CompTIA Linux+ (XK0-006) (XK0-006) — Questions 751–781

The -n test confirms the string is non-empty, and && requires the equality check to also pass. Both conditions must hold for the branch to execute, precisely matching the stem's requirement that $NAME be populated and equal to 'admin'.

The -x flag extends iostat output with per-device metrics including requests per second, average queue size and average wait time, while the 1 sets a one-second sampling interval. This directly satisfies the requirement for disk I/O statistics during high wait.

Using `setfacl -m u:username:rw file` writes a POSIX access control list entry granting that named user read and write permission, satisfying the stem's constraint of avoiding group changes or group membership edits. Standard Unix mode bits cannot grant per-user rights without altering owner, group or other classes, so ACLs are the only mechanism here.

Permissive is a valid SELinux mode: policy violations are logged but not blocked, unlike Enforcing. It satisfies the stem's requirement for a genuine SELinux operating mode, alongside Enforcing and Disabled, and is commonly used for troubleshooting before switching to enforcement.

CMD sets the default executable or arguments for a container, and any command supplied at docker run overrides it. ENTRYPOINT instead fixes the executable and requires --entrypoint to replace, so CMD satisfies the overridable default required here.

`chmod u+s file` sets the setuid bit on the file's owner-execute position, satisfying the stem's requirement to add setuid to a 644 file. The symbolic `u+s` form targets only the user (owner) permission triad, leaving the existing read and write bits untouched, which is precisely the operation requested.

The du command estimates file space usage. With -s it summarizes each argument, and -h makes the output human-readable. Running du -sh /home/* expands to each top-level directory and file under /home, giving a per-item total. This directly answers which directories consume the most space without descending into every file, making it the appropriate first step for this scenario.

`chronyc sources -v` queries the running chronyd daemon and lists configured time sources with their state, stratum, and reachability. The verbose flag adds details such as mode, poll interval, and last sample statistics. This directly shows whether the configured NTP servers are reachable and at what stratum, allowing the administrator to diagnose why synchronization is not occurring despite chronyd running.

The `last` command reads `/var/log/wtmp`, listing successful login sessions with usernames, terminal lines, source hosts and timestamps. This directly satisfies the analyst's need to examine user login history during breach investigation, showing who logged in, from where, and when.

The `-i` flag makes sed edit /etc/hosts in place, satisfying the requirement to save changes directly to the file. The `g` suffix replaces every occurrence of 'oldhost' on each line, not merely the first, meeting the "all occurrences" constraint without redirection or a temporary file.

Disables root SSH login, reducing attack surface.

hostnamectl set-hostname updates the system hostname and writes it to /etc/hostname, ensuring persistence across reboots. It is the recommended method on systemd-based distributions. This command also updates the transient hostname immediately, so the change takes effect without a reboot.

Podman is designed to be a drop-in replacement for Docker CLI.

The %wheel ALL=(ALL) ALL entry grants members of the wheel group permission to run any command as any user, identified by the leading % group prefix. This restricts sudo rights to wheel members alone, satisfying the requirement that only that group may use sudo.

chmod 640 restricts read access to root and the shadow group while removing all permissions for others, and chattr +i sets the immutable attribute so the file cannot be modified, renamed or deleted even by root until the flag is cleared.

The five fields run minute, hour, day-of-month, month, day-of-week, so `30 2 * * *` fires at 02:30 daily, satisfying the every-day-at-2:30-AM constraint. The absolute path `/usr/local/bin/cleanup.sh` executes directly, since cron's minimal environment lacks the user's PATH.

nice -n -10 launches the process with an explicit scheduling niceness of -10, raising its CPU priority relative to default-nice processes. This satisfies the stem's requirement to run the custom service at a specific priority, though negative values require root privileges.

Enabling httpd_can_network_connect_db permits the httpd_t domain to open network sockets to database ports, directly satisfying the requirement that Apache connect to a database server. Other booleans govern unrelated access, such as outbound connections generally or specific database types, so this one precisely matches the stated constraint.

The -x flag extends iostat's report with per-device statistics, including %util (device busy percentage), await (average I/O wait), and r/s and w/s throughput. The 1 argument refreshes every second, exposing the sustained disk I/O pattern the engineer needs to diagnose.

top refreshes periodically and sorts processes by CPU and memory, letting the administrator watch resident memory grow over time and pinpoint the leaking process by PID. It satisfies the need for continuous monitoring rather than a single snapshot, which free alone cannot provide.

`du -sh /*` reports the apparent disk usage of each top-level directory, with `-s` summarising each argument and `-h` rendering sizes readably. This directly satisfies the stem's need to pinpoint which directories consume the most space on the near-full root filesystem, unlike tools showing only aggregate free space.

rkhunter scans for rootkit signatures, comparing file hashes and permissions against known-good databases to flag hidden binaries, suspicious kernel modules and altered system files. This satisfies the stem's requirement for a tool specifically designed for rootkit detection, rather than general malware or vulnerability scanning.

The exhibit reports total installed memory as 7.7G, which is the sum of physical RAM recognised by the system. This figure reflects installed capacity rather than free or available memory shown separately in the output.

Creating a file requires write permission on the containing directory, not on the file itself. The group permission set is r-x, granting read and execute (traverse) but withholding write. Adding group write (rwx) satisfies the stem's constraint, allowing the 'dev' group member to create entries within that directory.

/etc/security/limits.conf defines per-user and per-group ulimit values, letting the engineer apply soft and hard resource caps to the 'developers' group through a group entry, which satisfies the requirement to restrict resource usage for that group.

Assigning httpd_log_t lets the Apache process, confined by the httpd_t domain, write to the file under SELinux type enforcement. The 664 mode and apache ownership already permit Unix-level writes, so the remaining constraint is the file's label; httpd_log_t is the type httpd_t is allowed to append to.

cgroups impose per-service CPU and memory limits by grouping processes and enforcing resource controllers, directly satisfying the requirement to stop one service starving others. Unlike nice, which only adjusts CPU scheduling priority, cgroups cap memory too, providing the hard isolation the scenario demands.

setfacl with -m modifies the ACL, and u:john:rw grants john read and write. Since the file has no existing ACLs, this creates the access ACL entry directly, satisfying the requirement without altering the traditional owner, group or other permission bits.

Traces each command before execution.

iotop displays per-process I/O usage, and the -o option shows only processes actively performing I/O. With -d 5, it refreshes every five seconds, allowing the administrator to identify the process generating heavy disk activity during the 02:00 window. This directly addresses the need to attribute I/O to a specific process.

The nosuid mount option prevents the execution of setuid and setgid programs on that filesystem. Because the requirement is to stop users from running setuid binaries from /home, this option directly satisfies it. It is a standard hardening measure for user-writable directories and works at the kernel mount level without affecting file permissions.