CompTIA Linux+ XK0-005 (XK0-005) — Questions 826–900

Why this answer

How to eliminate wrong answers

Option B is wrong because `setenforce 0` disables SELinux entirely (sets it to permissive mode), which is a drastic measure that bypasses all SELinux protections rather than fixing the specific file context issue. Option C is wrong because `restorecon -v` restores the file's SELinux context to the default policy-defined type, which would only help if the current context is incorrect and the default matches the expected type; it does not set a custom type like `httpd_sys_content_t`. Option D is wrong because `semanage fcontext -a -t httpd_sys_content_t /var/www/html` adds a persistent rule to the SELinux policy for the file, but it does not immediately apply the context to the file; a subsequent `restorecon` or `touch` is required to activate the change, so it is not a temporary fix.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because overlay2 is a storage driver and has no direct compatibility issue with the systemd cgroup driver; the warning is about cgroup driver mismatch, not storage. Option C is wrong because the 'user' directive in nginx is unrelated to container privilege reduction; the warning originates from Docker's cgroup driver check, not from nginx's runtime behavior. Option D is wrong because the log driver configuration does not cause warnings about the 'user' directive; log driver settings affect log output format and destination, not cgroup driver validation.

Why this answer

How to eliminate wrong answers

Option A is wrong because `git rebase 1m2n3o4` while on `feature/update` would replay the feature branch commits onto commit 1m2n3o4, but this would still include the 'Add new module' commit if it is part of the feature branch history, and does not create a new release branch. Option C is wrong because `git revert 2j3k4l5` would create a new commit that undoes the 'Add new module' commit, but the release branch would still contain that commit in its history, which violates the requirement to not include it at all. Option D is wrong because merging `master` into a branch based on `feature/update` would bring in all commits from master, including the 'Add new module' commit, which is explicitly unwanted.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'systemctl restart ntp' targets the legacy 'ntpd' service, which is not the active NTP service when chronyd is in use; the output shows 'NTP service: active' but does not specify the daemon, and on modern systems chronyd is the default, so restarting ntpd would have no effect or could conflict. Option B is wrong because 'ntpdate' is deprecated and often not installed by default; it also bypasses the running NTP service and can cause clock stepping that may disrupt applications, and it does not integrate with the active chronyd or ntpd configuration. Option C is wrong because 'systemctl restart chronyd' restarts the daemon but does not force an immediate synchronization; chronyd will still wait for its next scheduled poll (typically 64–1024 seconds), so the 5-minute lag would persist until the next automatic update.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `openssl ca` is used to sign a certificate request (CSR) with a CA certificate, not to generate a self-signed certificate and private key together; it requires an existing CA setup and a pre-generated CSR. Option B is wrong because while it does produce a self-signed certificate and key, it uses two separate commands (`genrsa` then `req`) chained with `&&`, which is not a single OpenSSL command as the question asks for 'one step'. Option D is wrong because `openssl x509 -req` signs a CSR using an existing key (`-signkey`), but it does not generate a new private key; it requires a pre-existing CSR and key file, so it cannot create both in one step.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because running `fsck` on an inactive logical volume will fail or cause corruption; the filesystem must be active and accessible before checking. Option C is wrong because `vgchange -ay` activates all volume groups, which is unnecessary and could interfere with other LVM states; the issue is isolated to a single LV, so targeting it with `lvchange` is more precise. Option D is wrong because `mount` will fail if the logical volume is inactive; the LV must be activated first before any mount attempt.

Why this answer

How to eliminate wrong answers

Option B is wrong because `chmod +x script.sh` adds execute permission for all three categories (user, group, others) by default when no target is specified, which is overly permissive and violates the principle of least privilege. Option C is wrong because `chmod g-x script.sh` removes execute permission from the group, which does not help make the script executable; it actually reduces permissions. Option D is wrong because `chmod a+rwx script.sh` grants read, write, and execute permissions to all users (user, group, others), which is excessively permissive and unnecessary for the administrator's goal.

Why this answer

How to eliminate wrong answers

Option A is wrong because `-A` is not a valid auditctl flag; the correct flag for appending a rule is `-a`, and the syntax `-A exit,always` is invalid and would cause an error. Option B is wrong because `-w /etc/shadow -p rwxa -k shadow` uses the watch flag `-w` with permissions `rwxa` (read, write, execute, attribute change), which audits all access types including read, but the question specifically asks to audit 'all attempts to access' the file, and while this might seem correct, the watch-based syntax is less precise for system call auditing and does not use the recommended `-a` approach for exit-based rules; more importantly, `-p rwxa` includes read (`r`), which is not necessary for auditing access attempts that modify the file, and the watch mode does not integrate as cleanly with the audit subsystem for exit-based filtering. Option D is wrong because `ausearch` is a search tool for querying audit logs, not a command to add audit rules; it cannot be used to configure auditing.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the error message is 'Input/output error', not 'Permission denied', and the user's lack of read permissions would produce a different error. Option C is wrong because the mount command shows /dev/sdb1 is present and mounted on /data, so the device exists. Option D is wrong because the mount output shows 'rw' (read-write) in the mount options, and a read-only mount would produce a 'Read-only file system' error, not an I/O error.

Why this answer

How to eliminate wrong answers

Option A is wrong because the shebang line must be on the first line of the script; if it is not, the script will still execute but will be interpreted by the default shell (usually /bin/sh) rather than bash, which may cause different behavior but not necessarily a failure to run. Option C is wrong because using #!/bin/sh instead of #!/bin/bash does not cause the script to fail to run; it simply invokes the system's default Bourne shell, which may lack some bash-specific features but will still execute the script if it is compatible. Option D is wrong because a byte order mark (BOM) at the start of the script is a Unicode encoding artifact that can cause the shebang line to be misinterpreted, but it is less common than carriage return issues and typically results in a 'bad interpreter' error similar to \r, but the question specifically tests the more frequent Windows-to-Linux line-ending problem.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a missing service binary would cause a different error, such as 'Exec format error' or 'Unit not found' when trying to execute the binary, not a parsing failure. Option C is wrong because a missing dependency typically results in 'dependency failed' or 'unit not found' errors, not an 'Invalid argument' syntax error. Option D is wrong because a masked service produces 'Unit is masked' or 'Failed to start unit: Unit is masked' errors, not a syntax-level parsing failure.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B (`chacl`) is wrong because `chacl` is used to change or set ACLs, not to view them; it requires an ACL specification as an argument and modifies the ACL rather than displaying it. Option C (`lsacl`) is wrong because there is no standard Linux command named `lsacl`; the correct command to list ACLs is `getfacl`, and `lsacl` is not a valid utility. Option D (`aclshow`) is wrong because `aclshow` is not a standard Linux command; it may be confused with `getfacl` or a command from a non-standard package, but it does not exist in typical Linux distributions.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `rescue` is not a valid GRUB command; it is a mode in systemd or anaconda, not used at the GRUB prompt. Option B is wrong because `reboot` is a system command, not a GRUB command; at the GRUB prompt, you would use `reboot` only after exiting GRUB or from the OS shell. Option D is wrong because `exit` in GRUB returns to the previous menu or the BIOS/UEFI boot selection, but does not attempt to load the operating system.

Why this answer

How to eliminate wrong answers

Option A is wrong because `set -u` treats unset variables as an error and causes the script to exit when referencing an undefined variable, but it does not affect how glob patterns are expanded when no files match. Option B is wrong because `set -e` causes the script to exit immediately if any command returns a non-zero exit status, but it does not change the behavior of glob expansion; a failed glob pattern would still be passed as a literal string, potentially causing a command failure that `set -e` would then propagate. Option C is wrong because `shopt -s failglob` causes the shell to print an error and exit if a glob pattern matches no files, which is the opposite of preventing script failure — it would actively cause the script to fail.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `docker exec` is used to run a command inside an existing container, not to create or start a new container; it does not accept `-d` for detached mode in the same way, and `-p` is not a valid flag for `docker exec`. Option C is wrong because `docker start` is used to start an existing stopped container, not to create a new one; it does not accept `-p` for port mapping, and the `nginx` argument would be interpreted as a container name, not an image. Option D is wrong because `-it` runs the container in interactive mode with a TTY, not detached mode; the question specifically requires detached mode (`-d`).

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the script were not executable, the cron job would fail with a 'Permission denied' error, but the cron daemon would still attempt to run it and send a failure notification; however, the exhibit shows a syntax error, not a permission issue. Option B is wrong because while a missing shebang line can cause the script to be interpreted by the default shell (often /bin/sh), which might still work, it would not directly cause an unmatched if statement error; the exhibit explicitly shows an 'unexpected end of file' error due to missing 'fi'. Option C is wrong because if the cron daemon were not running, no cron jobs would execute at all, and the administrator would not receive a failure email for a specific job; the email indicates the daemon is active and attempted the job.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a missing SSH key causes an authentication failure (e.g., 'Permission denied (publickey)') during the connection phase, not a YAML syntax error during parsing. Option C is wrong because an invalid module name results in a module-specific error (e.g., 'ERROR! couldn't resolve module/action'), not a YAML syntax error. Option D is wrong because playbooks are not executed as standalone scripts; Ansible runs them via the `ansible-playbook` command, so the executable bit is irrelevant — the error would be a 'Permission denied' if the file were executed directly, not a YAML syntax error.

Why this answer

How to eliminate wrong answers

Option A is wrong because `usermod -e` sets the account expiration date (in YYYY-MM-DD format), not the password aging interval; `-e 90` would be interpreted as a date offset from epoch, not a day count. Option C is wrong because `passwd -x 90` is not a valid syntax; the `passwd` command uses `-x` to set maximum password days, but it requires the username immediately after the option (e.g., `passwd -x 90 jsmith`), and even then it is less commonly used than `chage` for policy enforcement. Option D is wrong because `chfn -f 90` changes the user's full name (GECOS field), not password expiration; `-f` expects a string, not a numeric day value.

Why this answer

How to eliminate wrong answers

Option A is wrong because package integrity issues (e.g., corrupted RPM database or missing files) would typically produce errors like 'File not found' or checksum mismatches, not 'Permission denied'. Option B is wrong because DNS resolution failures cause 'Name or service not known' or timeout errors, not permission-related denials. Option C is wrong because firewall rules block network traffic at the packet level, producing 'Connection refused' or 'No route to host' errors, not 'Permission denied' which is a local filesystem or security context issue.

Why this answer

How to eliminate wrong answers

Option A is wrong because `maxcpus=1` limits the system to a single CPU core, which severely reduces parallel processing capability and is counterproductive for high-performance computing workloads. Option C is wrong because `acpi=off` disables Advanced Configuration and Power Interface, which can cause loss of power management, thermal control, and hardware enumeration features, but does not directly affect NUMA behavior. Option D is wrong because `noapic` disables the Advanced Programmable Interrupt Controller, which may affect interrupt routing but has no impact on NUMA memory access or latency.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `ls -l` shows only the traditional Unix permission bits (owner, group, other) and cannot display extended ACL entries that might be blocking file creation. Option C is wrong because `setfacl` is used to modify or set ACLs, not to view them; using it without the `-g` or `-m` options would not show current ACLs. Option D is wrong because `chmod` changes the basic permission mode bits and cannot read or display ACL entries.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Requires=' creates a hard dependency that will cause the service to fail if network-online.target is not started, but it does not enforce ordering; the service could start before the target unless 'After=' is also used. Option B is wrong because 'Wants=' creates a soft dependency that attempts to start network-online.target but does not enforce ordering; the service may start before the target completes. Option C is wrong because 'BindsTo=' creates a stronger dependency than 'Requires=' where the service will stop if network-online.target stops, and it also does not imply ordering; it is used for tightly coupled services, not for simple startup sequencing.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the system does not fall back to mounting by device name; fstab entries with UUID= take precedence, and if the UUID is invalid, the mount fails outright. Option B is wrong because Linux does not prompt for a UUID during boot; the boot process either succeeds or fails based on fstab, with no interactive correction mechanism. Option C is wrong because while the system may boot partially, the missing /home mount is considered a critical failure (unless 'nofail' is set), causing the boot to halt or drop to emergency mode, not simply continue without mounting.

Why this answer

How to eliminate wrong answers

Option A is wrong because `$(ls *.txt)` uses command substitution to run `ls`, which parses its output and can break on filenames with spaces, newlines, or glob characters; it also forks an unnecessary subshell. Option C is wrong because `'ls *.txt'` is a literal string (single quotes prevent expansion), so the loop would iterate over the single string `ls *.txt` instead of actual filenames. Option D is wrong because the syntax `for FILE = *.txt` uses an equals sign instead of the required `in` keyword, which is a syntax error in bash.

Why this answer

How to eliminate wrong answers

Option A is wrong because the setgid bit alone only forces group ownership inheritance; it does not control the permissions applied to new files, which are still subject to the user's umask. Option B is wrong because the sticky bit restricts file deletion to owners or root; it does not affect ownership or permissions of new files. Option C is wrong because ACL default permissions alone set the permissions for new files but do not enforce group ownership inheritance; without the setgid bit, new files may be owned by the user's primary group, not 'engineers'.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because checking the ARP cache (`arp -a`) would only be useful if the server had a valid route to the gateway but the MAC address resolution failed; here, the ping fails entirely, indicating a routing or connectivity issue, not an ARP resolution problem. Option B is wrong because replacing the network cable is a physical-layer troubleshooting step that should be performed only after verifying that the interface is up and has a link (e.g., via `ip link` or `ethtool`); the question states the interface has the correct IP, suggesting the link is likely up. Option C is wrong because restarting the network service is a disruptive, shotgun approach that may temporarily reset configurations but does not diagnose the root cause; it should be reserved for cases where configuration changes have been made or the service is misbehaving, not as a first diagnostic step.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `openssl req -new -key key.pem -out csr.pem` only generates a Certificate Signing Request (CSR), not a self-signed certificate; it requires a CA to sign the CSR to produce a certificate. Option C is wrong because `openssl ca -in csr.pem -out cert.pem` assumes a CA infrastructure is already set up and configured, and it signs an existing CSR using the CA's own key and certificate, which is not a self-signed certificate generation process. Option D is wrong because `openssl x509 -req -in csr.pem -signkey key.pem -out cert.pem` creates a self-signed certificate from a CSR, but it requires a CSR to already exist (generated by a separate command), making it a two-step process that is less direct than Option A; more importantly, it does not generate the private key, so it is incomplete for the stated requirement.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because chmod 755 sets group permission to r-x (5), which does not include write permission, so the user still cannot write. Option C is wrong because chmod 777 grants write permission to everyone (owner, group, and others), which is overly permissive and violates the principle of least privilege; it would work but is not the minimal correct solution. Option D is wrong because chmod 700 sets group permission to --- (0), removing all group access, which would prevent the user from even reading or executing the directory.

Why this answer

How to eliminate wrong answers

Option A is wrong because 660 grants read and write to both owner and group, which would allow members of the group (often 'shadow') to read password hashes, violating the principle of least privilege. Option C is wrong because 644 grants read access to everyone, exposing password hashes to all users on the system. Option D is wrong because 640 grants read access to the group, which is still too permissive for a file containing sensitive password data.

Why this answer

How to eliminate wrong answers

Option A is wrong because `setfacl -m u::rwx,g::rwx,o::---` sets permissions for the file owner and group owner (not the 'adm' group) and does not change group ownership or set the setgid bit on the directory; it also grants execute to the group, which is unnecessary for a log file. Option C is wrong because `chown :adm /var/log/secure` changes only the group of the file, but `chmod 640` gives read to the owner and group, and does not restrict access exclusively to the 'adm' group (the file's group is 'adm', but other users have no access, which is correct for the file, but it fails to ensure new files in /var/log inherit the 'adm' group because it does not set the setgid bit on /var/log). Option D is wrong because `usermod -aG adm $(whoami)` adds the current user to the 'adm' group but does not change the group ownership of /var/log/secure or /var/log, and `chmod 640` does not enforce inheritance for new files; it also does not restrict access to only the 'adm' group if the file's group is not 'adm'.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'no_all_squash' does not prevent root access; it actually preserves the UID mapping, including root, which is the opposite of what is required. Option B is wrong because 'insecure' allows clients to connect from non-privileged ports (1024 or higher), violating the requirement to use a privileged port. Option D is wrong because 'no_root_squash' allows root users on the client to retain root access to the share, directly contradicting the requirement to prevent that.

Why this answer

How to eliminate wrong answers

Option B is wrong because `fdisk -l` lists partition tables on block devices, not directory-level disk usage. Option C is wrong because `ls -lh` lists file and directory names with sizes, but it does not compute recursive disk usage for directories. Option D is wrong because `df -h` shows filesystem-level free and used space, not per-directory usage.