Courseiva

CompTIA Linux+ XK0-005 (XK0-005) — Questions 751–825

981 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 10

Page 11 of 14

Page 12
751
Multi-Selecthard

A system administrator is investigating a performance issue. Which THREE commands can be used to monitor running processes in real-time? (Select THREE).

Select 3 answers
A.zgrep
B.cat
C.zcat
D.less
E.zless
AnswersA, C, E

zgrep searches within compressed files.

Why this answer

top, htop, and ps with repeated execution can monitor processes in real-time. However, ps by itself is a snapshot, but watch ps can provide real-time. Typically, top and htop are real-time, and ps is not.

The question asks for commands that can be used to monitor in real-time. watch can be used with ps, but the option 'ps aux' alone is not real-time. I'll adjust: top, htop, and 'watch -n 1 ps aux' is not an option. I'll change the options to include top, htop, and 'ps -aux' might be considered if used with watch, but usually exam expects top/htop/atop.

I'll make 'top', 'htop', and 'atop' as correct if available. But I have only 5 options. Let me design: A: top, B: htop, C: ps -ef, D: lsof, E: iostat.

The correct ones are top and htop (real-time). ps is snapshot, lsof lists open files, iostat is I/O. To have three correct, I need to include something like 'watch ps' but not available. I can make 'atop' an option.

I'll change the stem to 'Which THREE commands provide real-time process monitoring?' and include top, htop, and atop. But I don't have atop in the domain content. Alternatively, I can include 'pstree'? No.

I'll keep it simple: top, htop, and 'ps -aux' is not real-time. Actually, the correct answer should be top, htop, and maybe 'vmstat'? But vmstat is system-wide. Let me reconsider: The domain includes 'top, htop'.

So I'll make two correct and one incorrect? The question requires exactly three correct for multi_select with 'Which THREE'. I'll include 'top', 'htop', and 'ps -ef' as incorrect, but need three correct. I'll add 'atop' as a correct option, even though not in domain, it's a common tool.

Alternatively, I can use 'pidstat'? Not in domain. To stay within domain, I'll use 'top', 'htop', and 'ps -aux' but explain that ps with watch is not an option. Since the question is hard, I can make 'ps -aux' correct if interpreted as part of 'ps aux' repeatedly.

But typically exam expects top/htop for real-time. I'll change the options: A: top, B: htop, C: ps -aux, D: iostat, E: free. The correct are A and B only, but need three.

So I need to add another real-time command: 'watch -n 1 ps -aux' is not an option. Perhaps 'pkill'? No. I'll change the stem to 'Which TWO commands' to avoid issue.

But the breakdown requires 3 multi_select: 2 of them 'Which TWO' and 1 'Which THREE'. I already have a 'Which TWO' above. So this one must be 'Which THREE'.

I'll make it 'Which THREE commands can be used to view system boot messages?' and include dmesg, journalctl -k, and cat /var/log/messages? That might work. But the domain includes journalctl. Let me create a new scenario.

I'll change this question to something else. Let's do: 'A technician needs to display the contents of a compressed log file without decompressing it. Which THREE commands can be used? (Select THREE).' Options: zcat, zless, zgrep, cat, less.

Correct: zcat, zless, zgrep. That works. So I'll replace the current question.

Full explanation →
752
Multi-Selecthard

An administrator is troubleshooting a slow system. Which two commands can be used to identify processes consuming excessive CPU or memory? (Choose two.)

Select 2 answers
A.free -m
B.iostat -x
C.ps aux --sort=-%mem
D.df -h
E.top
AnswersC, E

ps with sorting shows processes by memory usage.

Why this answer

Option C is correct because `ps aux --sort=-%mem` lists all processes with their memory usage, sorted by memory consumption in descending order, making it easy to identify processes consuming excessive memory. Option E is correct because `top` provides a real-time, dynamic view of system processes, including CPU and memory usage, and allows sorting by these metrics interactively.

Exam trap

CompTIA often tests the distinction between system-level resource commands (like `free`, `df`, `iostat`) and process-level monitoring commands (`ps`, `top`), leading candidates to choose commands that show overall usage rather than per-process details.

Full explanation →
753
MCQhard

A Linux server experiences a kernel panic after a recent driver update. The system is still operational but unstable. Which command should be used to gather detailed information about the kernel modules currently loaded?

A.modinfo
B.lsmod
C.dmesg
D.modprobe -l
AnswerB

Lists all loaded kernel modules.

Why this answer

B is correct because `lsmod` lists all currently loaded kernel modules by reading the `/proc/modules` file, showing their size, usage count, and dependencies. In a kernel panic scenario after a driver update, this command quickly reveals which modules are active, helping identify the problematic driver without further destabilizing the system.

Exam trap

The trap here is that candidates confuse `lsmod` (runtime loaded modules) with `modinfo` (module metadata) or `dmesg` (kernel logs), or mistakenly think `modprobe -l` lists loaded modules when it actually lists available modules (and is deprecated).

How to eliminate wrong answers

Option A is wrong because `modinfo` displays detailed metadata about a specific kernel module (e.g., author, description, parameters), but it does not list currently loaded modules; it requires the module name as an argument and reads the module file, not runtime state. Option C is wrong because `dmesg` prints the kernel ring buffer messages, which can show panic logs and driver errors, but it does not list currently loaded modules; it is useful for post-mortem analysis but not for a real-time inventory of loaded modules. Option D is wrong because `modprobe -l` is not a valid option in modern Linux; `modprobe` is used to load or unload modules, and listing available modules is done with `modprobe -l` only in older versions (deprecated), but it lists all installable modules, not those currently loaded.

Full explanation →
754
MCQhard

Given an ACL entry 'u:john:rwx' on a file, which command would remove only the ACL entry for user john without affecting other ACL entries?

A.setfacl -k /path/to/file
B.setfacl -m u:john:- /path/to/file
C.setfacl -x u:john /path/to/file
D.setfacl -b /path/to/file
AnswerC

-x removes the specified entry.

Why this answer

setfacl -x removes a specific ACL entry. The syntax 'u:john' removes the ACL for user john.

Full explanation →
755
MCQhard

Refer to the exhibit. An administrator can SSH to the server but cannot ping 10.0.0.1. What is the most likely cause?

A.The destination host 10.0.0.1 is not responding to ping due to a firewall or ICMP being disabled on that host.
B.The ping is being blocked by the nftables output chain, which is not configured.
C.ICMP is blocked by the nftables input chain policy drop.
D.The destination host 10.0.0.1 does not have a route back.
AnswerA

The 'Destination Port Unreachable' message indicates the remote host received the ping but sent back an ICMP unreachable, likely because ping is disabled or filtered on that host.

Full explanation →
756
MCQeasy

A system administrator needs to check the current runlevel on a system that uses systemd. Which command should the administrator use?

A.hostnamectl
B.getenforce
C.systemctl get-default
D.uname -r
AnswerC

Displays the default target (runlevel equivalent).

Why this answer

Option C is correct because `systemctl get-default` displays the default target (runlevel equivalent) on a systemd-based Linux system. Systemd uses targets instead of traditional SysV runlevels, and this command shows which target is set as the default at boot, such as `multi-user.target` or `graphical.target`.

Exam trap

The trap here is that candidates familiar with SysV init may expect a command like `runlevel` or `who -r`, but systemd uses `systemctl get-default` for the default target and `systemctl list-units --type=target` to see the current active target, not a direct runlevel command.

How to eliminate wrong answers

Option A is wrong because `hostnamectl` is used to query or change the system hostname and related settings, not to check the current runlevel or default target. Option B is wrong because `getenforce` is a SELinux command that returns the current enforcement mode (Enforcing, Permissive, or Disabled), and has nothing to do with runlevels or systemd targets. Option D is wrong because `uname -r` prints the kernel release version, not the runlevel or default target.

Full explanation →
757
Multi-Selectmedium

A system administrator is troubleshooting a network issue where a server cannot reach external websites. The server can ping the default gateway and internal hosts. Which TWO commands should the administrator use to further diagnose the problem? (Choose TWO.)

Select 2 answers
A.nslookup google.com
B.route -n
C.ping 127.0.0.1
D.ifconfig eth0
E.traceroute 8.8.8.8
AnswersA, E

Tests DNS resolution; if it fails, that could be the reason for not reaching external sites by name.

Why this answer

The server can reach internal hosts and the default gateway, which rules out Layer 2/3 connectivity issues within the local network. However, it cannot reach external websites, suggesting a DNS resolution failure or a routing problem beyond the gateway. 'nslookup google.com' (A) tests DNS resolution by querying the configured DNS server for the IP address of google.com; if it fails, the issue is with DNS. 'traceroute 8.8.8.8' (E) traces the path to a known external IP (Google's public DNS), bypassing DNS, to determine if packets are being dropped or misrouted after the gateway.

Exam trap

The trap here is that candidates often choose 'route -n' (B) thinking it will show a missing default route, but since the server can ping the gateway, the default route is present; the real issue is either DNS or a routing problem beyond the first hop, which 'traceroute' (E) specifically addresses.

Full explanation →
758
MCQmedium

A cron job runs a script that uses a command only available in a custom directory. The script fails from cron but works in the user's shell. Which of the following is the most common cause?

A.The script is not executable
B.The script has incorrect line endings
C.The cron job runs as root but command is in user's PATH
D.The cron job does not source the user's .bashrc
AnswerD

Cron's minimal environment lacks the custom PATH defined in .bashrc.

Why this answer

The most common cause is that cron jobs run in a minimal environment and do not source the user's shell initialization files like .bashrc. This means the custom directory containing the command is not in the PATH variable when the script executes under cron, even though it works in the user's interactive shell where .bashrc is sourced.

Exam trap

CompTIA often tests the misconception that cron inherits the user's interactive shell environment, leading candidates to incorrectly choose option C (user mismatch) instead of recognizing that cron does not source shell initialization files.

How to eliminate wrong answers

Option A is wrong because if the script were not executable, it would fail in both the user's shell and cron, not just cron. Option B is wrong because incorrect line endings (e.g., Windows CRLF) would cause syntax errors in both environments, not selectively in cron. Option C is wrong because if the cron job runs as root, root's PATH typically includes system directories, but the custom directory is unlikely to be in root's PATH either; however, the question states the command is in a custom directory, and the core issue is that cron does not source any user's shell profile, so the PATH is not set to include that custom directory regardless of the user.

Full explanation →
759
MCQmedium

An Apache web server hosted on a Linux system is unable to connect to a backend database server on port 3306. Based on the exhibit, which action should the administrator take to resolve the issue?

A.Set the httpd_can_network_connect boolean to on.
B.Disable SELinux by setting SELINUX=disabled in /etc/selinux/config.
C.Enable the httpd_enable_home_dirs boolean.
D.Change the SELinux context of the index.html file to httpd_sys_content_t.
AnswerA

This boolean controls whether httpd can initiate outbound network connections.

Why this answer

The Apache web server cannot connect to the backend database server on port 3306 because SELinux is blocking the outbound network connection. The boolean `httpd_can_network_connect` controls whether the httpd daemon is allowed to initiate outbound TCP connections to remote hosts. Setting this boolean to `on` permits Apache to connect to the database server, resolving the connectivity issue without disabling SELinux entirely.

Exam trap

CompTIA often tests the misconception that SELinux issues are always file-context problems, leading candidates to choose a file-context fix (Option D) when the actual issue is a network connection boolean.

How to eliminate wrong answers

Option B is wrong because disabling SELinux entirely (SELINUX=disabled) removes all SELinux protections, which is an insecure and overly broad solution that violates the principle of least privilege; the correct approach is to enable only the specific boolean needed. Option C is wrong because the `httpd_enable_home_dirs` boolean controls whether httpd can access user home directories (e.g., for UserDir), not outbound network connections to a database server. Option D is wrong because changing the SELinux context of `index.html` to `httpd_sys_content_t` affects file access for serving web content, not the ability of httpd to make outbound TCP connections to a remote database.

Full explanation →
760
MCQhard

An administrator wants to set an SELinux boolean that allows Apache to connect to databases. After setting the boolean, which option ensures the change persists across reboots?

A.setenforce 1
B.setsebool httpd_can_network_connect_db on
C.semanage boolean -m --on httpd_can_network_connect_db
D.setsebool -P httpd_can_network_connect_db on
AnswerD

-P makes it persistent.

Why this answer

setsebool -P makes the change permanent. Without -P, it only lasts until reboot.

Full explanation →
761
MCQhard

A user on a shared system cannot create files larger than 1MB, even though the filesystem has ample free space. Which command should the administrator use to investigate?

A.df -h
B.fdisk -l
C.lsblk
D.quota -u username
AnswerD

quota -u shows the user's disk quota limits and current usage.

Why this answer

Option D is correct because the `quota -u username` command displays the current disk quota limits and usage for a specific user. Since the user cannot create files larger than 1MB despite ample free space on the filesystem, the most likely cause is a per-user quota limit (soft or hard limit) restricting file size or total disk usage. This command directly checks whether quotas are enforced and what the limits are.

Exam trap

The trap here is that candidates see 'filesystem has ample free space' and immediately think of disk space commands like `df -h`, overlooking that user-level quotas can independently restrict file creation regardless of available free space.

How to eliminate wrong answers

Option A is wrong because `df -h` shows overall filesystem disk usage and free space, but it does not display per-user quota limits or usage; it would only confirm that the filesystem has free space, which is already known. Option B is wrong because `fdisk -l` lists partition tables and disk geometry, not user-level quotas or file size restrictions. Option C is wrong because `lsblk` lists block devices and their attributes (e.g., size, mount point), but it provides no information about user quotas or file creation limits.

Full explanation →
762
MCQhard

A company's web server running Apache on CentOS 7 has been compromised. The attacker exploited a vulnerability in the web application and gained access to the system as the 'apache' user. The administrator wants to prevent similar attacks in the future by hardening the server. Currently, the Apache process runs as the 'apache' user and can execute arbitrary code. The administrator considers enabling SELinux with targeted policy to confine the httpd daemon. However, after setting SELinux to enforcing and installing the 'httpd' SELinux package, the web server fails to serve pages over HTTPS. The administrator checks the audit log (/var/log/audit/audit.log) and sees denials related to port binding. What is the most likely cause of the issue?

A.The SSL certificate files have incorrect SELinux context (e.g., httpd_sys_content_t instead of cert_t)
B.The httpd binary must have the httpd_exec_t context
C.The boolean httpd_enable_homedirs must be enabled to allow HTTPS
D.The port 443 is not labeled with the http_port_t type; use semanage port -a -t http_port_t -p tcp 443
AnswerD

SELinux requires ports to be labeled for the daemon to bind. Without this, httpd cannot listen on 443.

Why this answer

The issue is that SELinux is blocking Apache from binding to port 443 because that port is not labeled with the http_port_t type. By default, SELinux only allows httpd to bind to ports that have the http_port_t context (e.g., 80, 443, 8080). If port 443 lacks this label, the httpd process will be denied permission to bind, even though the firewall may allow it.

The administrator must use `semanage port -a -t http_port_t -p tcp 443` to assign the correct SELinux port type.

Exam trap

The trap here is that candidates often focus on file contexts or booleans, overlooking that SELinux also controls network port access via port labeling, which is a distinct and frequently tested concept in the XK0-005 exam.

How to eliminate wrong answers

Option A is wrong because the SELinux context for SSL certificate files should be cert_t or httpd_sys_content_t, but incorrect file context would cause read/access denials, not port binding denials. Option B is wrong because the httpd binary already has the httpd_exec_t context by default when installed via the httpd package; this context is required for execution, not for port binding. Option C is wrong because the httpd_enable_homedirs boolean controls whether httpd can access user home directories, not whether it can bind to HTTPS ports.

Full explanation →
763
MCQeasy

A Linux administrator needs to change the permissions of a file to be readable and writable by the owner, readable by the group, and no access for others. Which command accomplishes this?

A.chmod 600 file
B.chmod 664 file
C.chmod 644 file
D.chmod 640 file
AnswerD

Correct: 640 gives owner rw, group r, others none.

Why this answer

The octal representation 640 sets owner read/write (6), group read (4), and others none (0).

Full explanation →
764
MCQhard

A system running systemd is failing to boot properly. The administrator wants to boot into an environment with only the essential services for troubleshooting. Which systemd target should be selected at boot?

A.multi-user.target
B.emergency.target
C.rescue.target
D.graphical.target
AnswerC

Correct: rescue.target provides a single-user shell with basic services.

Why this answer

rescue.target starts a minimal system with root filesystem mounted read-only and basic services.

Full explanation →
765
MCQmedium

After modifying the network configuration on a RHEL 8 system using NetworkManager, what command should be used to apply the changes without restarting the network service?

A.nmcli connection reload
B.nmcli con up 'System eth0'
C.ifup eth0
D.systemctl restart NetworkManager
AnswerB

Brings up the connection with updated settings.

Why this answer

nmcli con up <connection> activates the connection with new settings. nmcli connection reload reloads from disk but does not apply to active connections.

Full explanation →
766
MCQeasy

Refer to the exhibit. Which service is likely causing the longest boot delay?

A.sshd.service
B.firewalld.service
C.network.service
D.postfix.service
AnswerB

Has the highest boot time in the list.

Why this answer

The exhibit shows that firewalld.service has the longest time in the 'active' state during boot, as indicated by the 'time' column in the systemd-analyze blame output. Firewalld initializes complex netfilter/iptables rules and applies them to all network interfaces, which can be CPU-intensive and take several seconds, especially with many rules or zones. This makes it the primary contributor to boot delay compared to the other listed services.

Exam trap

Cisco often tests the trap that candidates assume network.service or sshd.service cause the longest delay because they are network-related, but the systemd-analyze blame output clearly shows firewalld with a higher time value, and the question specifically asks for the longest boot delay.

How to eliminate wrong answers

Option A is wrong because sshd.service typically starts quickly as it only needs to bind to a port and load its configuration, showing a much shorter boot time in the blame output. Option C is wrong because network.service, while it may take some time to bring up interfaces via DHCP or static configuration, usually completes faster than firewalld due to parallel startup and simpler operations. Option D is wrong because postfix.service is a mail transfer agent that starts after network is up and has minimal impact on boot time, often completing in under a second.

Full explanation →
767
MCQhard

A Linux administrator is configuring a firewall using iptables to allow incoming HTTP and HTTPS traffic but block all other incoming traffic. Which set of rules should be applied?

A.iptables -P INPUT DROP; iptables -A INPUT -p tcp -j ACCEPT
B.iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -j DROP
C.iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT
D.iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT
AnswerC

Default DROP blocks all; allow only HTTP/HTTPS.

Why this answer

Option C is correct because it sets the default policy for the INPUT chain to DROP, which blocks all incoming traffic by default, and then explicitly adds rules to ACCEPT TCP traffic on ports 80 (HTTP) and 443 (HTTPS). This implements a whitelist approach: only the specified services are allowed, and all other incoming packets are dropped by the default policy. The order is critical — the ACCEPT rules must be evaluated before the default DROP policy takes effect for unmatched traffic.

Exam trap

The trap here is that candidates often confuse the default policy with explicit rules, thinking that setting a default ACCEPT and then adding a DROP rule at the end will block all other traffic, but the default policy is evaluated only after all rules are checked, so a default ACCEPT will allow unmatched traffic regardless of a final DROP rule.

How to eliminate wrong answers

Option A is wrong because it sets the default policy to DROP but then adds a rule that accepts all TCP traffic regardless of destination port, which would allow all TCP-based traffic (including SSH, SMTP, etc.), not just HTTP and HTTPS. Option B is wrong because it sets the default policy to ACCEPT, which allows all incoming traffic by default, and then adds ACCEPT rules for ports 80 and 443 (which are redundant since the default already accepts everything), and finally adds a DROP rule that would only affect packets not matched by the earlier ACCEPT rules — but because the default policy is ACCEPT, the final DROP rule is effectively useless for traffic that doesn't match the earlier rules (since the default already accepts it). Option D is wrong because it sets the default policy to ACCEPT, which permits all incoming traffic, and then adds ACCEPT rules for ports 80 and 443 (which are unnecessary), but does not include any rule to block other traffic, so all incoming traffic is allowed.

Full explanation →
768
Multi-Selecteasy

Which of the following commands can be used to display the contents of a file one page at a time? (Choose two.)

Select 2 answers
A.less
B.head
C.cat
D.tail
E.more
AnswersA, E

Correct: less is a pager.

Why this answer

The `less` command is a pager that displays file contents one screen at a time, allowing both forward and backward navigation. It is designed for viewing large files interactively, loading only the visible portion into memory for efficiency.

Exam trap

The trap here is that candidates may confuse `cat` as a pagination tool because it displays file contents, but it lacks any paging or interactive control, while `head` and `tail` are often mistakenly thought to paginate because they show a subset of lines.

Full explanation →
769
MCQeasy

Which command displays the current SELinux mode?

A.sestatus
B.setenforce
C.selinuxenabled
D.getenforce
AnswerD

Displays the current SELinux mode.

Why this answer

The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It reads the enforcing status directly from the kernel, making it the correct choice for checking the runtime mode.

Exam trap

The trap here is that candidates confuse `sestatus` (which also shows the mode) with `getenforce`, but the exam expects the command specifically designed to output only the mode, and `setenforce` is often mistakenly chosen because it sounds like it 'gets' the enforce status.

How to eliminate wrong answers

Option A is wrong because `sestatus` displays comprehensive SELinux status information including the current mode, policy version, and loaded policy, but it is not the command that solely displays the mode; however, the question asks for the command that displays the current SELinux mode, and `sestatus` does show it, but `getenforce` is the more direct and standard command for this purpose. Option B is wrong because `setenforce` is used to change the SELinux mode (e.g., `setenforce 0` for Permissive, `setenforce 1` for Enforcing), not to display it. Option C is wrong because `selinuxenabled` is a command that returns an exit status indicating whether SELinux is enabled (0 if enabled, 1 if not), but it does not display the current mode.

Full explanation →
770
MCQmedium

A developer is writing a Bash script that needs to parse command-line options with arguments, such as -f filename and -v. Which built-in command should be used to handle these options?

A.getopt
B.getopts
C.case
D.shift
AnswerB

getopts is the built-in command for parsing options in Bash.

Why this answer

getopts is the standard Bash built-in for parsing short options with or without arguments.

Full explanation →
771
MCQeasy

An administrator needs to run a backup script every day at 2:00 AM. The script is located at /usr/local/bin/backup.sh and is executable. The administrator considers several methods to schedule this task. Which method should the administrator use to ensure the script runs at exactly 2:00 AM every day without additional configuration overhead?

A.Add the following line to the crontab for root: `0 2 * * * /usr/local/bin/backup.sh`
B.Append the script path to /etc/rc.local file.
C.Place the script in /etc/cron.daily/ directory.
D.Create a systemd timer unit that triggers the script daily at 2:00 AM.
AnswerA

This crontab entry schedules the script to run at exactly 2:00 AM daily.

Why this answer

The correct method is to add a cron job via crontab because cron is the standard Unix/Linux utility for scheduling tasks at specific times. The syntax `0 2 * * *` precisely defines execution at 2:00 AM daily (minute 0, hour 2, every day, every month, every day of week), and the script path is fully qualified. This approach requires no additional configuration overhead beyond a single crontab entry.

Exam trap

The trap here is that candidates may confuse cron.daily (which runs daily but at a non-configurable time) with a user-crontab entry, or assume systemd timers are simpler than they actually are, overlooking the extra unit files required.

How to eliminate wrong answers

Option B is wrong because /etc/rc.local runs once at system boot, not at a specific daily time like 2:00 AM. Option C is wrong because /etc/cron.daily/ runs once per day but at a system-defined time (typically around 6:25 AM via anacron), not at exactly 2:00 AM, and it cannot be precisely scheduled. Option D is wrong because while a systemd timer can achieve the same result, it requires creating both a service unit and a timer unit, which introduces significantly more configuration overhead compared to a simple crontab entry.

Full explanation →
772
MCQmedium

A system administrator wants to ensure that a service starts automatically at boot time using systemd. Which command should be used?

A.systemctl start service
B.systemctl daemon-reload
C.systemctl reenable service
D.systemctl enable service
AnswerD

Correct: enable sets the service to start at boot.

Why this answer

systemctl enable creates symlinks to make the service start at boot.

Full explanation →
773
MCQmedium

You are a Linux administrator at a company that runs a web application in Docker containers on a single host. The application consists of a front-end container (nginx) and a back-end container (node.js). Recently, after a system update, the front-end container fails to start with the error: 'Error response from daemon: driver failed programming external connectivity on endpoint frontend: (iptables failed: iptables --wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.17.0.2 --dport 80 -j ACCEPT: iptables: No chain/target/match by that name)'. Which action should you take to resolve the issue?

A.Restart the Docker daemon with systemctl restart docker
B.Reinstall iptables
C.Change the network driver to macvlan
D.Update the kernel to the latest version
AnswerA

Restarting Docker recreates its iptables chains and rules, fixing the missing chain error.

Why this answer

The error indicates that the Docker daemon's iptables rules are corrupted or missing, often caused by a system update that restarted or modified the iptables service. Restarting the Docker daemon with `systemctl restart docker` forces Docker to reinitialize its iptables chains (e.g., DOCKER, DOCKER-USER) and reapply the necessary rules, resolving the connectivity failure.

Exam trap

CompTIA often tests the misconception that iptables itself is broken or needs reinstallation, when the real issue is that Docker's custom iptables chains were lost and need to be recreated by restarting the Docker daemon.

How to eliminate wrong answers

Option B is wrong because reinstalling iptables is unnecessary; the iptables command itself is present and functional (the error is about a missing chain, not a missing binary). Option C is wrong because changing the network driver to macvlan would alter the networking model but does not address the missing iptables chain; the issue is with Docker's default bridge network and its iptables rules. Option D is wrong because updating the kernel is not required; the error stems from a configuration mismatch between Docker and iptables, not a kernel compatibility issue.

Full explanation →
774
Multi-Selectmedium

Which TWO commands can be used to display the amount of free and used memory on a Linux system?

Select 2 answers
A.df -h
B.du -sh
C.free -h
D.cat /proc/meminfo
E.iostat
AnswersC, D

free displays memory usage in human-readable format.

Why this answer

The `free -h` command displays the total, used, and free physical memory (RAM) and swap space in a human-readable format. The `cat /proc/meminfo` command reads the kernel's memory statistics directly from the virtual filesystem, providing detailed information about memory usage, including free, available, buffered, and cached memory. Both commands are standard tools for inspecting memory utilization on a Linux system.

Exam trap

CompTIA often tests the distinction between disk space commands (`df`, `du`) and memory commands (`free`, `/proc/meminfo`), trapping candidates who confuse filesystem usage with RAM usage.

Full explanation →
775
MCQmedium

A user wants to run a command that will continue running even after the user logs out. Which command should be used?

A.disown command
B.command &
C.bg command
D.nohup command &
AnswerD

Correct: nohup prevents the command from being terminated on logout, & backgrounds it.

Why this answer

nohup makes the command immune to hangups and runs in the background.

Full explanation →
776
Multi-Selectmedium

A system administrator wants to display a list of all currently running processes, including those of other users, with full command lines. Which TWO commands can achieve this? (Select TWO.)

Select 2 answers
A.pstree
B.top
C.ps aux
D.htop
E.ps -ef
AnswersC, E

Correct: shows all processes with user info and full command line.

Why this answer

ps aux and ps -ef both show all processes with full command lines. top and htop show dynamic views but not in a static list format. pstree shows process tree.

Full explanation →
777
MCQmedium

A system administrator wants to ensure that a container can access host devices such as USB drives. Which Docker run option should be used?

A.--device /dev/ttyUSB0
B.--privileged
C.--pid=host
D.--net=host
AnswerA

This grants the container access to the specified host device.

Why this answer

The `--device` flag in Docker allows a container to directly access a specific host device, such as `/dev/ttyUSB0` for a USB drive or serial adapter. This grants the container read/write permissions to the device node without requiring full privileged access, making it the precise and secure option for this requirement.

Exam trap

The trap here is that candidates often choose `--privileged` because they think it is the only way to give a container hardware access, but the exam tests the understanding that `--device` provides granular, secure device access without the broad security implications of full privilege escalation.

How to eliminate wrong answers

Option B is wrong because `--privileged` grants the container all capabilities and full access to all host devices, which is excessive and a security risk; it is not the targeted solution for accessing a specific device like a USB drive. Option C is wrong because `--pid=host` shares the host's PID namespace with the container, allowing the container to see all host processes, but it does not provide any access to host devices. Option D is wrong because `--net=host` makes the container use the host's network stack directly, which affects networking only and has no effect on device access.

Full explanation →
778
MCQhard

An administrator needs to generate a self-signed certificate valid for 365 days with a 2048-bit RSA key. Which OpenSSL command correctly creates both the private key and certificate in one step?

A.openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
B.openssl x509 -req -in req.pem -signkey key.pem -out cert.pem -days 365
C.openssl ca -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
D.openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365
AnswerA

Single command that generates both key and self-signed certificate.

Why this answer

The 'req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes' generates a self-signed certificate with a key. Other commands either miss -x509, -newkey, or use wrong options.

Full explanation →
779
MCQeasy

Which Dockerfile instruction sets the command to run when the container starts, but allows the user to override it when using docker run?

A.RUN
B.STARTUP
C.ENTRYPOINT
D.CMD
AnswerD

Correct. CMD sets the default command, which can be overridden.

Why this answer

CMD provides defaults for an executing container. If CMD is used, it can be overridden by command-line arguments to docker run. ENTRYPOINT, on the other hand, is not easily overridden without --entrypoint.

Full explanation →
780
MCQmedium

An administrator needs to view the last 20 lines of the systemd journal for the 'sshd' service. Which command should be used?

A.systemctl status sshd | tail -20
B.journalctl -u sshd -n 20
C.journalctl -u sshd --since '1 hour ago'
D.journalctl -u sshd -f
AnswerB

Correct: -u specifies unit, -n limits lines to 20.

Why this answer

journalctl -u sshd -n 20 shows the last 20 lines of the journal for the sshd unit.

Full explanation →
781
MCQhard

An administrator needs to create a Docker network of type 'bridge' so that containers can communicate with each other by name. Which command creates a user-defined bridge network named 'my-net'?

A.docker network create my-net
B.docker create network -d bridge my-net
C.docker network create --driver=overlay my-net
D.docker network create -d bridge my-net
AnswerD

Correct. Creates a user-defined bridge network.

Why this answer

User-defined bridge networks provide automatic DNS resolution between containers. The command is 'docker network create' with the -d (driver) flag.

Full explanation →
782
MCQhard

A system administrator runs the command 'chmod 4755 /usr/local/bin/backup'. What effect does this have on the file?

A.Sets the sticky bit and gives rwxr-xr-x permissions
B.Sets the SUID bit and gives rwxr-xr-x permissions
C.Sets the SGID bit and gives rwxr-xr-x permissions
D.Sets the SUID bit and gives rwxrwxr-x permissions
AnswerB

SUID bit is set with 4xxx, permissions are 755.

Why this answer

The 4 in the first digit sets the SUID bit, so the file runs with the owner's permissions. 755 sets rwxr-xr-x.

Full explanation →
783
MCQmedium

An administrator needs to ensure that the SSH service only allows key-based authentication and disables password authentication. Which configuration file and directive should be modified?

A./etc/ssh/sshd_config; PasswordAuthentication yes
B./etc/ssh/sshd_config; PubkeyAuthentication no
C./etc/ssh/ssh_config; PasswordAuthentication no
D./etc/ssh/sshd_config; PasswordAuthentication no
AnswerD

Correct file and directive to disable password authentication.

Why this answer

Option D is correct because the SSH server configuration file is /etc/ssh/sshd_config, and setting 'PasswordAuthentication no' disables password-based logins, forcing key-based authentication. This directive must be set on the server side (sshd_config), not the client side (ssh_config), to enforce the policy for all incoming SSH connections.

Exam trap

The trap here is confusing the client configuration file (/etc/ssh/ssh_config) with the server configuration file (/etc/ssh/sshd_config), leading candidates to select option C, which would have no effect on the SSH server's authentication behavior.

How to eliminate wrong answers

Option A is wrong because 'PasswordAuthentication yes' would enable password authentication, which is the opposite of the required outcome. Option B is wrong because 'PubkeyAuthentication no' would disable public key authentication, preventing key-based access entirely. Option C is wrong because /etc/ssh/ssh_config is the client-side configuration file; modifying it only affects outgoing SSH connections from that host, not incoming connections to the SSH server.

Full explanation →
784
MCQmedium

An administrator wants to display the last 20 lines of a log file and also write those lines to a file called recent.log. Which command should be used?

A.tail -n 20 file > recent.log
B.head -n 20 file > recent.log
C.cat file | head -n 20 > recent.log
D.tail -n 20 file | tee recent.log
AnswerD

Correct: tail outputs last 20 lines, tee sends to both stdout and recent.log.

Why this answer

tail -n 20 file | tee recent.log displays the last 20 lines and writes them to recent.log. tee is used to split output to file and stdout.

Full explanation →
785
MCQhard

An administrator is configuring a custom kernel module to be loaded automatically at boot for a specialized hardware device. The module is named 'custom_hw'. Which file should be created to ensure the module is loaded at boot?

A./etc/modules-load.d/custom_hw.conf with the line 'custom_hw'
B./etc/sysconfig/modules/custom_hw.modules with modprobe commands
C./etc/modprobe.d/custom_hw.conf with 'options custom_hw param=value'
D./etc/modprobe.d/blacklist.conf with 'blacklist custom_hw'
AnswerA

This file lists module names to be loaded at boot.

Why this answer

Option B is correct because modules-load.d directory contains .conf files with module names to be loaded at boot. Option A is for module parameters; C is for blacklisting; D is not a standard configuration file.

Full explanation →
786
MCQhard

A system administrator installs a new application that is failing to write to its configuration file in /etc. SELinux is enforcing. Which command would show the relevant SELinux denials?

A.sealert
B.ausearch -m avc -ts recent
C.getenforce
D.audit2why
AnswerB

Correct: Searches audit log for SELinux denials.

Why this answer

The `ausearch -m avc -ts recent` command queries the audit log for AVC (Access Vector Cache) denial messages, which are the specific SELinux denials logged when a process is blocked from accessing a resource. This is the direct way to view recent SELinux denials in an enforcing mode environment, as it filters audit records by message type (AVC) and time range (recent).

Exam trap

CompTIA often tests the distinction between commands that show denials (ausearch) versus commands that interpret or explain denials (audit2why, sealert), leading candidates to pick a tool that requires the denial data as input rather than one that retrieves it directly.

How to eliminate wrong answers

Option A is wrong because `sealert` is a GUI tool that analyzes SELinux denial messages and provides human-readable explanations, but it does not directly show the raw denials from the audit log; it requires the denials to already be present in the audit log or to be run with a specific file. Option C is wrong because `getenforce` only displays the current SELinux mode (Enforcing, Permissive, or Disabled) and does not show any denial logs. Option D is wrong because `audit2why` interprets AVC denial messages from audit logs and explains why access was denied, but it does not show the denials themselves; it requires input from `ausearch` or a log file to function.

Full explanation →
787
MCQeasy

A file has permissions -rwxr-x---. The administrator wants to give the group write permission using symbolic mode. Which command is correct?

A.chmod 775 file
B.chmod o+w file
C.chmod u+w file
D.chmod g+w file
AnswerD

g+w adds write permission to the group, leaving other permissions unchanged.

Why this answer

Option D is correct because the symbolic mode `g+w` adds write permission to the group owner of the file. The current permissions are `-rwxr-x---`, meaning the group has read and execute (`r-x`) but not write. The `g` stands for group, and `+w` adds write, resulting in `-rwxrwx---`.

Exam trap

The trap here is that candidates may confuse the symbolic mode operators (`u`, `g`, `o`) or incorrectly choose numeric mode (like 775) when the question explicitly requires symbolic mode.

How to eliminate wrong answers

Option A is wrong because `chmod 775` uses numeric (octal) mode, not symbolic mode as specified in the question. Option B is wrong because `o+w` adds write permission for 'others' (the world), not the group. Option C is wrong because `u+w` adds write permission for the file owner (user), not the group.

Full explanation →
788
Multi-Selecthard

Which THREE statements about Ansible are true? (Choose three.)

Select 2 answers
A.Ansible playbooks are written in YAML
B.Ansible uses a centralized master server
C.Ansible requires Python on the control node only
D.Ansible is idempotent
E.Ansible requires an agent to be installed on managed nodes
AnswersA, D

Playbooks are YAML files.

Why this answer

Ansible playbooks are written in YAML because YAML is a human-readable data serialization language that allows Ansible to define automation workflows declaratively. The control node parses the YAML playbook into Python data structures, which are then executed against managed nodes via modules. This design eliminates the need for a custom domain-specific language and simplifies version control and collaboration.

Exam trap

CompTIA often tests the misconception that Ansible requires a master server (like Puppet or Chef) or that it needs agents on managed nodes, but the trap here is that Ansible is agentless and uses a simple push model from a single control node.

Full explanation →
789
Multi-Selecthard

A technician needs to find all files in /home that have the SUID or SGID permission set. Which THREE commands can accomplish this? (Choose three.)

Select 3 answers
A.find /home -perm -4000 -o -perm -2000
B.find /home -perm -6000
C.find /home -perm /6000
D.find /home -perm 6000
E.find /home -type f -perm /4000 -o -type f -perm /2000
AnswersA, C, E

Combines -perm -4000 and -perm -2000 with OR.

Why this answer

find /home -perm /6000 matches files with either SUID (4000) or SGID (2000). -perm -4000 matches SUID only, -perm -2000 matches SGID only. The / notation matches any of the bits.

Full explanation →
790
MCQmedium

Refer to the exhibit. The system log is not updating. What is the cause?

A.The syslog file size exceeded 1GB and was rotated.
B.The syslog file permissions are incorrect.
C.The root filesystem is almost full, leaving no space for log growth.
D.rsyslogd was restarted and lost its configuration.
AnswerC

df shows 95% usage on / and rsyslogd error states 'No space left on device'.

Full explanation →
791
MCQmedium

A developer creates a Dockerfile for a web application. Which instruction should be used to define the command that runs when the container starts, allowing the container to accept arguments from the docker run command?

A.START
B.ENTRYPOINT
C.CMD
D.RUN
AnswerC

CMD specifies the default command to run, and can be overridden by docker run arguments.

Why this answer

CMD provides defaults for an executing container, but can be overridden by command-line arguments. ENTRYPOINT is used for main command and CMD for default arguments.

Full explanation →
792
Multi-Selecthard

A Linux system experiences intermittent network connectivity. The administrator suspects a faulty network cable or switch port. Which TWO of the following commands can provide information about link status, errors, and packet drops on the interface? (Choose TWO.)

Select 2 answers
A.ss -i
B.ip addr show eth0
C.ip link show eth0
D.ethtool eth0
E.tcpdump -i eth0
AnswersC, D

Shows state (UP/DOWN) and error counters.

Why this answer

ip link show displays link status and error counters; ethtool can show detailed link and error statistics.

Full explanation →
793
MCQmedium

An administrator needs to check the kernel ring buffer for hardware error messages from the current boot. Which command displays this information?

A.vmstat -f
B.journalctl -k -b 0
C.cat /var/log/boot.log
D.dmesg
AnswerD

Correct: dmesg shows kernel ring buffer messages.

Why this answer

dmesg displays the kernel ring buffer, which includes hardware-related messages from the current boot.

Full explanation →
794
MCQmedium

A server is experiencing frequent kernel panics. The administrator wants to capture the crash dump for analysis. Which kernel parameter must be set to enable crash dumps?

A.panic=10
B.kdump_enabled=1
C.irqpoll
D.crashkernel=auto
AnswerD

This parameter allocates memory for the crash kernel so that a dump can be captured.

Why this answer

The `crashkernel=auto` kernel parameter is required to reserve a portion of system memory for the kdump mechanism, which captures a crash dump when a kernel panic occurs. Without this reserved memory, the crash dump cannot be written to disk because the kernel has no safe memory region to operate the dump capture kernel. This parameter is set in the bootloader configuration (e.g., GRUB) and is specific to the kdump service on Linux systems.

Exam trap

The trap here is that candidates confuse the kdump service configuration (e.g., enabling kdump via systemctl) with the required kernel boot parameter `crashkernel`, leading them to select `kdump_enabled=1` as if it were a kernel parameter.

How to eliminate wrong answers

Option A is wrong because `panic=10` sets a timeout in seconds after which the system automatically reboots on a kernel panic, but it does not enable crash dump capture. Option B is wrong because `kdump_enabled=1` is not a valid kernel parameter; the kdump service is controlled via systemd or init scripts, not a kernel boot parameter. Option C is wrong because `irqpoll` is a kernel parameter used to work around interrupt problems by polling IRQs, and it has no role in crash dump capture.

Full explanation →
795
MCQmedium

A developer wants to change all occurrences of 'foo' to 'bar' in a configuration file and save the changes in-place. Which sed command should be used?

A.sed -i 's/foo/bar/' file
B.sed -n 's/foo/bar/p' file
C.sed 's/foo/bar/g' file
D.sed -i 's/foo/bar/g' file
AnswerD

Correct: -i enables in-place editing.

Why this answer

sed -i 's/foo/bar/g' file performs an in-place global substitution. The -i flag edits the file directly.

Full explanation →
796
MCQhard

An administrator is configuring a Linux firewall to allow incoming SSH (port 22) and HTTPS (port 443) traffic while denying all other incoming traffic. Using iptables, which set of commands achieves this?

A.iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT
B.iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT
C.iptables -P FORWARD DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT
D.iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 443 -j DROP
AnswerB

Default DROP drops all incoming packets, then specific ACCEPT rules allow SSH and HTTPS.

Why this answer

Option B is correct because it first sets the default policy on the INPUT chain to DROP, which denies all incoming traffic by default. It then adds rules to explicitly ACCEPT incoming TCP traffic on ports 22 (SSH) and 443 (HTTPS), achieving the requirement of allowing only those two services while dropping everything else.

Exam trap

CompTIA often tests the distinction between the INPUT and FORWARD chains, and the trap here is that candidates mistakenly set the default policy on FORWARD instead of INPUT, thinking it controls incoming traffic to the local host.

How to eliminate wrong answers

Option A is wrong because it sets the default INPUT policy to ACCEPT, which allows all incoming traffic by default, then adds ACCEPT rules for ports 22 and 443 — this does not deny other traffic, it just redundantly accepts those ports. Option C is wrong because it sets the default policy on the FORWARD chain to DROP, but the requirement is about incoming traffic to the local system, which is governed by the INPUT chain, not FORWARD; the INPUT chain's default policy remains ACCEPT, so all incoming traffic is still allowed. Option D is wrong because it sets the default INPUT policy to ACCEPT and then adds DROP rules for ports 22 and 443, which would block SSH and HTTPS while allowing all other traffic — the exact opposite of the requirement.

Full explanation →
797
Multi-Selectmedium

Which TWO commands can be used to check the kernel version currently running on a system? (Choose two.)

Select 2 answers
A.sysctl kernel.version
B.cat /proc/version
C.lsb_release -a
D.uptime
E.uname -r
AnswersB, E

Contains kernel version string.

Why this answer

Option B is correct because the file /proc/version contains the kernel version string, including the version number and compiler information, as maintained by the kernel at boot time. Reading this file with cat displays the exact kernel version currently running on the system.

Exam trap

The trap here is that candidates may confuse distribution release information (lsb_release -a) with kernel version information, or incorrectly assume sysctl has a 'kernel.version' parameter similar to other kernel parameters.

Full explanation →
798
MCQhard

An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?

A.ops webserver=(root) /usr/bin/systemctl restart httpd
B.ops ALL=(root) /usr/bin/systemctl restart httpd
C.ops webserver=(ALL) /usr/bin/systemctl restart httpd
D.ops webserver=(root) ALL
AnswerA

This restricts to host webserver and runs as root.

Why this answer

The format is: username hostname=(runas) command. For host-specific, use the hostname. The correct entry is 'ops webserver=(root) /usr/bin/systemctl restart httpd'.

Full explanation →
799
MCQeasy

A database administrator needs to schedule a one-time system backup to run at 2:00 AM tomorrow. Which command should be used?

A.systemd-run --on-calendar='*-*-* 02:00:00' /usr/bin/backup
B.at 2:00 AM tomorrow
C.echo '/usr/bin/backup' | atq
D.crontab -e
AnswerB

Schedules a one-time job at the specified time.

Why this answer

The `at` command is specifically designed to schedule a one-time job at a specified time, making it the correct choice for a backup that runs exactly once at 2:00 AM tomorrow. It accepts natural language time specifications like '2:00 AM tomorrow' and executes the command at that moment without recurring.

Exam trap

Cisco often tests the distinction between one-time (`at`) and recurring (`cron`, `systemd-timer`) job schedulers, trapping candidates who confuse `atq` (a query command) with `at` (the scheduling command).

How to eliminate wrong answers

Option A is wrong because `systemd-run --on-calendar` uses systemd timer syntax for recurring calendar events, not a one-time schedule, and the syntax shown is for a daily recurrence, not a single execution. Option C is wrong because `atq` lists pending `at` jobs, not schedules them; piping a command to `atq` does nothing to schedule a backup. Option D is wrong because `crontab -e` edits the cron table for recurring jobs (minute, hour, day, month, weekday), not for a one-time execution.

Full explanation →
800
MCQeasy

Which file contains the hashed passwords and password aging information for user accounts?

A./etc/shadow
B./etc/gshadow
C./etc/group
D./etc/passwd
AnswerA

Contains encrypted passwords and aging data.

Why this answer

/etc/shadow stores password hashes and aging fields.

Full explanation →
801
MCQeasy

A system administrator needs to determine which process is using the most memory on a Linux server. Which command should be used to display processes sorted by memory usage?

A.top -o %MEM
B.vmstat 1 5
C.ps aux --sort=-%mem
D.free -m
AnswerC

Correctly sorts processes by memory usage descending.

Why this answer

Option C is correct because `ps aux --sort=-%mem` lists all processes with detailed information and sorts them by memory usage in descending order, showing the most memory-intensive process first. The `-%mem` flag specifies sorting by the %MEM column (resident set size as a percentage of total physical memory) in reverse order, which directly answers the requirement to determine which process is using the most memory.

Exam trap

CompTIA often tests the distinction between commands that show system-wide memory statistics (like `free` or `vmstat`) versus commands that display per-process memory usage (like `ps` or `top`), and candidates may mistakenly choose `free -m` because it shows memory usage, even though it does not identify which process is consuming the most memory.

How to eliminate wrong answers

Option A is wrong because `top -o %MEM` sorts processes by memory usage interactively, but the `-o` flag is not a valid option for the `top` command in most Linux distributions; the correct syntax is `top -o %MEM` (with a space) or simply pressing 'M' inside top, but the given command would fail or produce an error. Option B is wrong because `vmstat 1 5` reports system-wide virtual memory statistics (processes, memory, paging, block I/O, traps, and CPU activity) at one-second intervals for five samples, but it does not list individual processes or sort them by memory usage. Option D is wrong because `free -m` displays total, used, and free physical and swap memory in megabytes, but it provides no information about individual processes or their memory consumption.

Full explanation →
802
MCQeasy

A system administrator is troubleshooting a server that is experiencing periodic slowdowns. The administrator runs the 'ps aux' command and notices a process named 'cpu_burn' that is consistently using over 90% CPU. The administrator wants to identify which user is running the process and then terminate it. The server runs Red Hat Enterprise Linux 8. Which command should the administrator use to determine the owner of the 'cpu_burn' process?

A.ps -u cpu_burn
B.ps -ef | grep cpu_burn
C.top -bn1 | grep cpu_burn
D.ps -eo pid,user,comm | grep [c]pu_burn
AnswerD

This shows PID and user for the process, and the bracket trick avoids matching the grep process itself.

Why this answer

The 'ps -eo pid,user,comm' command outputs the PID, user, and command name for all processes, useful for identifying the owner of a specific process. Option A can show user but 'grep cpu_burn' will match other fields. Option B is correct as it directly greps the command name.

Option C uses 'top' which is interactive and not efficient for scripting. Option D shows all processes filtered by user, but that doesn't help find the user.

Full explanation →
803
MCQeasy

A Docker container needs persistent storage that survives container restarts. Which of the following is the recommended method to achieve this?

A.Use a Docker volume
B.Store data inside the container filesystem
C.Use a bind mount only for configuration files
D.Set the container to always restart
AnswerA

Correct. Volumes are managed by Docker and persist data.

Why this answer

Docker volumes are managed by Docker and are the recommended way to persist data, as they are independent of container lifecycle.

Full explanation →
804
MCQmedium

An administrator needs to find the line number of the first occurrence of the string 'ERROR' in a log file, ignoring case. Which command is most appropriate?

A.grep -n 'ERROR' logfile
B.sed -n '/ERROR/=' logfile
C.awk '/ERROR/ {print NR}' logfile
D.grep -in 'error' logfile
AnswerD

-i for case insensitive, -n for line numbers.

Why this answer

grep -in 'error' logfile will output the line numbers with matches, ignoring case. The first line will be shown first if no other sorting is applied.

Full explanation →
805
Multi-Selectmedium

A Linux administrator needs to add an ACL entry to grant read permission to a user named 'jdoe' on a file. Which TWO commands can be used to achieve this? (Select TWO).

Select 2 answers
A.setfacl -m u:jdoe:r file
B.setfacl --modify u:jdoe:r file
C.chown jdoe file
D.setfacl -x u:jdoe file
E.chmod u+r file
AnswersA, B

This adds an ACL entry for user jdoe with read permission.

Why this answer

Both setfacl -m and setfacl --modify can be used to modify ACLs. The -m option is the short form, and --modify is the long form.

Full explanation →
806
MCQmedium

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration should be added to /etc/ssh/sshd_config?

A.AllowUsers sshusers
B.DenyUsers sshusers
C.AllowGroups sshusers
D.PermitRootLogin no
AnswerC

This allows only users in the sshusers group.

Why this answer

Option C is correct because the `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH login to users who are members of the specified group. By setting `AllowGroups sshusers`, only users belonging to the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This matches the administrator's requirement precisely.

Exam trap

The trap here is that candidates confuse `AllowUsers` (which matches usernames) with `AllowGroups` (which matches group names), leading them to incorrectly select Option A thinking it applies to the group name.

How to eliminate wrong answers

Option A is wrong because `AllowUsers` specifies individual usernames, not groups; `AllowUsers sshusers` would only allow a user literally named 'sshusers', not members of the group. Option B is wrong because `DenyUsers` explicitly denies specific users; `DenyUsers sshusers` would block the user named 'sshusers', which is the opposite of the requirement. Option D is wrong because `PermitRootLogin no` only prevents root from logging in via SSH, but does nothing to restrict access based on group membership.

Full explanation →
807
MCQeasy

Which directory in the Linux filesystem contains essential user command binaries that are needed for booting and repairing the system?

A./usr/bin
B./bin
C./sbin
D./opt
AnswerB

Correct: /bin contains essential binaries like ls, cp, etc., needed during boot.

Why this answer

/bin contains essential command binaries required for booting and recovery.

Full explanation →
808
Multi-Selecteasy

A junior administrator needs to monitor system resource usage on a production server. Which TWO commands should the administrator use to check CPU and memory utilization in real-time? (Choose two.)

Select 2 answers
A.top
B.df
C.uptime
D.lsof
E.free
AnswersA, E

Top displays real-time CPU and memory usage along with processes.

Why this answer

The `top` command provides a real-time, dynamic view of system processes, displaying CPU usage per process, memory utilization, and overall system load. It continuously updates, making it ideal for monitoring resource usage on a production server.

Exam trap

Cisco often tests the distinction between commands that show real-time resource usage versus those that show static or historical data, and the trap here is that candidates might choose `uptime` thinking it shows CPU utilization, when it only shows load averages.

Full explanation →
809
Multi-Selectmedium

A Linux engineer needs to harden SSH access. Which TWO of the following settings should be configured in /etc/ssh/sshd_config to enhance security? (Select TWO.)

Select 2 answers
A.MaxAuthTries 6
B.PasswordAuthentication no
C.Protocol 1
D.PermitRootLogin yes
E.AllowUsers alice bob
AnswersB, E

Disables password logins, reducing risk of brute force.

Why this answer

Option B is correct because disabling password authentication forces the use of SSH keys, which are resistant to brute-force attacks and credential stuffing. This setting eliminates the risk of weak or reused passwords being exploited, a fundamental hardening step for SSH access.

Exam trap

The trap here is that candidates often confuse 'hardening' with 'increasing limits' (like MaxAuthTries) or 'enabling convenience' (like PermitRootLogin yes), when the correct hardening choices actually restrict or disable weaker authentication methods.

Full explanation →
810
MCQhard

An administrator is investigating a security breach. The attacker gained root access via an application vulnerability. The administrator needs to determine which commands were executed by the attacker after gaining access. Which log file should be examined first?

A./var/log/syslog
B./var/log/secure
C./var/log/audit/audit.log
D./var/log/auth.log
E./root/.bash_history
AnswerE

Contains the root user's command history.

Why this answer

The correct answer is E, /root/.bash_history, because this file logs the command-line history for the root user. After gaining root access via an application vulnerability, the attacker would execute commands as root, and those commands are recorded in the root user's bash history file. Examining this file provides a direct timeline of the commands executed post-compromise, which is the most efficient starting point for determining the attacker's actions.

Exam trap

The trap here is that candidates often choose /var/log/secure or /var/log/auth.log because they associate 'security breach' with authentication logs, but these logs only show how access was gained, not what commands were executed afterward.

How to eliminate wrong answers

Option A is wrong because /var/log/syslog is a general system log that records kernel messages, daemon logs, and other non-security-specific events; it does not capture individual user command histories. Option B is wrong because /var/log/secure is used on Red Hat-based systems to log authentication-related events (e.g., SSH logins, sudo usage), not the commands executed after authentication. Option C is wrong because /var/log/audit/audit.log is the Linux Audit daemon (auditd) log, which can record system calls and file accesses if configured, but it is not a default command history log and requires specific audit rules to capture shell commands.

Option D is wrong because /var/log/auth.log is used on Debian-based systems to log authentication attempts (e.g., PAM, SSH), not the subsequent command execution.

Full explanation →
811
MCQhard

You are a DevOps engineer managing a Git repository for a large development team. Your CI/CD pipeline runs automated tests on every push. Recently, developers have been pushing commits that break the build. You need to enforce that all commits pass the tests before being pushed to the remote repository. Which Git hook should you implement on the client side?

A.pre-receive
B.pre-commit
C.post-commit
D.pre-push
AnswerD

Pre-push runs after commit but before push, ensuring tests pass before code leaves the local machine.

Why this answer

The pre-push hook (option D) runs after a `git push` command is issued but before the data is actually sent to the remote repository. This allows you to run tests locally and abort the push if they fail, enforcing that only commits that pass tests are pushed. It is the correct client-side hook for this requirement.

Exam trap

CompTIA often tests the distinction between client-side and server-side hooks, and the trap here is that candidates confuse pre-receive (server-side) with pre-push (client-side), thinking any hook that runs 'before receive' will block the push on the client.

How to eliminate wrong answers

Option A is wrong because pre-receive is a server-side hook that runs on the remote repository after the push is received, so it cannot prevent the push from being sent from the client. Option B is wrong because pre-commit runs before each commit is created, not before a push, so it cannot enforce that all commits in a push pass tests. Option C is wrong because post-commit runs after a commit is created and cannot abort the commit or push, making it useless for blocking broken commits from being pushed.

Full explanation →
812
MCQeasy

A system administrator wants to ensure that the /tmp directory is mounted with noexec to prevent code execution from temporary files. Which file should be modified to persist this across reboots?

A./etc/mtab
B./etc/fstab
C./etc/sysconfig/network
D./etc/security/limits.conf
AnswerB

Used to define persistent mount options.

Why this answer

The /etc/fstab file is the system configuration file that defines how disk partitions, block devices, and remote filesystems are mounted at boot time. Adding the noexec mount option to the /tmp entry in /etc/fstab ensures that the /tmp directory is mounted with the noexec flag persistently across reboots, preventing execution of binaries from temporary files.

Exam trap

The trap here is that candidates may confuse /etc/mtab (a runtime snapshot) with /etc/fstab (the persistent configuration file), or think that modifying /etc/mtab will make changes permanent, when in fact it is overwritten on every mount event.

How to eliminate wrong answers

Option A is wrong because /etc/mtab is a dynamically generated file that lists currently mounted filesystems; modifying it does not persist mount options across reboots. Option C is wrong because /etc/sysconfig/network is used for network configuration (e.g., hostname, gateway) and has no role in filesystem mount options. Option D is wrong because /etc/security/limits.conf is used to set per-user resource limits (e.g., file size, number of processes) via PAM, not to control filesystem mount behavior.

Full explanation →
813
MCQmedium

An administrator notices that a service named 'httpd' is not running. They want to check its current status and, if inactive, start it. Which set of systemctl commands should be used?

A.systemctl list-units httpd; if inactive, systemctl run httpd
B.systemctl show httpd; if inactive, systemctl launch httpd
C.systemctl is-active httpd; if inactive, systemctl enable httpd
D.systemctl status httpd; if inactive, systemctl start httpd
AnswerD

Correct sequence.

Why this answer

systemctl status httpd shows the status; if inactive, systemctl start httpd starts it. The other options have incorrect commands or syntax.

Full explanation →
814
MCQeasy

A user reports that a Linux workstation fails to boot and displays 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

A.A filesystem listed in /etc/fstab has errors.
B.A memory module is faulty.
C.The boot loader is missing or corrupted.
D.The root filesystem device is incorrectly specified in the kernel command line.
AnswerD

The error 'unable to mount root fs' often means the root= parameter points to a nonexistent or wrong device.

Why this answer

The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate the root filesystem device. The most likely cause is that the root filesystem device is incorrectly specified in the kernel command line (e.g., via a bootloader parameter like root=), preventing the kernel from finding the correct block device to mount as root.

Exam trap

The trap here is that candidates often confuse a boot loader issue (which prevents kernel loading) with a kernel command line misconfiguration (which allows the kernel to load but fail to mount root), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because filesystem errors in /etc/fstab would typically cause a failure during the mount of additional filesystems after the root is already mounted, not a kernel panic at boot before the root filesystem is accessed. Option B is wrong because a faulty memory module usually causes random crashes, kernel panics with memory-related errors, or system instability, not a specific VFS root mount failure with unknown-block(0,0). Option C is wrong because a missing or corrupted boot loader would prevent the kernel from being loaded at all, resulting in a blank screen or a 'boot device not found' error, not a kernel panic after the kernel has started executing.

Full explanation →
815
MCQmedium

A system administrator needs to configure a daily backup that creates hard links to unchanged files to save space. Which tool and option combination is most appropriate?

A.dd if=/source of=/destination conv=sync
B.cp -al /source /destination
C.rsync -a --link-dest=/previous/backup /source /current/backup
D.tar --hard-link --create /source > /destination/backup.tar
AnswerC

rsync --link-dest creates hard links to files in the previous backup that have not changed, saving disk space.

Why this answer

Option C is correct because `rsync -a --link-dest=/previous/backup /source /current/backup` creates a new backup directory (`/current/backup`) where files unchanged since the previous backup are represented as hard links to the corresponding files in `/previous/backup`, while changed or new files are copied normally. This saves disk space by avoiding duplicate storage of identical file content, which is the exact requirement for a daily backup with hard links to unchanged files.

Exam trap

The trap here is that candidates often confuse `cp -al` (which creates hard links to the source) with the incremental backup requirement, not realizing that `cp -al` does not link to a previous backup snapshot, whereas `rsync --link-dest` explicitly references a prior backup directory for deduplication.

How to eliminate wrong answers

Option A is wrong because `dd if=/source of=/destination conv=sync` performs a low-level block copy with synchronous I/O, which does not create hard links and is not designed for incremental or space-saving backups. Option B is wrong because `cp -al /source /destination` creates a directory tree of hard links from `/source` to `/destination`, but it does not support incremental backup or linking to a previous backup set; it simply replicates the source as hard links, which does not achieve the daily backup goal of linking unchanged files across different backup snapshots. Option D is wrong because `tar --hard-link --create /source > /destination/backup.tar` creates a tar archive that preserves hard links within the archive, but it does not create hard links on the filesystem between backup directories, and it stores all data in a single archive file rather than a directory structure with hard links to unchanged files.

Full explanation →
816
MCQhard

A custom application service 'myapp.service' fails to start on a RHEL 8 system with the error: "Failed at step EXEC spawning /usr/local/bin/myapp: Permission denied". The service runs as user 'myapp'. The binary /usr/local/bin/myapp has permissions 755 and is owned by root:root. The user myapp is not in the sudoers. The administrator checks SELinux and finds the binary has the context 'unconfined_u:object_r:usr_t:s0'. The service unit file does not specify any SELinux context. What is the most likely cause of the failure?

A.The user myapp does not have read access to the binary.
B.The SELinux context of the binary is incorrect; it should be bin_t.
C.The binary is located in a directory that is not in the systemd safe path.
D.The binary is not executable by myapp due to file permissions.
AnswerB

The binary has usr_t context, which is not allowed for execution by the service; restoring to bin_t fixes it.

Why this answer

The error occurs because SELinux is enforcing and the binary has the type 'usr_t', which is not allowed to be executed by the service's domain (probably init_t or custom domain). The correct type for executables in /usr/local/bin is 'bin_t'. The solution is to restore the SELinux context to the default for binaries using `restorecon -v /usr/local/bin/myapp` or changing it to bin_t.

Option A is incorrect because permissions allow execution. Option C is unlikely because /usr/local/bin is in PATH. Option D is incorrect as user has execute permission.

Full explanation →
817
MCQeasy

A user reports that they cannot reach a remote server by hostname but can reach it by IP address. Which file should be checked first for possible misconfiguration?

A./etc/nsswitch.conf
B./etc/hosts
C./etc/resolv.conf
D./etc/sysconfig/network
AnswerC

This file contains DNS server and search domain settings.

Why this answer

Option C is correct because the /etc/resolv.conf file configures the system's DNS resolver, specifying the nameservers to query for hostname-to-IP resolution. Since the user can reach the remote server by IP but not by hostname, the issue is likely with DNS resolution, and /etc/resolv.conf is the first file to check for misconfigured or missing nameserver entries.

Exam trap

The trap here is that candidates often confuse /etc/hosts with DNS resolution, thinking a missing static entry is the cause, when the real issue is the absence or misconfiguration of DNS servers in /etc/resolv.conf.

How to eliminate wrong answers

Option A is wrong because /etc/nsswitch.conf controls the order of name service lookups (e.g., files, dns, mdns), but it does not contain DNS server addresses; a misconfiguration here would affect the lookup order, not the ability to resolve hostnames entirely if DNS servers are correct. Option B is wrong because /etc/hosts provides static hostname-to-IP mappings; if the remote server's hostname were listed there with a wrong IP, the user might reach the wrong server, but since they cannot reach it by hostname at all, the issue is not a static mapping. Option D is wrong because /etc/sysconfig/network is a Red Hat-based configuration file for network-wide settings like hostname and default gateway, not for DNS resolver configuration; it does not contain nameserver entries.

Full explanation →
818
MCQhard

An administrator needs to audit all write operations to the /etc/shadow file. Which audit rule should be added to /etc/audit/rules.d/audit.rules?

A.-w /etc/shadow -k identity
B.-w /etc/shadow -p rwxa
C.-a always,exit -S open -F path=/etc/shadow
D.-w /etc/shadow -p wa
AnswerD

This watches /etc/shadow for write and attribute changes, which includes modifications.

Why this answer

Option D is correct because the audit rule `-w /etc/shadow -p wa` uses the `-w` (watch) flag to monitor the file for write (`w`) and attribute change (`a`) permissions, which captures all write operations to `/etc/shadow`. This is the standard syntax for auditing file writes in Linux auditd, and it directly meets the requirement to audit write operations without unnecessary syscall filtering.

Exam trap

The trap here is that candidates often confuse the `-p` permission flags with syscall-based rules, mistakenly choosing option C because they think `-S open` captures all writes, but they overlook that writes can occur via other syscalls (like `write`) and that `-w -p wa` is the correct, simpler approach for file-based auditing.

How to eliminate wrong answers

Option A is wrong because `-k identity` only adds a key label to the audit record but does not specify any permission filters (`-p`), so it would log all accesses (read, write, execute, attribute change) to `/etc/shadow`, not just write operations. Option B is wrong because `-p rwxa` monitors read (`r`), write (`w`), execute (`x`), and attribute change (`a`) — this is overly broad and would generate excessive audit records for reads and executes, not just writes. Option C is wrong because `-a always,exit -S open -F path=/etc/shadow` uses the `open` syscall, which captures file opens but not all write operations (e.g., writes via `write` syscall on an already open file descriptor would be missed); it also lacks the `-p wa` permission filter that directly targets write and attribute changes.

Full explanation →
819
MCQmedium

A DevOps engineer is writing a Dockerfile for a Python web application. The base image is python:3.9-slim. The application code is in the current directory, and the container should expose port 8080. Which Dockerfile instructions correctly build the image and run the application using python app.py?

A.FROM python:3.9-slim COPY . /app WORKDIR /app EXPOSE 8080 CMD python app.py
B.FROM python:3.9-slim COPY . /app WORKDIR /app EXPOSE 8080 CMD ['python', 'app.py']
C.FROM python:3.9-slim COPY . /app EXPOSE 8080 ENTRYPOINT python app.py
D.FROM python:3.9-slim WORKDIR /app COPY . . EXPOSE 8080 RUN python app.py
AnswerB

Correct order of instructions; CMD uses JSON array form correctly.

Why this answer

The correct order is: FROM to set base image, COPY to add code, EXPOSE to document port, and CMD to specify the command to run when the container starts.

Full explanation →
820
MCQmedium

During boot, a Linux system displays a kernel panic with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

A.Incorrect time configuration in the BIOS
B.Corrupt initramfs missing a necessary kernel module for the root device
C.The /etc/fstab file has an invalid filesystem type for the root partition
D.A defective network cable
AnswerB

The kernel cannot mount root because the required driver is missing from initramfs.

Why this answer

This error indicates that the root filesystem cannot be found, often due to a missing driver for the storage device in the initramfs.

Full explanation →
821
Multi-Selectmedium

A system is experiencing boot failures. The administrator wants to view kernel messages from the current boot to diagnose the issue. Which two commands can be used to see these messages? (Choose two.)

Select 2 answers
A.journalctl -k
B.cat /proc/kmsg
C.tail -f /var/log/boot.log
D.dmesg
E.vmstat -f
AnswersA, D

journalctl -k shows kernel messages from the journal.

Why this answer

`journalctl -k` displays kernel messages from the current boot by querying the systemd journal, which logs kernel ring buffer messages persistently. `dmesg` reads the kernel ring buffer directly and shows messages from the current boot cycle. Both commands provide the kernel diagnostic output needed to troubleshoot boot failures.

Exam trap

The trap here is that candidates confuse `dmesg` with `cat /proc/kmsg` or think `boot.log` contains kernel messages, when in fact `dmesg` and `journalctl -k` are the standard tools for viewing kernel ring buffer output from the current boot.

Full explanation →
822
MCQmedium

Refer to the exhibit. A Linux administrator needs to capture all messages with priority 'alert' from the kernel facility. Which directive should be added to /etc/rsyslog.conf?

A.kern.alert /var/log/kernel_alert
B.kern.=alert /var/log/kernel_alert
C.kern.* /var/log/kernel_alert
D.*.alert /var/log/kernel_alert
AnswerA

Correct syntax for kernel facility, alert priority.

Why this answer

The kernel facility is 'kern'. 'alert' priority is one of the syslog priorities. The correct syntax is 'kern.alert' to capture only alert messages from kernel.

Full explanation →
823
MCQeasy

A Linux administrator needs to view all listening TCP ports and the associated processes on a server. Which command should be used?

A.netstat -tulpn
B.ss -tlnp
C.lsof -i
D.nmap localhost
AnswerB

Correct: ss -tlnp shows listening TCP ports with process info.

Why this answer

The ss command with -tlnp options shows listening TCP ports with process information, replacing netstat.

Full explanation →
824
MCQeasy

Refer to the exhibit. After adding a firewall rule, the web server becomes unreachable from the internal network 192.168.1.0/24. Which line is the cause?

A.Default policy (INPUT ACCEPT)
B.Missing rule for RELATED traffic
C.Line: -A INPUT -p tcp --dport 80 -j DROP
D.Line: -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
AnswerC

This rule drops all HTTP traffic, including from 192.168.1.0/24, before an ACCEPT rule.

Why this answer

Option C is correct because the firewall rule `-A INPUT -p tcp --dport 80 -j DROP` explicitly drops all incoming TCP traffic destined for port 80, regardless of source. Since the web server listens on port 80, this rule blocks all HTTP requests, including those from the internal network 192.168.1.0/24. The rule is placed before any ACCEPT rule for the same port, so the DROP action takes precedence, making the server unreachable.

Exam trap

The trap here is that candidates may focus on the source IP restriction in option D and assume it is the cause, overlooking the fact that iptables processes rules in order and a preceding DROP rule for the same port will block all traffic, including from the allowed subnet.

How to eliminate wrong answers

Option A is wrong because the default policy of ACCEPT on the INPUT chain would allow traffic by default, but the explicit DROP rule for port 80 overrides that default, so the default policy is not the cause. Option B is wrong because RELATED traffic is associated with connection tracking (e.g., FTP data connections) and is not relevant to HTTP traffic on port 80; the issue is a direct DROP rule, not a missing RELATED rule. Option D is wrong because while it correctly allows traffic from 192.168.1.0/24 to port 80, it is placed after the DROP rule (line order matters in iptables), so the DROP rule is matched first and the ACCEPT rule is never evaluated.

Full explanation →
825
MCQhard

During boot, the system drops into an emergency target. Which command can be used to repair the root filesystem from this environment?

A.mount -o remount,rw / && fsck /
B.xfs_repair /dev/sda1
C.fsck /dev/sda1
D.journalctl -xb
AnswerC

Correct; fsck can be run if the partition is unmounted or mounted read-only.

Why this answer

In emergency mode, the root filesystem is often mounted read-only. fsck can check and repair filesystems, but requires the filesystem to be unmounted.

Full explanation →
Page 10

Page 11 of 14

Page 12

All pages

1234567891011121314

Practice XK0-005 by domain

Target a specific domain to shore up weak areas.

SecurityTroubleshootingScripting, Containers, and AutomationSystem ManagementScripting, Containers and Automation
See all domains with question counts →
CompTIA Linux+ XK0-005 XK0-005 Questions 751–825 | Page 11/14 | Courseiva