: not available' which points to a missing device.

Full explanation →
21
MCQmedium

A developer is writing a Bash script that must be portable across different Linux distributions. The script needs to check if a package is installed. Which command should be used to achieve this portability?

A.which package
B.command -v package
C.dpkg -l package
D.rpm -q package
AnswerB

POSIX-compliant.

Why this answer

The `command -v package` command is the most portable way to check if a package is installed across different Linux distributions because it uses the POSIX-standard `command` shell built-in, which works in any Bourne-compatible shell (bash, sh, dash, etc.) regardless of the underlying package manager. It returns the path to the executable if the package's binary is in the PATH, or nothing if it is not installed, making it distribution-agnostic.

Exam trap

The trap here is that candidates often choose `dpkg` or `rpm` because they are familiar with checking packages on their own distribution, but the question explicitly requires portability across different Linux distributions, making the distribution-agnostic `command -v` the correct choice.

How to eliminate wrong answers

Option A is wrong because `which package` is not a POSIX-standard command and its behavior can vary across distributions; it may not be installed by default or may produce different exit codes, reducing portability. Option C is wrong because `dpkg -l package` is specific to Debian-based distributions (e.g., Ubuntu) and will fail or be unavailable on Red Hat-based or other distributions. Option D is wrong because `rpm -q package` is specific to Red Hat-based distributions (e.g., CentOS, Fedora) and will not work on Debian-based or other package management systems.

Full explanation →
22
MCQhard

An application running under an AppArmor profile is being denied access to log files. The administrator wants to troubleshoot by allowing all actions and logging denials. Which command will switch the profile to complain mode?

A.aa-complain /path/to/profile
B.aa-enforce /path/to/profile
C.aa-disable /path/to/profile
D.aa-status
AnswerA

This sets the profile to complain mode, allowing actions but logging denials.

Why this answer

The `aa-complain` command places an AppArmor profile into complain mode, which allows all actions but logs denials to the system log. This is the correct tool for troubleshooting because it lets the administrator see what the application is trying to do without actually blocking it.

Exam trap

The trap here is confusing `aa-complain` with `aa-enforce`, as candidates often assume that logging denials requires enforcement mode, but complain mode is specifically designed for logging without blocking.

How to eliminate wrong answers

Option B is wrong because `aa-enforce` activates enforcement mode, which actively blocks denied actions and logs them, not allowing all actions as required. Option C is wrong because `aa-disable` completely disables the AppArmor profile, removing all logging and access controls, which does not meet the requirement to log denials. Option D is wrong because `aa-status` only displays the current status of AppArmor profiles (e.g., which are in enforce or complain mode) and does not change the profile mode.

Full explanation →
23
MCQhard

A Red Hat Enterprise Linux 8 system is configured with SELinux in enforcing mode. A custom application needs to write to a file in /var/log. The audit log shows an AVC denial for httpd_t attempting to write to var_log_t. Which of the following is the most appropriate persistent solution?

A.Set the SELinux boolean httpd_can_network_connect to on.
B.Change the ownership of the file to apache.
C.Use chcon to set the file context to httpd_log_t.
D.Use semanage fcontext to define the default context for the file and then restorecon.
AnswerD

Persistent method; sets default context in policy.

Why this answer

Semanage fcontext defines a persistent default SELinux file context rule, which survives file system relabeling. After defining the rule, restorecon applies the context to the file. This ensures the custom application's log file is labeled httpd_log_t, allowing httpd_t to write to it, while chcon (option C) only makes a temporary change that can be overwritten by restorecon or a relabel.

Exam trap

The trap here is that candidates confuse chcon (temporary) with semanage fcontext (persistent), or mistakenly think changing Unix ownership or enabling a network boolean will resolve a file-based SELinux denial.

How to eliminate wrong answers

Option A is wrong because httpd_can_network_connect controls network access, not file write permissions to /var/log. Option B is wrong because changing file ownership to apache does not affect SELinux type enforcement; the AVC denial is based on the file's SELinux context (var_log_t), not its Unix owner. Option C is wrong because chcon makes a non-persistent context change that will be lost after a file system relabel or restorecon operation; it does not create a default rule in the SELinux policy.

Full explanation →
24
MCQhard

A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?

A.semanage fcontext -a -t httpd_sys_content_t webapp.conf && restorecon -v webapp.conf
B.setenforce 0
C.chcon -t httpd_sys_content_t webapp.conf
D.restorecon -v webapp.conf
AnswerA

Correct. semanage fcontext adds a persistent rule, then restorecon applies it, ensuring the context survives relabeling.

Why this answer

The most appropriate command. It adds a persistent SELinux file context rule with semanage fcontext and then applies it with restorecon, ensuring the correct type (httpd_sys_content_t) is set and preserved across system relabeling. Option D (restorecon alone) may not work if the file's path lacks a default mapping in the SELinux policy, making it unreliable for non-standard locations.

Therefore, only A fully addresses the requirement for a permanent and reliable fix.

Exam trap

The trap is that candidates often choose chcon (option C) because it works immediately without additional commands. However, chcon changes are not persistent across file relabeling (e.g., after a full restorecon or system policy update), making semanage fcontext the recommended approach for a permanent fix.

How to eliminate wrong answers

Option B is wrong because 'setenforce 0' disables SELinux entirely, which is a security risk and not a proper fix for the context mismatch; it only masks the issue. Option C is wrong because 'chcon -t httpd_sys_content_t webapp.conf' changes the context temporarily but does not update the SELinux policy database, so the change will be lost after a file system relabel or 'restorecon' run. Option D is wrong because 'restorecon -v webapp.conf' alone will reset the file to its default context based on the current policy, but since no persistent rule exists for this file, it will revert to 'admin_home_t' (or another default) and not fix the permission error.

Full explanation →
25
MCQeasy

A Linux administrator wants to ensure a bash script stops execution immediately if any command fails. Which line should be added to the script?

A.set -x
B.set -u
C.set -e
D.set -o pipefail
AnswerC

Correct. This causes the script to exit on any command failure.

Why this answer

The 'set -e' command causes the script to exit immediately when a command returns a non-zero exit status.

Full explanation →
26
Multi-Selectmedium

A system administrator suspects a disk failure. Which TWO commands can be used to check disk health and identify bad sectors?

Select 2 answers
A.iostat -x
B.fsck /dev/sda
C.badblocks -v /dev/sda
D.smartctl -a /dev/sda
E.dd if=/dev/sda of=/dev/null
AnswersC, D

Correct: Scans for bad sectors.

Why this answer

The `badblocks` command (option C) directly scans a disk for defective sectors by performing read/write tests, making it a primary tool for identifying bad blocks. The `smartctl -a` command (option D) queries the disk's S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology) data, which includes attributes like reallocated sector count and pending sector errors, providing a proactive health assessment. Together, they cover both active scanning and passive monitoring of disk health.

Exam trap

The trap here is that candidates confuse filesystem repair tools like `fsck` with hardware diagnostic tools, or assume `iostat` or `dd` provide equivalent health checks, when only `badblocks` and `smartctl` directly assess physical disk integrity.

Full explanation →
27
MCQeasy

Which file contains the password aging information such as minimum and maximum days between password changes?

A./etc/shadow
B./etc/security/limits.conf
C./etc/passwd
D./etc/login.defs
AnswerA

Contains password aging fields: min, max, warn, inactive, expire.

Why this answer

/etc/shadow stores password hashes and aging fields like min, max, warn, and inactive days. /etc/passwd has basic user info, /etc/login.defs has system defaults, and /etc/security/limits.conf sets resource limits.

Full explanation →
28
MCQmedium

A security analyst needs to see a list of failed login attempts on a Linux system. Which command displays this information from the /var/log/btmp log?

A.lastb
B.lastlog
C.last
D.faillog
AnswerA

lastb displays bad login attempts from /var/log/btmp.

Why this answer

lastb shows failed login attempts by reading the /var/log/btmp file. last reads /var/log/wtmp for successful logins, lastlog shows last login per user from /var/log/lastlog, and faillog is an older command that reads from /var/log/faillog.

Full explanation →
29
MCQeasy

A Linux administrator needs to check which services are listening on TCP port 22. Which command should be used?

A.ss -tlnp | grep :22
B.ping -p 22 localhost
C.ip addr show port 22
D.traceroute -p 22 localhost
AnswerA

ss -tlnp shows listening TCP ports with process info; grep filters for port 22.

Why this answer

The 'ss -tlnp' command shows listening TCP sockets with process information, making it suitable for checking services on port 22.

Full explanation →
30
MCQeasy

Which command is used to display the contents of the systemd journal for a specific unit?

A.systemctl status unit
B.dmesg
C.journalctl -f
D.journalctl -u
AnswerD

-u specifies the unit.

Why this answer

journalctl -u unitname displays logs for the specified systemd unit.

Full explanation →
31
MCQhard

After building and running the container as shown in the exhibit, the administrator tries to access http://localhost:8080 but receives a connection refused error. What is the most likely cause?

A.The container exited immediately after starting.
B.The port mapping is incorrect.
C.The base image is not compatible.
D.The CMD syntax is incorrect.
AnswerA

Check docker ps to see if running.

Why this answer

The most likely cause is that the container exited immediately after starting. When a container runs a command that finishes quickly (e.g., a shell script that exits), the container stops, and no process listens on port 8080. This results in a 'connection refused' error because the container is no longer running to accept connections.

Exam trap

CompTIA often tests the distinction between a container that fails to start (e.g., due to syntax errors) and one that starts but exits immediately, where the 'connection refused' error is a symptom of the latter.

How to eliminate wrong answers

Option B is wrong because if the port mapping were incorrect, the container would still be running but inaccessible on the specified host port; the error would be 'connection timeout' or 'no route to host', not 'connection refused'. Option C is wrong because an incompatible base image would cause a build failure or runtime crash, not a clean exit with a 'connection refused' error. Option D is wrong because incorrect CMD syntax would cause a build error or a container that fails to start, not one that runs and then exits immediately.

Full explanation →
32
Multi-Selecteasy

Which THREE commands can be used to display the mount points and file system usage? (Choose three.)

Select 3 answers
A.df -h
B.du
C.df -i
D.mount
E.lsblk
AnswersA, D, E

Shows filesystem usage with mount points.

Why this answer

(df -h) is correct because the 'df' command (disk free) with the '-h' (human-readable) flag displays file system disk space usage in a format that includes mount points, total size, used space, available space, and usage percentage. This directly shows both mount points and file system usage, making it a standard tool for this purpose.

Exam trap

The trap here is that candidates may confuse 'df -i' (inode usage) with 'df -h' (space usage), or think 'du' shows mount points, when in fact 'du' only shows directory-level usage and requires additional options to correlate with mount points.

Full explanation →
33
Multi-Selectmedium

Which TWO of the following are characteristics of containers compared to virtual machines? (Choose two.)

Select 2 answers
A.Containers run their own kernel.
B.Each container has its own operating system.
C.Containers use hypervisor for isolation.
D.Containers require less overhead than VMs.
E.Containers typically start in seconds.
AnswersD, E

No hypervisor, shares OS.

Why this answer

Containers share the host OS kernel and do not require a full guest OS per instance, resulting in significantly lower resource overhead (CPU, memory, and storage) compared to virtual machines. Option E is correct because containers are lightweight processes that can start in seconds, whereas VMs require booting an entire operating system, which typically takes minutes.

Exam trap

The trap here is that candidates often confuse container isolation with hypervisor-based isolation, mistakenly thinking containers run their own kernel or OS, when in fact they share the host kernel and use namespaces/cgroups.

Full explanation →
34
MCQeasy

A user reports that the /home partition is running out of space. Which command identifies the largest directories under /home?

A.du -sh /home/*
B.df -h /home
C.ls -lhS /home
D.find /home -type d -size +100M
AnswerA

du -sh gives human-readable totals for each top-level item under /home.

Why this answer

`du -sh /home/*` calculates the disk usage of each top-level item under /home, with `-s` summarizing each directory and `-h` providing human-readable sizes. This directly identifies the largest directories consuming space, which is exactly what the user needs to troubleshoot the /home partition running out of space.

Exam trap

The trap here is that candidates confuse `df` (filesystem-level usage) with `du` (directory-level usage), or assume `ls -lhS` or `find -size` can accurately report directory disk consumption, when only `du` correctly accounts for all nested file contents.

How to eliminate wrong answers

Option B is wrong because `df -h /home` shows the overall disk usage and available space of the /home filesystem, not the sizes of individual directories within it. Option C is wrong because `ls -lhS /home` lists files and directories sorted by size, but it only shows metadata (not recursive disk usage) and may miss large subdirectory contents. Option D is wrong because `find /home -type d -size +100M` looks for directories with a size attribute greater than 100 MB, but directories typically have a small metadata size (e.g., 4 KB) regardless of their contents, so this command will rarely return useful results.

Full explanation →
35
MCQmedium

A security policy requires that system logs be rotated weekly and kept for 4 weeks. Which configuration file should be modified to achieve this for /var/log/syslog?

A./etc/security/limits.conf
B./etc/rsyslog.conf
C./etc/logrotate.conf
D./etc/audit/auditd.conf
AnswerC

Main configuration file for logrotate.

Why this answer

Log rotation is managed by logrotate, not by rsyslog or syslog itself. The /etc/logrotate.conf file contains global rotation settings, including frequency (weekly) and retention count (rotate 4). Adding or modifying a configuration block for /var/log/syslog in logrotate.conf (or a file in /etc/logrotate.d/) directly implements the policy requirement.

Exam trap

CompTIA often tests the distinction between log generation (rsyslog.conf) and log rotation (logrotate.conf), so candidates mistakenly choose /etc/rsyslog.conf because they associate it with log management, not realizing rotation is a separate function.

How to eliminate wrong answers

Option A is wrong because /etc/security/limits.conf controls system resource limits (e.g., file handles, processes) per user via PAM, not log rotation. Option B is wrong because /etc/rsyslog.conf configures the rsyslog daemon’s logging rules, outputs, and facilities, but does not handle rotation or retention of log files. Option D is wrong because /etc/audit/auditd.conf configures the audit daemon (auditd) for kernel audit events, not general system log rotation.

Full explanation →
36
MCQhard

Based on the exhibit, what is the purpose of the audit rule?

A.Monitor open syscalls on a specific file.
B.Monitor all open syscalls by the root user.
C.Monitor all open syscalls by users with UID 1000 or higher.
D.Monitor all open syscalls except those by users with UID 1000 or higher.
AnswerC

The condition auid>=1000 selects regular users, excluding system accounts and root (UID 0).

Why this answer

The audit rule `-a always,exit -F arch=b64 -S open -F uid>=1000 -k monitor_open` uses the `uid>=1000` filter to match only system calls made by users with UID 1000 or higher. This is a common Linux auditd rule to track user-level activity while excluding system accounts (typically UIDs below 1000). Option C correctly identifies that the rule monitors all open syscalls by users with UID 1000 or higher.

Exam trap

CompTIA often tests the direction of comparison operators in audit rules — candidates frequently confuse `uid>=1000` (monitor UIDs 1000 and above) with `uid<1000` (monitor UIDs below 1000), leading them to select the exclusion-based option D instead of the correct inclusion-based option C.

How to eliminate wrong answers

Option A is wrong because the rule does not specify a particular file path; it monitors the open syscall system-wide, not on a specific file. Option B is wrong because the rule uses `uid>=1000`, which excludes the root user (UID 0) from being monitored; root's open syscalls are not captured. Option D is wrong because the rule includes users with UID 1000 or higher, not excludes them; the `>=` operator means 'greater than or equal to', so it matches those UIDs.

Full explanation →
37
MCQmedium

A server shows /dev/sda1 mounted at / is 100% full in df -h, but du -sh / shows only 50% usage. What is the most likely explanation?

A.The filesystem is corrupted
B.Hidden files are not counted by du
C.A process is still holding a deleted file open
D.The disk has many hard links
AnswerC

Deleted files held open by processes continue to occupy space until the process releases them.

Why this answer

When a file is deleted but still held open by a running process, the file's inode remains allocated and its disk blocks are not freed until the process closes the file descriptor. The `df` command reports filesystem usage by querying the superblock for total and free blocks, so it still counts the space occupied by the deleted-but-open file. In contrast, `du` traverses the directory tree and sums the sizes of files reachable from the specified path; since the deleted file is no longer linked in the directory, `du` does not include it, leading to the discrepancy.

Exam trap

The trap here is that candidates assume `du` and `df` should always match, and they overlook the classic Linux behavior where a file deleted while still open consumes space invisible to `du` but visible to `df`.

How to eliminate wrong answers

Option A is wrong because filesystem corruption typically causes inconsistent or erroneous output from both `df` and `du`, not a consistent discrepancy where `df` shows 100% and `du` shows 50%; corruption would likely produce errors or unmountable filesystems. Option B is wrong because `du -sh /` by default counts all files, including hidden files (those starting with a dot), as it traverses the entire directory tree; hidden files are not excluded unless specific exclusions are used. Option D is wrong because hard links do not consume additional disk space beyond the original inode; `du` counts the file's size once per inode, and `df` reports total allocated blocks, so hard links would not cause a 50% discrepancy between the two commands.

Full explanation →
38
MCQmedium

A system administrator needs to ensure that the Apache web server can read files in /var/www/html, which has the SELinux context httpd_sys_content_t. However, Apache is unable to access the files. What command should be used to apply the correct context to the directory and its contents?

A.chcon -R -t httpd_sys_content_t /var/www/html
B.restorecon -Rv /var/www/html
C.fixfiles -R restore /var/www/html
D.semanage fcontext -a -t httpd_sys_content_t /var/www/html
AnswerB

Correct. restorecon applies the default context recursively.

Why this answer

The directory /var/www/html already has the correct SELinux type (httpd_sys_content_t) as stated, but Apache cannot access the files. This suggests that the file contexts are not correctly applied or are mislabeled. The restorecon -Rv command resets the SELinux context of the directory and its contents to the default policy-defined context (httpd_sys_content_t), ensuring consistent labeling.

This directly resolves the access issue without needing to define or change the context type.

Exam trap

The trap here is that candidates assume the context is missing and choose `chcon` or `semanage fcontext` to set it, when in fact the context is already present but not applied correctly, and `restorecon` is the proper tool to enforce the policy-defined context.

How to eliminate wrong answers

Option A is wrong because `chcon -R -t httpd_sys_content_t` changes the SELinux context temporarily and does not persist after a file system relabel; it also assumes the context is missing when it is already present, and using it could overwrite any correct context with a non-persistent one. Option C is wrong because `fixfiles -R restore` is not a valid command; the correct syntax is `fixfiles restore` or `fixfiles -R` with a directory path, but `fixfiles` is used for bulk relabeling and is not the appropriate tool for a single directory context restoration. Option D is wrong because `semanage fcontext -a -t httpd_sys_content_t` adds a new file context mapping to the SELinux policy database, which is unnecessary since the correct type is already defined in the policy; this command would create a duplicate rule and does not apply the context to the files immediately.

Full explanation →
39
MCQmedium

An administrator needs to extend the size of a logical volume named 'lv_data' in volume group 'vg_data' by 10 GB. A new disk /dev/sdb has been added to the system. What is the correct sequence of commands?

A.pvcreate /dev/sdb; vgextend vg_data /dev/sdb; lvextend -L +10G /dev/vg_data/lv_data
B.lvextend -L +10G /dev/vg_data/lv_data; vgextend vg_data /dev/sdb; pvcreate /dev/sdb
C.vgextend vg_data /dev/sdb; pvcreate /dev/sdb; lvextend -L +10G /dev/vg_data/lv_data
D.pvcreate /dev/sdb; lvextend -L +10G /dev/vg_data/lv_data; vgextend vg_data /dev/sdb
AnswerA

This sequence correctly initializes the physical volume, extends the volume group, then extends the logical volume.

Why this answer

It follows the proper sequence for extending a logical volume when a new disk is added: first, initialize the new disk as a physical volume with pvcreate; second, add the physical volume to the volume group with vgextend; third, extend the logical volume by the desired size with lvextend. This order ensures the volume group has available physical extents before attempting to allocate them to the logical volume.

Exam trap

The trap here is that candidates often assume lvextend can be run first because they think the volume group already has space, but the question explicitly states a new disk must be added, so the correct order requires preparing the disk and volume group before extending the logical volume.

How to eliminate wrong answers

Option B is wrong because it attempts to extend the logical volume before the new disk is added to the volume group, which would fail due to insufficient free extents in vg_data. Option C is wrong because it tries to extend the volume group with a disk that has not yet been initialized as a physical volume, causing vgextend to fail. Option D is wrong because it extends the logical volume before adding the physical volume to the volume group, resulting in an error as the volume group lacks the necessary free space.

Full explanation →
40
MCQeasy

Which of the following is a key difference between Docker and Podman?

A.Docker does not support container images.
B.Podman can run containers without root privileges.
C.Podman requires a daemon to run containers.
D.Docker can only run on Linux.
AnswerB

Podman supports rootless containers natively.

Why this answer

Podman is daemonless and can run containers rootless, while Docker typically runs with a daemon and root privileges.

Full explanation →
41
MCQmedium

Refer to the exhibit. A developer is pushing an image to a private registry at `192.168.1.100:5000` but receives an error about using an insecure registry. Which part of the Docker daemon configuration allows this registry without TLS?

A.The 'insecure-registries' setting
B.The 'exec-opts' setting
C.The 'storage-driver' setting
D.The 'log-driver' setting
AnswerA

This setting explicitly allows insecure (non-TLS) connections to the specified registry.

Why this answer

The error indicates the Docker client is attempting to push an image to a registry over HTTP (port 5000) without TLS. By default, Docker Engine requires TLS for all registry communications. The `insecure-registries` setting in `/etc/docker/daemon.json` allows the daemon to bypass TLS verification for specified IP addresses or CIDR ranges, enabling communication with registries that lack a valid TLS certificate.

Exam trap

CompTIA often tests the distinction between daemon configuration options that affect registry communication versus those that affect container runtime or storage, leading candidates to confuse `insecure-registries` with unrelated settings like `exec-opts` or `storage-driver`.

How to eliminate wrong answers

Option B is wrong because `exec-opts` is used to pass options to the container runtime (e.g., native.cgroupdriver=systemd), not to configure registry security. Option C is wrong because `storage-driver` defines the storage backend (e.g., overlay2, aufs) for container layers, not registry TLS settings. Option D is wrong because `log-driver` configures the logging driver for containers (e.g., json-file, syslog), and has no role in registry TLS enforcement.

Full explanation →
42
MCQmedium

A developer needs to run a one-time script after the network is up on a systemd-based server. Which unit type should be used?

A.forking
B.exec
C.simple
D.oneshot
AnswerD

Oneshot units run a single command and then exit.

Why this answer

The `oneshot` unit type is correct because it is designed for services that run a single task to completion and then exit, making it ideal for a one-time script that must execute after the network is up. In systemd, `oneshot` units can be configured with `RemainAfterExit=no` (the default) to indicate they do not need to stay running, and they support ordering dependencies like `After=network-online.target` to ensure the network is available before the script runs.

Exam trap

The trap here is that candidates confuse `oneshot` with `simple` or `forking`, mistakenly thinking a one-time script needs to remain running (`simple`) or fork into the background (`forking`), but systemd's `oneshot` is explicitly designed for tasks that exit after completion.

How to eliminate wrong answers

Option A is wrong because `forking` is used for daemons that fork into the background after startup, and systemd tracks the parent process; a one-time script that exits does not fork, so this type is inappropriate. Option B is wrong because `exec` is not a valid systemd service type; the correct types are `simple`, `forking`, `oneshot`, `dbus`, `notify`, and `idle`. Option C is wrong because `simple` is for services that start and remain running in the foreground, which does not match a one-time script that exits after execution.

Full explanation →
43
MCQmedium

A Linux administrator needs to locate all files in the /var/log directory that have been modified within the last 2 days and contain the word 'error' (case-insensitive). Which command accomplishes this?

A.find /var/log -mtime +2 -exec grep -li 'error' {} \;
B.find /var/log -name '*error*' -mtime -2
C.find /var/log -mtime -2 -exec grep -l 'error' {} \;
D.find /var/log -mtime -2 -exec grep -li 'error' {} \;
AnswerD

Correctly finds files modified within 2 days and searches for 'error' case-insensitively.

Why this answer

The correct command uses -mtime -2 to find files modified less than 2 days ago, and -exec grep -li 'error' to perform a case-insensitive search for 'error' in file contents, listing filenames. Option A uses -mtime +2 (files older than 2 days). Option B uses -name to match filenames, not content.

Option C uses grep -l without -i, so it would miss case variations.

Full explanation →
44
Multi-Selecthard

An administrator is configuring auditd to monitor changes to the /etc/passwd file. Which three commands are part of the auditd toolset for setting up and reviewing audit rules?

Select 3 answers
A.aureport
B.ausearch
C.aulog
D.auditctl
E.auditd
AnswersA, B, D

Generates summary reports from audit logs.

Why this answer

auditctl adds rules, ausearch searches logs, aureport generates reports. auditd is the daemon, not a command for rules. aulog is not a standard tool.

Full explanation →
45
MCQmedium

An administrator wants to use Ansible to ensure a service is running on a remote host. Which Ansible module should be used in a playbook?

A.service
B.command
C.copy
D.shell
AnswerA

Correct. The service module ensures a service is started, stopped, restarted, etc.

Why this answer

The service module manages services on remote hosts. The command and shell modules run arbitrary commands but are not idempotent. The copy module copies files.

Full explanation →
46
MCQmedium

A system administrator needs to find all files in the /etc directory that are larger than 1 MB and are regular files. Which find command accomplishes this?

A.find /etc -type f -size +1M
B.find /etc -size +1MB -type f
C.find /etc -type f -size 1M
D.find /etc -type d -size +1M
E.find /etc -size +1M -type f
AnswerA

Correct. Uses -type f to select regular files and -size +1M for files larger than 1 MB.

Why this answer

Only option A correctly accomplishes the task. Option A uses -type f to select regular files and -size +1M to find files larger than 1 MB. Option B fails because the size suffix 'MB' is invalid; it should be 'M'.

Option C omits the '+' prefix, so it matches files exactly 1 MB, not larger. Option D is incorrect; it uses -type d, which selects directories, not regular files. Option E also uses -type d, and the order of predicates does not affect the output, but the type is wrong.

Full explanation →
47
MCQmedium

A system administrator wants to limit the number of simultaneous logins for a user to 2. Which file and parameter should be configured?

A./etc/pam.d/login: session required pam_limits.so
B./etc/security/limits.conf: username hard maxlogins 2
C./etc/security/limits.conf: @users hard maxlogins 2
D./etc/security/limits.conf: username soft nproc 2
AnswerB

Correct: limits.conf with hard maxlogins limits login count.

Why this answer

The `/etc/security/limits.conf` file allows setting resource limits per user or group, and the `maxlogins` parameter specifically controls the maximum number of simultaneous logins for a user. The syntax `username hard maxlogins 2` enforces a hard limit of 2 concurrent sessions for that user, which is the exact requirement. This limit is enforced by the PAM module `pam_limits.so`, which must be configured in the appropriate PAM stack file (e.g., `/etc/pam.d/login` or `/etc/pam.d/sshd`).

Exam trap

The Linux+ exam often tests the distinction between `maxlogins` (simultaneous logins) and `nproc` (number of processes), and the difference between `soft` and `hard` limits, causing candidates to confuse process limits with login limits or choose a group-based entry when a per-user entry is required.

How to eliminate wrong answers

Option A is wrong because `/etc/pam.d/login` is a PAM service configuration file, not a resource limit file; the line `session required pam_limits.so` is necessary to enable `pam_limits.so` but does not itself set any limit. Option C is wrong because `@users` refers to a group named 'users', not a specific username, and the question explicitly asks to limit a single user, not a group. Option D is wrong because `soft nproc 2` limits the number of processes (nproc) for the user, not the number of simultaneous logins (maxlogins), and using a soft limit allows the user to exceed it temporarily, which does not enforce a hard cap of 2 logins.

Full explanation →
48
Multi-Selecthard

An administrator is configuring a firewall using iptables to block all incoming traffic except SSH on port 22. Which three rules correctly implement this? (Choose THREE.)

Select 3 answers
A.iptables -A INPUT -p tcp --dport 22 -j DROP
B.iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
C.iptables -A INPUT -p tcp --dport 22 -j ACCEPT
D.iptables -A INPUT -j DROP
E.iptables -P INPUT DROP
AnswersB, C, E

Allows established and related connections.

Why this answer

The correct approach: set default policy to DROP on INPUT, then allow established/related connections, then allow SSH. The other options either drop all (blocking SSH), use wrong chain, or allow all.

Full explanation →
49
MCQhard

A Linux system administrator is troubleshooting a server that runs a web application. Users report that the web application occasionally returns 503 Service Unavailable errors. The Apache web server appears to be running (systemctl status httpd shows active). The server has 8GB RAM and runs multiple applications. The administrator runs free -m and sees that swap usage is at 75% while available memory is very low. The top output shows that a process named 'databased' is consuming 40% of memory. The databased process is not a core application and is not needed for the web server. The administrator wants to resolve the issue without restarting the server. What should the administrator do?

A.Enable the OOM killer to handle memory pressure automatically
B.Increase swap space by adding a swap file
C.Kill the databased process using kill -9
D.Reduce Apache's MaxClients setting
AnswerC

Immediately frees the memory held by the databased process, alleviating memory pressure.

Why this answer

The immediate cause of the 503 errors is memory exhaustion: swap is at 75% and available RAM is critically low. The non-essential 'databased' process is consuming 40% of memory, starving Apache. Killing it with kill -9 frees that memory instantly, resolving the pressure without a restart.

This directly addresses the root cause—a rogue process hogging RAM—rather than treating symptoms.

Exam trap

The trap here is that candidates may think increasing swap (Option B) or reducing Apache workers (Option D) will fix the 503 errors, but they overlook that the real issue is a specific non-essential process consuming the memory that Apache needs, making direct termination the only efficient fix without restarting.

How to eliminate wrong answers

Option A is wrong because enabling the OOM killer does not proactively free memory; it only kills processes when the system is completely out of memory, which may kill Apache or other critical services unpredictably. Option B is wrong because increasing swap space would only mask the problem by moving more data to disk, worsening performance and not freeing RAM for Apache. Option D is wrong because reducing MaxClients limits Apache's concurrency but does not reclaim the 40% of memory consumed by 'databased'; the web server would still be starved for RAM.

Full explanation →
50
MCQhard

A technician wants to create a symbolic link in /usr/local/bin that points to /opt/myapp/bin/start.sh. The technician has write permissions to /usr/local/bin. Which command should be used?

A.ln -s /opt/myapp/bin/start.sh /usr/local/bin/start.sh
B.ln -s /usr/local/bin/start.sh /opt/myapp/bin/start.sh
C.ln /opt/myapp/bin/start.sh /usr/local/bin/start.sh
D.cp -s /opt/myapp/bin/start.sh /usr/local/bin/start.sh
AnswerA

Creates a symbolic link.

Why this answer

ln -s target linkname creates a symbolic link. The target should be the file to link to, and the link name is the new symlink.

Full explanation →
51
Multi-Selectmedium

A system administrator wants to encrypt a large directory of files using GPG with a symmetric cipher. Which two steps are necessary? (Select TWO).

Select 2 answers
A.gpg --decrypt file.gpg
B.Use a passphrase to encrypt
C.gpg --encrypt --recipient user file
D.Import a public key
E.gpg --symmetric --cipher-algo AES256 file
AnswersB, E

Symmetric encryption requires a passphrase.

Why this answer

Symmetric encryption in GPG requires a passphrase to derive the encryption key. When using `gpg --symmetric`, the cipher key is generated from a passphrase provided by the user, making the passphrase the essential secret for both encryption and decryption. Without a passphrase, symmetric encryption cannot proceed.

Exam trap

The trap here is that candidates confuse symmetric encryption with asymmetric encryption and select `--recipient` or public key import, not realizing that `--symmetric` requires only a passphrase, not a key pair.

Full explanation →
52
MCQmedium

A user reports they cannot log in after three failed password attempts. The system uses PAM with pam_faillock. Which command can the administrator use to view the number of failed attempts for the user?

A.faillock --user username
B.ausearch -m USER_LOGIN -ui username
C.pam_tally2 --user username
D.lastb username
AnswerA

Correct. The faillock command with the --user option shows the number of failed login attempts recorded by pam_faillock.

Why this answer

The system uses PAM with pam_faillock, a modern lockout module. The 'faillock' command is specifically designed to display and manage failure counts for this module. 'pam_tally2' is used with the older pam_tally2 module and is not applicable here.

Full explanation →
53
Multi-Selectmedium

A Linux administrator needs to view real-time information about running processes, including CPU and memory usage. Which TWO commands can be used for this purpose? (Choose two.)

Select 2 answers
A.ps aux
B.top
C.systemctl list-units
D.htop
E.kill -l
AnswersB, D

Shows real-time processes.

Why this answer

top and htop provide real-time process information with CPU/memory usage. ps gives a snapshot; kill is for terminating; systemctl manages services.

Full explanation →
54
Multi-Selecteasy

A Linux administrator is creating a shell script to back up configuration files to a remote server. The script must ensure that if any command fails (e.g., rsync or tar), the script exits immediately and does not continue. Which TWO of the following should be included in the script to achieve this behavior? (Choose two.)

Select 2 answers
A.trap 'exit 1' ERR
B.set -o pipefail
C.set -x
D.set -e
E.set -u
AnswersA, D

Traps the ERR signal and exits when any command fails.

Why this answer

`trap 'exit 1' ERR` instructs the shell to execute `exit 1` whenever a command returns a non-zero exit status, which immediately terminates the script on any failure. Option D is correct because `set -e` causes the shell to exit immediately if any command (or pipeline, unless overridden) fails, providing a straightforward way to enforce fail-fast behavior in a backup script.

Exam trap

The trap here is that candidates often confuse `set -o pipefail` with `set -e`, thinking it alone causes script exit, or they mistakenly believe `set -x` or `set -u` handle command failures, when in fact only `set -e` and `trap ... ERR` directly enforce exit on any non-zero exit status.

Full explanation →
55
Multi-Selecteasy

Which TWO commands can be used to check disk space usage on a Linux system?

Select 2 answers
A.mount
B.lsof
C.du
D.fdisk
E.df
AnswersC, E

Summarizes disk usage of files/directories.

Why this answer

The `du` (disk usage) command estimates file and directory space usage, allowing you to check disk space consumed by specific paths. The `df` (disk free) command reports the total, used, and available space on mounted filesystems. Both are standard tools for inspecting disk space on Linux systems.

Exam trap

The trap here is that candidates may confuse `du` and `df` with commands like `mount` or `fdisk`, which are related to filesystem management but do not directly report disk space usage.

Full explanation →
56
MCQmedium

A system administrator wants to review kernel-related log messages from the current boot session. Which journalctl command should be used to filter the kernel messages?

A.journalctl -p err
B.journalctl -b -u systemd-journald
C.journalctl -k
D.journalctl --since today
AnswerC

-k displays kernel messages.

Why this answer

journalctl -k shows kernel messages from the current boot.

Full explanation →
57
MCQhard

A Linux server experiences a kernel panic during boot. You need to capture the panic message for analysis. Which kernel parameter should be added to the GRUB command line to ensure the panic message is displayed before the system halts?

A.panic=10
B.nomodeset
C.quiet
D.single
AnswerA

Adds a delay before rebooting after panic.

Why this answer

The `panic=<seconds>` kernel parameter instructs the kernel to wait the specified number of seconds after a kernel panic before automatically rebooting. By setting `panic=10`, the system pauses for 10 seconds, allowing the panic message to remain on the console for capture and analysis before the system halts or reboots. This is the correct parameter to ensure the panic output is visible.

Exam trap

The trap here is that candidates often confuse `panic=` with a boot-time delay or a recovery mode option, mistakenly thinking `single` or `quiet` will help display the panic message, when in fact `panic=` is the specific parameter that controls the post-panic behavior to keep the message visible.

How to eliminate wrong answers

Option B (`nomodeset`) is wrong because it disables kernel mode-setting for video drivers, which can help with display issues but does not affect the display or retention of kernel panic messages. Option C (`quiet`) is wrong because it suppresses most kernel log messages, including panic details, making it counterproductive for capturing panic output. Option D (`single`) is wrong because it boots the system into single-user mode (runlevel 1) for maintenance, which does not alter the behavior of kernel panic handling or message display.

Full explanation →
58
MCQmedium

Based on the exhibit, what is the most likely cause of the repeated connection refused errors?

A.The DNS resolution for the database host fails.
B.A firewall is blocking port 3306.
C.The database service is down.
D.The database credentials are incorrect.
AnswerC

Connection refused typically means no process listening.

Why this answer

The 'connection refused' error indicates that the client's TCP SYN packet reached the target host on port 3306, but the host actively rejected the connection because no process is listening on that port. This is the classic symptom of the MySQL/MariaDB database service being stopped or crashed, as the OS TCP stack sends an RST packet when a connection attempt hits a port with no listening socket.

Exam trap

CompTIA often tests the distinction between 'connection refused' (service down) and 'connection timeout' (firewall blocking) — candidates confuse the two because both prevent access, but the TCP error message uniquely identifies the cause.

How to eliminate wrong answers

Option A is wrong because DNS resolution failures would produce a 'Name or service not known' error, not a TCP-level 'connection refused'. Option B is wrong because a firewall blocking port 3306 would cause the connection to time out (no response) or be silently dropped, not produce an immediate 'connection refused' which requires a TCP RST from the target host. Option D is wrong because incorrect credentials result in an authentication failure after the TCP connection is established, typically returning 'Access denied for user' from the database server, not a transport-layer refusal.

Full explanation →
59
MCQmedium

A file on an SELinux-enabled system has the security context 'unconfined_u:object_r:httpd_sys_content_t:s0'. A web server needs to read it, but it is being denied. Which command changes the context to allow access?

A.chcon -t httpd_sys_content_t /path/to/file
B.setsebool -P httpd_read_content on
C.semanage fcontext -a -t httpd_sys_content_t /path/to/file
D.restorecon -v /path/to/file
AnswerB

setsebool -P httpd_read_content on enables the necessary boolean to allow httpd to read files with httpd_sys_content_t, fixing the access denial permanently.

Why this answer

The file already has the correct SELinux type 'httpd_sys_content_t', so the denial is likely due to a missing policy boolean. The command `setsebool -P httpd_read_content on` enables a boolean that permits the web server to read content labeled with that type. This permanently resolves the access issue without altering the file's context.

Exam trap

Candidates often mistakenly select `chcon` because it directly changes the context, but the file already has the correct type. Others may choose `semanage fcontext` thinking it will fix the denial, but adding a file-context rule does not alter the current context and won't resolve the immediate access problem. The correct approach is to adjust the SELinux boolean that controls the web server's ability to read the content.

How to eliminate wrong answers

Option B is wrong because `setsebool -P httpd_read_content on` toggles a boolean that controls whether Apache can read content from certain directories, but it does not change the file's SELinux context; the file's type must already match for the boolean to be effective. Option C is wrong because `semanage fcontext -a -t httpd_sys_content_t /path/to/file` adds a file context mapping to the SELinux policy database, but it does not immediately change the context of the existing file; a subsequent `restorecon` would be needed to apply it. Option D is wrong because `restorecon -v /path/to/file` restores the file's context based on the default policy mapping, but if the file's path is not defined in the policy with the correct type, it will not set `httpd_sys_content_t` and may leave the file with an incorrect type.

Full explanation →
60
MCQmedium

A technician needs to kill a process with PID 1234 that is not responding to normal termination. Which command sends SIGKILL?

A.kill 1234
B.kill -15 1234
C.kill -9 1234
D.kill -1 1234
AnswerC

kill -9 sends SIGKILL, forcefully killing the process.

Why this answer

kill -9 sends SIGKILL, which forcefully terminates the process.

Full explanation →
61
MCQeasy

Which of the following directories in the Filesystem Hierarchy Standard (FHS) contains variable data files such as logs, spool files, and temporary files that persist across reboots?

A./opt
B./etc
C./tmp
D./var
AnswerD

Correct: /var holds variable data like logs and spool.

Why this answer

/var is for variable data like logs, spool, and temporary files that persist. /tmp is for temporary files that may be cleared on reboot. /etc is for configuration files. /opt is for optional add-on software.

Full explanation →
62
MCQmedium

An administrator needs to create a Docker image from a Dockerfile located in the current directory and tag it as 'myapp:v1'. Which command should be used?

A.docker create -t myapp:v1 .
B.docker commit myapp:v1 .
C.docker build -t myapp:v1 .
D.docker image create myapp:v1 .
AnswerC

Correct. Builds and tags the image.

Why this answer

docker build with -t tag creates the image. The period indicates the build context.

Full explanation →
63
MCQmedium

A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?

A.pam_faillock.so
B.pam_tally2.so
C.pam_pwquality.so
D.pam_unix.so
AnswerA

Correct. pam_faillock is the recommended module in current Linux distributions to lock accounts after failed attempts, configurable in /etc/pam.d/sshd or system-auth.

Why this answer

pam_faillock is the recommended PAM module in modern Linux distributions (e.g., RHEL 7+, CentOS 7+) for locking accounts after a specified number of failed login attempts. While pam_tally2 is an older module, it is considered deprecated and not the standard answer for this exam. pam_pwquality is for password quality checking, and pam_unix handles standard authentication, not account locking. Therefore, only pam_faillock is the correct choice.

Full explanation →
64
MCQhard

A system administrator is creating an Ansible playbook to deploy a web server on a group of hosts. The playbook needs to install the nginx package, start the service, and ensure it is enabled on boot. Which playbook structure is correct?

A.--- - hosts: webservers tasks: - name: Install nginx apt: name: nginx state: present - name: Start and enable nginx service: name: nginx state: started enabled: yes
B.--- - hosts: webservers tasks: - name: Install nginx apt: name: nginx state: present - name: Start and enable nginx systemd: name: nginx state: started enabled: yes
C.--- - hosts: webservers tasks: - name: Install nginx command: apt install -y nginx - name: Start nginx command: systemctl start nginx
D.--- - hosts: webservers tasks: - name: Install nginx yum: name: nginx state: present - name: Start and enable nginx service: name: nginx state: started enabled: yes
AnswerA

Correct. Uses 'apt' to install nginx (implied Debian/Ubuntu) and 'service' module to start and enable it. The 'service' module works with both SysV and systemd, ensuring portability.

Why this answer

It uses the 'service' module, which abstracts away the underlying init system and works on both SysV init and systemd systems, making it the recommended cross-platform choice. Option B is incorrect because the 'systemd' module is specific to systemd-managed services; while it works on many modern Linux distributions, it may not be available on older systems, and the 'service' module is preferred for portability. Options C and D are incorrect: C uses raw 'command' and 'command' to run shell commands, bypassing Ansible's idempotency and module benefits; D uses 'yum' instead of 'apt', which is inconsistent with the Debian/Ubuntu context implied by the 'apt' module in the correct option.

Exam trap

Candidates often assume that because the service is managed by systemd, the 'systemd' module must be used. However, Ansible's 'service' module works with both SysV and systemd, and is the recommended module for managing services across all distributions.

Full explanation →
65
MCQhard

A Linux administrator wants to limit the disk space used by the /var/log directory. Which tool can be used to set disk usage quotas for a filesystem?

A.edquota
B.repquota
C.quotaon
D.quotacheck
AnswerA

edquota is used to edit user/group quotas.

Why this answer

quota is the traditional tool; however, xfs_quota is for XFS. The question is general, so quota is correct.

Full explanation →
66
Multi-Selectmedium

A technician wants to extract the third column of a tab-separated file and sort the output uniquely. Which three commands can be combined using pipes to achieve this? (Choose three.)

Select 3 answers
A.cut -f3
B.tee
C.wc -l
D.sort
E.uniq
AnswersA, D, E

Extracts third field.

Why this answer

cut extracts columns, sort sorts them, uniq removes duplicates. tee would write to file and stdout, not needed.

Full explanation →
67
Multi-Selectmedium

A Linux administrator is writing a Bash script that must accept command-line options for an input file (-i) and an output file (-o). Which of the following are valid methods to parse these options? (Choose TWO.)

Select 2 answers
A.Using positional parameters $1, $2 directly
B.Using a here-document
C.Using the shift command only
D.Using the getopt command
E.Using the getopts builtin command
AnswersD, E

getopt is another tool for option parsing.

Why this answer

getopts is a built-in for parsing options, and getopt is an external command. Both can be used.

Full explanation →
68
MCQmedium

A process is consuming excessive CPU. The administrator wants to reduce its priority. Which command should be used?

A.renice +10 PID
B.taskset -c 0 PID
C.nice -n -20 PID
D.chrt -r 99 PID
AnswerA

Lowers priority of a running process.

Why this answer

The `renice` command is used to change the priority of an already running process. By specifying `+10`, the administrator increases the nice value, which lowers the process's scheduling priority and reduces its CPU consumption. This directly addresses the requirement to reduce the priority of a currently executing process.

Exam trap

The trap here is confusing `nice` (which starts a new process with a specified priority) with `renice` (which changes the priority of an existing process), leading candidates to choose option C even though it uses a negative value that increases priority.

How to eliminate wrong answers

Option B is wrong because `taskset -c 0 PID` binds the process to CPU core 0, which does not change its scheduling priority or reduce CPU consumption; it only restricts which CPU the process can run on. Option C is wrong because `nice -n -20 PID` would start a new process with a very high priority (low nice value), which is the opposite of what is needed and does not apply to an already running process. Option D is wrong because `chrt -r 99 PID` sets the process to real-time FIFO scheduling with the highest priority (99), which would increase its CPU priority, not reduce it.

Full explanation →
69
MCQeasy

A new user 'jdoe' has been added using the command 'useradd jdoe', but upon first login, the user receives a message that the home directory does not exist. Which command should the administrator run to resolve this issue while also populating the home directory with default skeleton files?

A.chown jdoe:jdoe /home/jdoe
B.mkdir /home/jdoe; cp /etc/skel/* /home/jdoe/
C.usermod -d /home/jdoe jdoe
D.useradd -m jdoe
AnswerD

The -m flag creates the home directory and copies skeleton files from /etc/skel.

Why this answer

The `useradd -m jdoe` command creates the user's home directory and copies the default skeleton files from `/etc/skel` into it. Since the user was initially created without the `-m` flag, the home directory was not created, causing the login error. Running `useradd -m` on an existing user will create the missing home directory and populate it with skeleton files, resolving the issue.

Exam trap

The trap here is that candidates may think `usermod -d` (Option C) will both set and create the home directory, but it only updates the path in `/etc/passwd` without creating the directory or copying skeleton files, which is a common misconception in Linux user management.

How to eliminate wrong answers

Option A is wrong because `chown jdoe:jdoe /home/jdoe` only changes the ownership of the home directory; it does not create the directory if it does not exist, nor does it populate it with skeleton files. Option B is wrong because while `mkdir /home/jdoe; cp /etc/skel/* /home/jdoe/` creates the directory and copies skeleton files, it does not update the user's home directory path in `/etc/passwd` if it was not set, and it may miss hidden files (dotfiles) in `/etc/skel` unless using `cp -r` or `cp -a`. Option C is wrong because `usermod -d /home/jdoe jdoe` only changes the home directory path in the user database; it does not create the directory or populate it with skeleton files.

Full explanation →
70
MCQmedium

A Linux system is running slowly with high I/O wait as shown by vmstat. To investigate the I/O activity of a specific process that is suspected of causing the bottleneck, which of the following commands would be used to trace its system calls related to I/O?

A.iostat -x 1
B.strace -p <pid>
C.dmesg | tail
D.free -h
AnswerB

strace traces system calls of a process, including I/O calls like read/write.

Why this answer

The 'wa' in vmstat indicates CPU time spent waiting for I/O. To examine what I/O operations a particular process is performing, strace can be used to trace system calls such as read, write, and ioctl. By attaching to the process with strace -p <pid>, the administrator can see the I/O calls being made in real time. iostat provides aggregated per-device statistics, not per-process details. dmesg shows kernel messages, which may contain I/O errors but not process-level I/O patterns. free displays memory usage and is unrelated to I/O tracing.

Full explanation →
71
Multi-Selecthard

A security audit reveals that a Linux system allows password-based SSH logins and has weak password policies. Which THREE actions should the administrator take to improve security? (Choose three.)

Select 3 answers
A.Change SSH port to 2222
B.Configure pam_faillock.so to lock accounts after failed attempts
C.Configure pam_pwquality.so to enforce password complexity
D.Set PasswordAuthentication no in sshd_config
E.Set PermitRootLogin yes
AnswersB, C, D

Prevents brute force.

Why this answer

Disabling password authentication, enforcing password complexity via pam_pwquality, and setting account lockout via pam_faillock are three strong measures. Changing SSH port is a minor hardening but not as effective as the other three. Enabling root login is bad.

Full explanation →
72
MCQmedium

A junior administrator is writing a bash script that should exit immediately if any command in a pipeline fails. Which command should be added at the beginning of the script?

A.set -u
B.shopt -s extglob
C.set -e
D.set -o pipefail
AnswerD

Ensures pipeline fails on any component error.

Why this answer

`set -o pipefail` ensures that if any command in a pipeline fails (returns a non-zero exit status), the entire pipeline is considered to have failed, and with `set -e` (which is often used alongside it), the script will exit immediately. This is specifically required by the question: 'exit immediately if any command in a pipeline fails.' Without `pipefail`, only the exit status of the last command in the pipeline is considered, so earlier failures would be ignored.

Exam trap

The trap here is that candidates often choose `set -e` (option C) thinking it covers all command failures, but they overlook that `set -e` does not propagate failures through pipelines unless `set -o pipefail` is also set, which is the specific requirement in the question.

How to eliminate wrong answers

Option A is wrong because `set -u` causes the script to exit when an unset variable is referenced, but it does nothing to handle pipeline failures or exit on command errors. Option B is wrong because `shopt -s extglob` enables extended pattern matching in bash (e.g., `?(pattern)`, `*(pattern)`), which is unrelated to error handling or pipeline exit behavior. Option C is wrong because `set -e` alone causes the script to exit on a command failure, but it does not apply to pipelines; by default, only the last command in a pipeline determines the exit status, so a failure in an earlier command would not trigger `set -e`.

Full explanation →
73
MCQhard

A server with multiple disks is configured with RAID 5 for performance and redundancy. The administrator notices that write performance is lower than expected. Which RAID level would provide better write performance while still offering fault tolerance with the same number of disks (minimum 4)?

A.RAID 0
B.RAID 6
C.RAID 10
D.RAID 1
AnswerC

RAID 10 combines striping and mirroring, providing high write performance and fault tolerance.

Why this answer

RAID 10 (striping of mirrors) provides better write performance than RAID 5 because it does not incur the overhead of calculating and writing parity data on every write operation. With a minimum of four disks, RAID 10 offers fault tolerance (each mirror can survive one disk failure) while delivering the full write speed of the underlying disks, unlike RAID 5 which must update parity across all disks.

Exam trap

The trap here is that candidates often assume RAID 6 offers better fault tolerance than RAID 5 without considering that its double parity further degrades write performance, and they overlook that RAID 10 provides both performance and redundancy with the same minimum disk count.

How to eliminate wrong answers

Option A is wrong because RAID 0 offers no fault tolerance; it stripes data without redundancy, so any single disk failure causes complete data loss. Option B is wrong because RAID 6 uses double parity, which adds even more write overhead than RAID 5, resulting in worse write performance. Option D is wrong because RAID 1 (mirroring) with four disks would require all disks to be paired into mirrors, but it does not provide striping for performance gains; RAID 10 combines mirroring and striping to achieve both performance and fault tolerance.

Full explanation →
74
MCQhard

A Linux system fails to boot and displays a kernel panic immediately after the GRUB menu. The administrator needs to boot into a rescue environment. Which GRUB boot parameter should the administrator add to the kernel line?

A.single
B.init=/bin/bash
C.systemd.unit=rescue.target
D.quiet splash
AnswerC

Boots into systemd rescue target.

Why this answer

When a Linux system experiences a kernel panic immediately after GRUB, the administrator needs to boot into a minimal rescue environment that loads essential system services. The `systemd.unit=rescue.target` parameter tells systemd to start the rescue target, which mounts the root filesystem and starts only the most basic services, allowing the administrator to diagnose and repair the system. This is the proper GRUB kernel parameter for systemd-based distributions to enter a rescue shell without fully booting into the default multi-user or graphical target.

Exam trap

The trap here is that candidates confuse the legacy SysVinit `single` parameter or the direct `init=/bin/bash` shortcut with the correct systemd-based rescue target, not realizing that modern distributions require the `systemd.unit=` syntax to properly initialize the rescue environment with necessary services and filesystem mounts.

How to eliminate wrong answers

Option A is wrong because `single` is a legacy SysVinit parameter that boots into single-user mode, but on modern systemd-based distributions, it is often mapped to `rescue.target`; however, it is not the correct GRUB kernel parameter for systemd rescue environments and may not work reliably with kernel panics. Option B is wrong because `init=/bin/bash` bypasses the init system entirely and drops directly into a Bash shell without mounting the root filesystem properly or starting any services, which can lead to a read-only root filesystem and lack of necessary tools for recovery. Option D is wrong because `quiet splash` are kernel parameters that suppress boot messages and show a splash screen; they do not change the boot target and will not prevent a kernel panic or provide a rescue environment.

Full explanation →
75
MCQmedium

A system administrator needs to configure a Linux server to automatically synchronize time with the NTP pool servers. The server should also act as an NTP peer for other servers on the local network. Which file should be modified, and which directive should be added?

A./etc/chrony/chrony.conf with "pool pool.ntp.org iburst" and "allow 192.168.1.0/24"
B./etc/npt.conf with "peer pool.ntp.org"
C./etc/systemd/timesyncd.conf with "NTP=pool.ntp.org" and "LocalPort=123"
D./etc/ntp.conf with "server pool.ntp.org iburst"
AnswerA

Correct file and directives for both client sync and allowing other servers to peer.

Why this answer

The system uses chrony (the default NTP implementation on modern RHEL/CentOS 8+ and many other distributions). The `pool` directive with `iburst` synchronizes time from NTP pool servers, and the `allow` directive grants local subnet peers access to the chronyd service, enabling the server to act as an NTP peer for other hosts on 192.168.1.0/24.

Exam trap

The trap here is that candidates often confuse the legacy `ntpd` configuration file (`/etc/ntp.conf`) with the modern `chrony` configuration file (`/etc/chrony/chrony.conf`) and forget that only chrony (or ntpd with proper restrict rules) can act as a server/peer, while systemd-timesyncd is a client-only service.

How to eliminate wrong answers

Option B is wrong because `/etc/npt.conf` is not a valid configuration file; the correct path for the legacy NTP daemon is `/etc/ntp.conf`, and the directive `peer` is used for symmetric active peering with another NTP server, not for synchronizing from pool servers. Option C is wrong because `/etc/systemd/timesyncd.conf` is used by systemd-timesyncd, which only acts as an SNTP client and cannot serve time to other hosts (it lacks the `allow` directive and peer functionality). Option D is wrong because while `/etc/ntp.conf` is a valid file for the legacy NTP daemon, it only configures the server as a client (using `server` directive) and does not include the `allow` directive needed to act as a peer for other local servers.

Full explanation →

Page 1 of 14

Page 2

All pages

1234567891011121314

Practice XK0-006 by domain

Target a specific domain to shore up weak areas.

Services and User ManagementSecurityTroubleshootingAutomation, Orchestration, and ScriptingSystem Management
See all domains with question counts →